FERPA requires institutions to use reasonable methods to identify and verify the identity of students, parents, and other parties before disclosing educational records. (34 CFR §99.30-31).
In order to ensure that only authorized individuals have access to a student’s information, it is best practice to use, at a minimum, three types of personal identifiable information (PII) to verify the identity of a student or the legitimacy of an authorized individual before releasing student information.
Name and GWID should not be the sole information types used to verify the identity of an individual.
Social Security numbers must not to be used as PII for identity verification.
Below are some best practices for identity verification:
Requests made in Person
Student Self-Request:
Provide full name and GWID
Verify student valid photo ID
Third Party Request:
Provide student's full name and GWID
Verify that consent was given (in writing) by the student for the requested disclosure of information to the third party requestor (contact the Registrar Office for verification of consent). If GWID is not provided/verified, requestor must answer two student PII answers.
Requests made by Phone
Student Self-Request:
Provide full name and GWID
Provide one PII answer (see examples below). Note: If GWID is not verified, student must provide two PII answers.
Third Party Request:
Provide student's full name and GWID
Provide third party’s full name
Verify third party is listed on student’s FERPA Release/Consent Form
Provide one student PII answer (see below), or two student PII answers if GWID is not provided/verified.
Requests made by Email
Student Self-Request:
Gwu.edu email address serves as first PII
Provide GWID
Provide one PII answer (see examples below). Note: If GWID is not verified, student must provide two PII answers.
If student's self request is made using student's personal email, student should either resend the request using their gwu.edu email address or verify one additional PII.
Third Party Request:
Provide student's full name and GWID
Provide third party’s full name
Verify third party is listed on student’s FERPA Release/Consent Form
Provide two PII answers (see below)
Email response to student’s gwu.edu email account with the least amount of confidential information as possible.
Under FERPA, students can restrict the disclosure of all their personal information, including their directory information, by notifying the university’s Registrar Office; this is done by submitting a Confidentiality request form, essentially limiting who can access their information. In such instance, no information (not even directory information) can be disclosed without the student's consent.
Remember to always check the student's Confidentiality status before you engage in any communication about the student.
Personal Identifiable Information (PII) Examples (for use when verifying the identity of the student).
Identify a course the student took last term.
What term did the student enter GW?
Who is the student’s advisor?
What is the student’s academic major?
Who is the instructor of one of this term’s courses?
When was the last exam in a certain course?
Identify a course the student is taking this term.
If you have access to Banner, you may use other PII types (e.g. DoB, home address, etc.) for the student's identity verification, but never the student's SSN.
