(a) A program must maintain child records in a manner that ensures only parents, and officials within the program or acting on behalf of the program have access, and such records must be destroyed within a reasonable timeframe after such records are no longer needed or required to be maintained.

(b) A program must maintain, with the child records, for as long as the records are maintained, information on all individuals, agencies, or organizations to whom a disclosure of PII from the child records was made (except for program officials and parents) and why the disclosure was made. If a program uses a web-based data system to maintain child records, the program must ensure such child records are adequately protected and maintained according to current industry security standards.

(c) If a parent places a statement in the child record, the program must maintain the statement with the contested part of the child record for as long as the program maintains the record and, disclose the statement whenever it discloses the portion of the child record to which the statement relates.