(a) All requests shall be made in writing, except that the privacy compliance officer may make records available upon an oral request made in person after the applicant had demonstrated proof of identity.

(b) A request shall reasonably describe the record or records sought. Whenever possible, the data subject should supply identifying information that will assist in locating the records sought.

(c) Within five business days of the receipt of a request, the privacy compliance officer shall provide access to the record, deny access in writing explaining the reasons therefor, or acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not exceed 30 days from the date of the acknowledgement.