(a) The system manager will release records to the requester or representative in person only upon production of satisfactory identification which includes the individual's name, signature, and photograph or physical description.

(b) The system manager will release copies of records by mail only when the circumstances indicate that the requester and the subject of the record are the same. The system manager may require that the requester's signature be notarized or witnessed by two individuals unrelated to the requester.

(c) Identity procedures more stringent than those required in this section may be prescribed in the system notice when the records are medical or otherwise sensitive.