You know that notebook. Chen — dad called again, sounds stressed about tuition.Maybe it's a Notes app on your phone. So naturally, the one where you scribble "J. The one with the coffee stain on the corner. That's why martinez — keeps asking about grad school but hasn't requested a transcript" or "K. Even so, " Maybe it's a legal pad. Maybe it's sticky notes stuck to your monitor like wallpaper Less friction, more output..
Short version: it depends. Long version — keep reading.
Here's the thing: those notes? They might be the only records you have that aren't legally accessible to the student Took long enough..
What Is a Sole Possession Record
Under FERPA — the Family Educational Rights and Privacy Act — most records a school keeps on a student are "education records.Also, " That means the student (or their parent, if the student's under 18) has a right to see them. Request them. Challenge them. Even amend them.
But there's a narrow exception. A sole possession record is a record that meets all of these criteria:
- It's kept in the sole possession of the maker
- It's used only as a personal memory aid
- It's not accessible or revealed to any other person — except a temporary substitute
That's it. On top of that, three bullets. Sounds simple. In practice? It's where good intentions go to die Simple, but easy to overlook..
The "sole possession" part
This doesn't mean "I'm the only one who knows my password.No shared drive. Consider this: you maintain it. In practice, no Google Doc with "view access" for your supervisor. " It means literally sole possession. No departmental folder. You control it. Plus, you created it. If your colleague can open it, it's not sole possession anymore It's one of those things that adds up..
The "memory aid" part
This is where most people trip. The record has to exist for you — to jog your memory later. Not to document a decision. Not to create a paper trail. Not to "cover yourself." If you're writing it thinking "this might be useful if someone asks questions later," you've already crossed the line.
The "not accessible" part
This is the strictest one. Not accessible to any other person. Not your boss. Not the registrar. That's why not the student's advisor. Which means not IT. The only exception? A temporary substitute — someone covering for you while you're out. And even then, only for the duration of your absence. The moment you're back, that access evaporates.
Why It Matters / Why People Care
FERPA gives students the right to inspect and review their education records. That right is broad. That's why "Education record" is defined as any record directly related to a student and maintained by the institution (or a party acting for the institution). Now, emails. Which means spreadsheets. Notes in a CRM. In real terms, disciplinary files. Financial aid worksheets. All of it Not complicated — just consistent..
People argue about this. Here's where I land on it.
Except sole possession records.
That exemption matters because it protects your professional judgment space. You need room to think, to form impressions, to track context that hasn't crystallized into official action yet. If every scribbled thought became a FERPA-accessible record, advisors would stop writing things down. Worth adding: or they'd write sterile, defensive notes. Neither serves the student.
But — and this is critical — the exemption is narrow by design. Congress didn't want schools hiding behind "personal notes" to avoid transparency. Courts and the Department of Education have consistently ruled against schools that stretch the definition.
Real stakes
A student files a complaint. Practically speaking, oCR (Office for Civil Rights) investigates. They request all records related to the student. That said, your sticky notes get subpoenaed. If they don't meet the three-part test, they're education records. In practice, you should have produced them. Which means you didn't. Now you're in a FERPA violation hearing.
Or: a student requests their file. Still, you hand over the official folder. That said, they later discover you kept a separate notebook with "subjective impressions. Still, the court asks: was this a sole possession record? Here's the thing — " They sue. If the answer is no, you violated their access rights Not complicated — just consistent..
These aren't hypotheticals. They happen.
How It Works (or How to Do It Right)
Let's walk through what this looks like in daily practice — and where the boundaries live.
The advisor's notebook
You meet with a student. They're struggling. You jot: "Seems overwhelmed. Day to day, mentioned family pressure. Referred to counseling.
Is this a sole possession record?
Maybe. If:
- You keep the notebook locked in your desk
- No one else sees it — ever
- You use it only to remind yourself before the next meeting
- You don't share it with the counseling center, the dean, or your chair
But the moment you:
- Mention the note in an email to a colleague ("Per my notes, she mentioned family pressure...")
- Bring it to a case conference
- Leave it on your desk where a student worker could photograph it
- Scan it into the student's electronic file
...it's an education record. Full stop.
The "temporary substitute" exception
Say you're on medical leave. Consider this: your colleague covers your caseload. You can give them access to your sole possession records — but only for the duration of your absence Which is the point..
This isn't a loophole. It's a narrow, time-bound necessity.
Electronic notes
Here's where it gets messy. Most of us don't use paper anymore.
A Word doc on your local hard drive? Potentially sole possession — if no one else has access, it's not backed up to a shared server, and IT can't pull it.
A note in the SIS (Student Information System)? Consider this: **Never. ** That's an institutional system. Day to day, it's maintained by the institution. But it's accessible to others with permissions. It's an education record.
A note in your personal OneNote/Notion/Obsidian synced to the cloud? Risky. If your institution's IT manages the account, they can access it. If it's a personal account but you use it for work, you've blurred the line. The safer answer: don't do it.
