At my current school, we have are doing a few things – uploading documents to a students linked document, however before this is uploaded we password protect each of the documents then uploaded as public.
We have also created a few UDF fields to store the additional information, and added them to the welfare section, to limit who has access to these UDF.