34 C.F.R. § 300.623 – Safeguards.

(a) Each participating agency must protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages.
(b) One official at each participating agency must assume responsibility for ensuring the confidentiality of any personally identifiable information.
(c) All persons collecting or using personally identifiable information must receive training or instruction regarding the State's policies and procedures under § 300.123 and 34 CFR part 99.
(d) Each participating agency must maintain, for public inspection, a current listing of the names and positions of those employees within the agency who may have access to personally identifiable information.
(Authority: 20 U.S.C. 1412(a)(8); 1417(c))