In General. The Secretary shall issue policies, as appropriate, to ensure that all records and other information are maintained in a secure fashion to prevent loss, destruction, or unauthorized access. Elements. Policies under §A of this regulation shall, at a minimum: Identify the staff positions responsible for the custody and maintenance of records and information; Warn all employees of the Department and of all private-sector providers that they may not disclose or knowingly permit the disclosure of any confidential record or information to any unauthorized person; and Establish procedures to monitor and track access to all records and information.