FERPA allows emailing confidential information to a student email on record if the university controls the email account. Most universities offer their own email service (and require using it) for this exact reason.
There is no more risk of access to email than there is to Canvas. They are usually secured by the same SSO, too.
However, congratulations for finding the exact dodge around implementing a useful feature. Back when I worked at a university, it was apparent we had a “toolbox” of reasons to deny requests we didn’t want to do: HIPAA, FERPA, ERISA, PCI, GLBA, Title IX, ADA.
“We can’t do that integration with student health services due to HIPAA concerns.”
“We can’t implement that sign up form due to FERPA.”
“We can’t update that site because we’d have to do so and be ADA compliant and that would cost too much.”
“Due to Dining Services’ server being in scope for PCI, we can’t run reports off of it.”
“Adding that ability to Student Affairs’ portfolio app would raise Title IX concerns.”
It was great. You had endless excuses to say why you can’t email a student their grade.
