It is fairly well established that a journalist does not have liability personally for receiving information distributed without authorization by someone with a duty to maintain a government secret. On the other hand, personally stealing such secrets or soliciting someone to do so for you is probably some form of illegal espionage.
There is ongoing litigation, and the answer is not uniform in all jurisdictions, over whether a journalist may be compelled by subpoena to reveal a confidential source who illegal disclosed a government secret, or whether a journalist's sources are subject to a legal privilege not to testify. Most journalists compelled to testify by subpoena decline to do so anyway despite being incarcerated for contempt of court.
Receipt of a private trade secret knowing that it is misappropriated is a basis for a civil action for damages and injunctive relief, even for a journalist, although the issues of a privilege for confidential sources is the same and unresolved. A journalist is not authorized to personally steal, or to solicit another to steal, a trade secret which is a crime.
For secrets other than trade secrets and national security secrets there is less well developed law and different domains have different consequences. The consequences of leaking private educational information are probably minimal or non-existent.
For example, I haven't seen any law considered HIPPA protected secrets stolen by, solicited by, disclosed to, or revealed by journalists. I have no strong sense of how such a case would come out, and that resolution would depend upon how the case was presented to the courts and by whom.
There is also a common law privacy tort for revealing private or confidential facts, which is acknowledged in the Restatement (Second) of Torts, but is far from universally adopted by all jurisdictions in the U.S. as a private common law basis for a lawsuit, and this has to be balanced against First Amendment concerns.
There is case law out there that shields journalists from business torts (e.g. intentional interference with contract) that amount to defamation claims, by the same defenses that apply to a defamation claim. But that doesn't necessarily resolve the separate kinds of interests inherent in a privacy tort claim.
