Iowa Admin. Code r. 281-41.623
Each participating agency must protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages. One official at each participating agency must assume responsibility for ensuring the confidentiality of any personally identifiable information. All persons collecting or using personally identifiable information must receive training or instruction regarding the state's policies and procedures under rule 281-41.123 (256B, 34CFR300) and 34 CFR Part 99 . Each participating agency must maintain, for public inspection, a current listing of the names and positions of those employees within the agency who may have access to personally identifiable information.
Iowa Admin. Code r. 281-41.623