Am I allowed to show properly redacted exams to a colleague to determine if cheating occurred? On an exam I recently administered, I discovered that several students had turned in essentially the same solutions for multiple questions. Before launching an academic dishonesty investigation, however, I want to make sure that it's not just "in my head" after reviewing too many exams in a row, or some other similar problem.

If I'm in the US, does the Family Educational Rights and Privacy Act (FERPA) preclude me from showing a redacted version of the exam—one in which names and ID numbers have been removed, for instance—to a departmental colleague to get a second opinion? If so, then how can someone get a second opinion on whether everything is above board or not?
FERPA permits education records to be shared with school officials who have a "legitimate educational interest" in them. Examples of a "legitimate educational interest" include (via University of Northern Iowa):


  
  Performing appropriate tasks that are specified in his/her position description or by a contract agreement.
  Performing a task related to a student's education.
  Performing a task related to the discipline of a student.
  Providing services for the student or the student's family, such as health care, counseling, job placement, or financial aid.
  


Also, if the student is not personally identifiable from the anonymized exam paper, then the papers are not protected by FERPA at all. Via Wayne State University:


  With specific exceptions, FERPA defines “an educational record” quite broadly and it is not limited to “academic” records.  “Education records” include virtually all records maintained by an educational institution, in any format, that are “directly related” to one or more of its past or present students.  A record is “directly related” to a student if it is “personally identifiable” to the student. A record is “personally identifiable” to a student if it expressly identifies the student on its face by name, address, ID number, or other such common identifier.
  
  A record is also personally identifiable if it includes “other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty” – in other words, if it contains enough demographic or other information that it points to a single student.