An unauthorized person retrieves information from a computer screen that was left unattended. Under FERPA, is the staff member or institution responsible?

Information on a computer screen should be treated the same as printed reports.
The medium in which the information is held is unimportant. No information should be left accessible or unattended, including computer displays.