44 CFR §6.21

1. (a)Upon receipt of a request for disclosure, the system manager shall verify the right of the requestor to obtain disclosure pursuant to § 6.20. Upon that verification and subject to other requirements of this part, the system manager shall make the requested records available.
2. (b)If the system manager determines that the disclosure is not permitted under the provisions of § 6.20 or other provisions of this part, the system manager shall deny the request in writing and shall inform the requestor of the right to submit a request for review and final determination to the Administrator or designee.