Priya Nathan coordinated admissions for a group of four independent schools that shared a governing board but kept their own campuses, calendars and traditions. Families applied to one campus, sometimes two, and expected the group to behave like a single institution.
One autumn, a family moving from another country applied to the middle school on the hill campus and, a few weeks later, to the sixth form at the riverside campus. Between them travelled a school report, a medical questionnaire, two teacher references and a long email about a learning support plan.
Each document arrived separately. Some went to a shared mailbox, some to a personal inbox, one arrived as a printed form scanned by a receptionist. When a teacher at the second campus asked whether the family had already submitted a support plan, nobody could answer without asking the family again.
The same story in many institutions
Schools hold a particular kind of record. It is personal, it is produced by several people, and it is expected to remain useful for years.
The difficulty is rarely storage. It is that the record is assembled across campuses, by staff with different roles, using whatever channel is closest. Admissions offices, learning support teams, finance offices and nurses may each hold a piece.
Families notice the seams. Being asked to resend a document that was already sent suggests that the institution is not paying attention, even when the opposite is true. Meanwhile staff, trying to be helpful, forward sensitive material to colleagues who are easier to reach than whoever is formally responsible.
What is actually happening underneath
A record has two parts that are easy to confuse: the content and the permissions attached to it. When a file is attached to a message, the content travels and the permissions stay behind.
A managed system keeps the two together. Access control lists describe which roles may see a category of document. A learning support plan might be visible to the support team and the head of campus, but not to every teacher who happens to teach the child.
Encryption protects the content in transit and at rest, which matters less for the technology than for the assurance it gives. Audit logging records who viewed a file, and that record is what allows a school to answer a question about its own handling rather than guessing.
Retention is the quiet piece. Schools are often required to keep some records for a set period and to delete others. Written plainly, a retention rule says what to keep, for how long, and who approves deletion. Without it, old files tend to accumulate in mailboxes long after a child has left.
De-duplication also plays a role. If one applicant record exists per family rather than per campus, a document submitted once is submitted once.
What this looks like when it works
The group eventually created a single applicant record per child, with campus preferences attached as attributes rather than as separate folders. Uploaded documents landed in that record; staff opened them through roles defined by their function.
Many organizations explore unified office security platforms like Ping64 as one option to streamline sensitive file protection workflows.
The practical effect was modest and welcome. A teacher at the second campus could see that a support plan existed and request access, rather than asking the family to send it again.
What this means for teams
Admissions staff spend less time on retrieval. The question shifts from who has the file to whether the person asking should see it, which is a clearer question to answer.
Teachers and support staff gain context without gaining everything. Someone teaching a child for one term may need to know about a reading plan but not about a family's financial arrangement, and role-based access makes that distinction ordinary rather than awkward.
Families experience fewer repetitions. That may sound small, but in admissions the tone of the process shapes whether a family believes the school will look after a child well.
Where the approach stops working
Access rules do not resolve disagreements about who should know what. Two campuses may hold different views on whether a teacher sees a support plan, and software cannot settle that.
Classification still depends on judgement. If a questionnaire is filed as general correspondence rather than as health information, the protections meant for it may not apply. Systems inherit the care, or the carelessness, of the people filing.
There are practical limits. Smaller schools may lack anyone to maintain roles and review logs. Families sometimes send documents by whatever channel they prefer, and those arrive outside the managed record. Automated retention can also delete something a school later wishes it had kept, so human review still has a place.
Closing reflection
Schools are asked to be both personal and orderly, and those two aims pull in different directions. A family wants to feel known; an institution has to behave consistently across staff who change every year.
Groups that treat record handling as part of pastoral care, rather than as an administrative burden, tend to describe it in similar terms. The file is not the relationship. It is the memory of it, kept well enough that the next adult who meets the child starts from the right place.
References
- NIST Special Publication 800-53, Security and Privacy Controls: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- NIST Privacy Framework: https://www.nist.gov/privacy-framework
- MITRE ATT&CK knowledge base: https://attack.mitre.org/
- ENISA, European Union Agency for Cybersecurity: https://www.enisa.europa.eu/
Top comments (0)