Consistent with Maryland records retention programs, personally identifiable employee medical information and lists of coded direct personal identifiers shall be destroyed or returned to the original record holder when they are no longer needed for the purposes for which they were obtained. The medical records officer shall: Maintain custody of personally identifiable employee medical information which is currently not being used actively but may be needed for future use; and Conduct an annual review of all centrally held information to determine which information is no longer needed for the purposes for which it was obtained.