(1) A department must adopt a procedure which is consistent with this subchapter and which contains, at a minimum, the following provisions:

(a) a list of the types of records which are maintained, pursuant to records management procedures found in Chapter 800, Montana Operations Manual, Volume I;

(b) a statement restricting access to confidential personnel records to those with a job-related purpose for viewing or using the records;

(c) a list or description of those with access to personnel records which includes the employee, and any limitations on that access;

(d) the acceptable location of records in the department; and,

(e) security procedures for the records.

(2) The policy must be adopted and approved by the depart­ment of administration, as provided in ARM 2.21.1203, no later than 90 days after the effective date of this policy.