The "personal memory aid" test
Ask yourself: If this note disappeared tomorrow, would I still be able to do my job?
If the answer is "yes, it's just for my own recall" — you're closer to sole possession Still holds up..
If the answer is "no, this documents a decision / creates a record / informs others" — it's an education record Simple, but easy to overlook. That's the whole idea..
Be honest with yourself. The law doesn't care what you call it. It cares what it is Worth keeping that in mind..
Common Mistakes / What Most People Get Wrong
Mistake 1: "I labeled it 'personal notes,' so it's protected."
Labels don't matter. Consider this: content, control, and use matter. You can title a spreadsheet "MY PRIVATE THOUGHTS — DO NOT OPEN" and if it lives on the shared drive, it's an education record.
Mistake 2: "I only share it with my supervisor."
That's sharing. Full stop. The exception is only for a temporary substitute during your absence. Your supervisor is not a temporary substitute Simple, but easy to overlook..
Mistake 3: "It’s in my locked desk drawer, so it’s safe."
Physical security doesn’t override FERPA. If others in your office or department can reasonably access the notes (e.g., your administrative assistant, a colleague covering for you, or even a student worker who might clean your office), it’s no longer sole possession. The key is whether you maintain exclusive control. A locked drawer in a shared space isn’t enough—if there’s potential for others to view it, treat it as an education record That's the part that actually makes a difference..
Mistake 4: "The student signed a release form, so I can share it."
Students cannot waive their FERPA rights. Even if a student provides written consent to share their information, you must still comply with institutional policies and legal requirements. A release might allow disclosure in specific cases, but it doesn’t transform an education record into a non-record. Always verify with your institution’s legal team before acting on such forms.
Mistake 5: "I can keep these notes indefinitely for future reference."
Education records are subject to retention and destruction policies. Sole possession notes may seem temporary, but if they’re retained long-term or become part of a student’s ongoing file, they fall under FERPA’s scope. Follow your institution’s guidelines for archiving or purging records—hoarding notes “just in case” invites compliance risks.
Mistake 6: "I’ll use my personal email to document this quickly."
Using personal accounts for work-related communications blurs professional boundaries and exposes records to unintended scrutiny. If your institution’s IT department manages your email account, or if personal emails are accessed during audits or legal proceedings, those notes could be deemed education records. Use approved institutional systems to ensure clarity and compliance.
Best Practices for Staying FERPA-Compliant
- Use Institutional Systems: Store all student-related notes in secure, FERPA-compliant platforms designated by your institution. Avoid personal devices, cloud apps, or informal tools.
2
2. Document Only What Is Necessary and Relevant
Once you need to record an interaction, focus on factual observations and concrete actions rather than subjective impressions. A concise entry that captures the who, what, when, and why eliminates the temptation to embellish details that could be misinterpreted later. Over‑documenting creates unnecessary clutter and increases the risk that unrelated content will be discovered and treated as part of the student’s permanent file.
Real talk — this step gets skipped all the time.
3. Label and Store Records According to Policy
Even when you keep notes in a personal notebook, it is advisable to label them with a clear identifier such as “Student‑Specific Notes – FERPA‑Protected.” This signals to anyone who might encounter the material that it is not casual scribbles but a regulated record. Store the notebook in a locked cabinet, a password‑protected digital folder, or any other location designated by your institution’s records‑management protocol.
4. Limit Access to Authorized Personnel Only
If a colleague needs to view your notes for legitimate reasons—such as covering a class or preparing a progress report—grant access on a case‑by‑case basis and document the request. Day to day, maintain a log that records who accessed the material, when, and for what purpose. Day to day, this audit trail demonstrates that you are actively controlling distribution and helps protect against accidental disclosures. ### 5 The details matter here. Practical, not theoretical..
Adhere strictly to your institution’s retention schedule. Once the prescribed period expires, destroy the notes securely—shred physical copies, delete digital files, or use a certified data‑wiping service. Avoid the habit of “just in case” archiving, because indefinite storage can inadvertently convert a temporary record into a permanent education record subject to FERPA’s full protections. ### 6.
Compliance is a shared responsibility. Here's the thing — conduct regular training sessions that walk staff through common pitfalls, illustrate real‑world examples of breaches, and reinforce the institution’s specific procedures for handling student information. When every member of the academic community understands the boundaries, the likelihood of inadvertent violations diminishes dramatically.
Conclusion
The line between personal reflection and a FERPA‑protected education record is thin, but it is not invisible. Implementing disciplined note‑taking habits, using only approved systems, and rigorously controlling access and retention will keep your documentation within the permissible confines of “sole possession” while still serving its instructional purpose. By recognizing that any material—whether typed, handwritten, digital, or stored in a locked drawer—can fall under FERPA’s scope when it is linked to a student, you can proactively safeguard both the student’s privacy and your institution’s compliance status. In the long run, a culture of vigilance and ongoing education transforms what could be a compliance risk into a routine, low‑risk practice that respects student rights and protects institutional integrity.
