A program must establish procedures to protect the confidentiality of any personally identifiable information (PII) in child records.