Many institutions collect their most sensitive student information through generic web forms that cannot prove compliance, enforce proper access controls or maintain adequate audit trails.