(a) Personnel records. All SBA personnel records and files, as prescribed by OPM, shall be maintained in such a way that the privacy of all individuals concerned is protected in accordance with regulations of OPM (5 CFR parts 293 and 297).

(b) Mailing lists. The SBA will not sell or rent an individual's name or address. This provision shall not be construed to require the withholding of names or addresses otherwise permitted to be made public.

(c) Changes in systems. The SBA shall provide adequate advance notice to Congress and OMB of any proposal to establish or alter any system of records in order to permit an evaluation of the probable or potential effect of such proposal on the privacy and other personal or property rights of individuals or the disclosure of information relating to such individuals, and its effect on the preservation of the constitutional principles of federalism and separation of powers.

(d) Medical records. Medical records shall be disclosed to the individual to whom they pertain. SBA may, however, transmit such information to a medical doctor named by the requesting individual. In regard to medical records in personnel files, see also 5 CFR 297.205.