Getting your son to sign a release is the right way but not the only way, As part of the deal for paying for college, our daughter gave up password access to her schools portal. We could see every grade, bill and assignment. We mainly look at the financial data but did check academic progress to make sure she was on track. No five year plan for us.
It might work to explain to you son why you need the information. Since it sounds like both parents are paying the bills independently and without much communictaion (sorry if I am off base), he needs to understand the need for you to make sure everything is paid. If he is a freshman, he might not understand how fast schools cancel regristration if money is owed. Explain that since you are paying, you have a basic need to verify things are going as planned. That will be a hard sell but hey most of us have some basic conditions for financial support. Generally those conditions hold as long as the money is flowing. Even adults have to follow their bosses rules to get paid. It’s life.
I would rethink your view on the medical FERPA. While your doctor was trying to protect her privacy, I suspect his main goal with a teen was to get honest answers to serious issues that your child might not disclose with you in the room. Also it gives your child the chance to ask what they feel are embarassing questions. Isn’t that part of what you are paying your doctor for? In my case, I made it VERY clear that any heath issues were between my daughter and her doctor unless it was a serious medical problem. I felt it was important that she felt she could discuss anything with her doctor. Luckly, my daughter is comfortable sharing info so it works for us.