(a) A data subject requesting access to his or her own record may be required to provide proof of his or her identity.

1. (1) When a request for access is made in person, the individual may be required to present the appropriate identification, such as a driver license, an employee identification card containing a photograph of the individual, an identifier assigned to the data subject by the department or other similar means of confirming that the person seeking the record is the data subject of such record.

2. (2) When a request for access is made by mail, there may be required verification of a signature or inclusion of an identifier generally known only by a data subject, or similar appropriate identification.

   (c)

3. (1) The privacy compliance officer may permit individuals to act as an authorized representative of the data subject. However, such authorized representative shall be required to complete and file a prescribed form and to supply requested particulars before such officer shall act upon the request.
4. (2) The prescribed form shall be a power of attorney, appointing such authorized representative to make a request for access to and/or amendment or correction of such records on the principal's behalf and to obtain access to such records requested therein. Such power may also contain further authority to authorize such representative to take an appeal from denials of access and refusals of amendment or correction pursuant to section 2371.8 of this Part.

(b)