I worked in medical research for a long time, though not as an author of research papers, merely as a data gatherer. Because of HIPAA, we were scrupulous about scrubbing the data of any "PHI" (patient health information) that might be traceable to individuals. However, aggregate data was sufficient for research studies and many papers were written using data I helped collect (using computers in various ways). I worked for Regional Heart and Vascular Data Services in the Providence network of hospitals.
At a recent Open Source Convention (OSCON) I attended a talk on FERPA and its implications. This seemed somewhat familiar ground.
Whereas I don't necessarily share Bishop's or Milgram's views about a lot of things, I do agree there are two sides to this story and I don't see the desire / need to verify education research as in any way unethical.
Student identities and records may be protected even as aggregate numbers are released to the public. If there's no way for independent researchers to verify the data, then it shouldn't count as publication-worthy scientific research.
This seeming truism is not followed in a lot of what calls itself science though. In the genetically modified food business, you will find companies seeking court assistance in making it illegal to verify / study various claims, because of trade secrets and/or patents. The companies strictly control who gets access to the raw data and the means to produce it. The same is true of some tobacco research. Is it science if it's secret? Maybe it's just useful and lucrative knowledge.