32 CFR § 310.5 - Responses to requests for access to records.

(a) Upon receipt of a request, a component will send an acknowledgment letter to the requester within 10 days (excluding Saturdays, Sundays, and legal public holidays) which shall confirm the requester's agreement to pay duplication fees, if any, and provide an assigned case file number for reference purposes.

(b) In some cases, the DoD Component initially receiving the request may refer the request to another DoD Component or agency. The DoD Component that initially received the request will send the requester a notice of referral that will identify each DoD Component or agency to which the request has been referred, as well as which part of the request has been referred.

(c) Access to protected health information, including medical records, is governed by the Privacy Act and DoD 6025.18–R, “DoD Health Information Privacy Regulation” (available at http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/602518r.pdf).

(d) When a DoD Component makes a determination to grant a request for access in whole or in part, the DoD Component shall notify the requester in writing or simply provide the requested record. The response to the request may be made in lieu of the acknowledgment of receipt provided the response will be made within 10 days (excluding Saturdays, Sundays, and legal public holidays). The DoD Component shall inform the requester of any fee charged for duplication of the record(s). If the request is made in person, the individual may receive the records directly in a manner not unreasonably disruptive of the DoD Component's operations, upon payment of any applicable fee. If the individual is accompanied by another person, the individual may be required to authorize in writing any discussion of the records in the presence of the other person.

(e) A DoD Component denying a request for access in any respect shall notify the requester of that determination in writing.

(1) The notice of denial consists of:

(i) A determination to withhold any requested record in whole or in part;

(ii) A determination that a requested record does not exist or cannot be located; or

(iii) A determination that what has been requested is not a record subject to the Privacy Act.

(2) The denial notification letter shall be signed by the head of the DoD Component, or the DoD Component head's designee, and shall include:

(i) The date of the denial;

(ii) A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied by the DoD Component in denying the request; and

(iii) A statement that the denial can be appealed within 60 calendar days in accordance with § 310.6. The statement will include the position title and the address of the appellate authority.