As an associate registrar at Berklee College of Music, the author is responsible for ensuring the College's compliance with the Family Educational Rights and Privacy Act of 1974 (FERPA). In 2009 he was asked to be part of a team charged with assessing Berklee's conformity with a soon-to-be-enacted state regulation. The Massachusetts Department of Consumer Affairs and Business Regulation soon would enact 201 CMR 17.00--Standards for the Protection of Personal Information of Residents of the Commonwealth--which would set new standards for all Massachusetts business entities to protect the personal information of the state's residents. While FERPA focuses broadly on safeguarding education records, the Massachusetts regulation focuses specifically on protecting a resident's social security number (SSN), driver's license or state-issued identification card number, and financial account number(s) or credit/debit card number(s). These are the keys to identity theft. The Massachusetts regulation and FERPA overlap: All students who apply for federal financial aid must disclose their SSNs to the schools to which they apply. In turn, many colleges rely on students' SSNs (which appear on their transcripts) as the most efficient way to identify students receiving transcript credit. As increasing numbers of people change their names--or use hyphenated names and/or first name/last name combinations--no single data element provides such quick and certain identification of a person as an SSN. In this article, the author describes how the new Massachusetts law motivated Berklee to improve its FERPA compliance, including its protection of students' grades, addresses, identification numbers, and immunization records.