As outlined in our August email to faculty and staff, CU Boulder employees are obligated to comply with FERPA, the federal law that governs the protection and disclosure of student educational records.
Before disclosing any sensitive information to an unfamiliar student or third party (e.g., parent, guardian, sponsor), follow our instructions to confirm a student's identity or confirm a third party's FERPA authorization.
In particular, be sure to:
- Verify a student's security passphrase if they can't present a photo ID. If they haven't set a passphrase yet, refer them to Buff Portal to do so rather than using an alternate method to verify their identity.
- Verify a third party's authorization phrase. If they're unable to provide their authorization phrase, there's no other way to confirm their identity or FERPA authorization over the phone. The third party will need to reach out to the student to ask what authorization phrase the student set up for them.
Note: If a third party tells you they've logged in to a CU Boulder system using a student's credentials, please inform them that campus computing policies prohibit students from sharing their login information.