Section 21a-1-7a(e) - Procedures regarding the maintenance of personal data(a) All employees who function as custodians of the department's personal data systems or who have access thereto shall be given a copy of the provisions of Chapters 3 and 55 of the General Statutes together with a copy of these regulations.(b) All such departmental employees shall take reasonable precautions to protect personal data under their supervision from the danger of fire, theft, flood, natural disaster and other physical threats.(c) Except for departmental employees a record shall be maintained of each person, individual, agency or organization who has obtained access to or to whom disclosure has been made of personal data, pursuant to Chapter fifty-five of the Connecticut General Statutes, together with a reason for each disclosure or access. Upon written request this record shall be made available to the individual who is the subject of the personal data disclosure.(d) The department shall maintain only such personal data as is relevant and necessary in order to accomplish the statutory authorization to maintain such information.(e) Upon receipt of a written request, the department shall, within four business days thereafter, mail or deliver to individuals a written response to the question of whether the department maintains personal data concerning such individual.(f) Except where precluded by law, the department shall disclose to any person upon request, all personal data, concerning him which is maintained by the department. Such disclosure shall be conducted so as not to disclose any personal data concerning persons other than the individual requesting such information.(g) If the department refuses to disclose personal medical data to a person and the non-disclosure is not mandated by law, the department shall, at the written request of such person, permit a qualified medical doctor to review the personal medical data contained in the person's record to determine if the personal medical data should be disclosed. If disclosure is recommended by the person's medical doctor, the department shall disclose the personal medical data to such person; if non-disclosure is recommended by such person's medical doctor, the department shall not disclose the personal medical data and shall inform such person of the judicial relief provided under section 4-195 of the General Statutes.Conn. Agencies Regs. § 21a-1-7a(e)