Again, my issue is with the emotional driving this discussion, exemplified by this post. There are no actual substantive arguments in your post, just things that you 'think' or 'feel'.
"You can't request all students all of their medical records without a cause." Yes, you can.
"For one, if a student claims discrimination for X condition later down the line, then the school is in big trouble." Which is what HIPAA compliant security is for, just like hospital databases. Further, any data breach will land a school in trouble. I fail to see how sentence one connects with sentence two.
"Two, school doesn't necessarily have the resources to safeguard the confidential health information, which is a lot since you are asking for all medical records for each student." I don't think that you know anything about "the resources to safeguard the confidential health information", thus it seems odd that you would try to make a claim based on this. Resources to protect 12,000 patients and their records was affordable on my resident salary for my research (was re-reimbursed by the hospital, but making the point). A school a) has more resources than me and b) will have to protect far less records than me.
"If that type of info leaks out somehow, then the school is again in trouble." This is true for many things. That doesn't mean that you CAN'T collect the information.
"The list goes on and on. I am no lawyer, but I am pretty sure schools can't do that (and I don't see any legitimate source any school is currently doing that)." No, the list does not go on and on. You are no lawyer. There are no schools that I am aware of that are doing it, I doubt they exist and I certainly wouldn't support them doing it. But, I'm sorry, you are woefully ignorant on this topic.