From the AMCAS instruction book:
The AAMC recognizes its responsibility to treat with care the information it
collects about individuals involved in medical education, and to respect their
privacy relative to sensitive data concerning them. To meet this obligation, the
Association has developed policies to prevent the exposure of truly confidential
personal data without the permission of the individual involved, to limit the
distribution of sensitive data to those situations which require it, and to permit
distribution of non-sensitive, directory information wherever a useful purpose
can be served.
Directory information consists of lists of students attending each medical
school, lists of graduates of each medical school with year of graduation, and
lists of residents participating in each program of graduate medical education.
For identification purposes, birth dates and Social Security Numbers are
sometimes exchanged on a confidential basis with certifying boards and other
organizations involved in medical education to accompany this directory
information in order to assure that credentials are attributed to the proper
person.
Information about applicants and students is, of course, disclosed to the
schools to which a student applies or matriculates. Each medical school
authorizes the Association to circulate the names of accepted applicants for
each entering class after all deadlines have passed, but before classes have
begun. Information submitted to the AAMC by a medical school is available
only to that institution, except for the accepted applicant lists discussed above.
Medical schools also provide information to the AAMC about the entrance,
dismissal, transfer, withdrawal and graduation of students, and residency
program directors provide information about participation in graduate medical
education. Such information permits the Association to maintain accurate
records of the number of enrolled students and residents and their mobility.
Information relating to medical school applicants, students and residents from
various sources is published in the form of aggregate statistics, such as the
tables found in Medical School Admission Requirements and other AAMC
annual publications. Except for directory information as defined above and
communications with the schools as a part of the application and record
keeping process, information about individual students is not shared with
anyone in a way which would permit individual identification.
Any personally identifiable data submitted by an applicant will be made
available to that applicant upon written request. Where archival data from prior
years is requested, a fee may be assessed to cover retrieval costs.