Access to personally identifiable information is authorized only for those who have a business need for such access, and sensitive records are retained only as long as necessary to meet business or legal needs.