The approval of a data subject or authorized representative prior to a disclosure as required by 950 CMR

33.13 may be granted in writing or orally, including by telephone; provided that the agency seeking such approval shall make reasonable efforts to verify the identity of the data subject and the authority of any person representing the data subject; and, provided further, that the agency shall, if no written consent is given, make a notation of an oral approval and shall file such notation with the personal data held.