It may be policy but it's not law. However with the privacy issues today it is a best practice. If you have ID procedures in place to identify customers over the phone, and good documentation the ID procedures were performed, I see no reason you could not release the PO.
_________________________
The opinions expressed are mine and they are not to be taken as legal advice.