28 CFR § 700.13 - Form and content of Office responses.
(a) Form of notice granting request for access. After the Office has made a determination to grant a request for access in whole or in part, the Office shall so notify the requester in writing. The notice shall describe the manner in which access to the record will be granted and shall inform the requester of any fees to be charged in accordance with § 700.17.
(b) Form of notice denying request for access. When the Office denies a request for access in whole or in part it shall so notify the requester in writing. The notice shall be signed by the head of the Office, or his designee, and shall include:
(1) The name and title or position of the person responsible for the denial;
(2) A brief statement of the reason or reasons for the denial, including the Privacy Act exemption or exemptions that the Office has relied upon in denying the request and a brief explanation of the manner in which the exemption or exemptions apply to each record withheld; and
(3) A statement that the denial may be appealed under § 700.18(a) and a description of the requirements of that subsection.
(c) Record cannot be located or has been destroyed. If a requested record cannot be located from the information supplied, or is known or believed to have been destroyed or otherwise disposed of, the Office shall so notify the requester in writing.
(d) Medical records. When an individual requests medical records pertaining to himself that are not otherwise exempt from individual access, the Office may advise the individual that the records will be provided only to a physician, designated by the individual, who requests the records and establishes his identity in writing. The designated physician shall determine which records should be provided to the individual and which records should not be disclosed to the individual because of possible harm to the individual or another person.