R722-900-9. Misuse

  (1) Anyone who has reason to believe that records have been misused may submit a written complaint to the bureau.

  (2)(a) The bureau shall conduct a review of its records to determine if there is any evidence to support the complaint.

  (b) If the bureau finds evidence indicating records may have been accessed, used, disclosed, or disseminated, the bureau shall notify the agency TAC or entity point of contact and request that an internal review be conducted.

  (3) The agency or entity shall be responsible for conducting an internal review to determine if there has been misuse of a record and submit its findings to the bureau within 30 days.

  (4)(a) If the agency or entity determines there was misuse, the agency or entity shall submit a corrective action plan to the bureau.

  (b) The bureau shall review the corrective action plan to determine if the action taken by the agency or entity was sufficient to address the misuse.

  (5) If the bureau finds that an agency, entity, TAC, user, non-user, or employee of an agency or entity misused records, the bureau may:

  (a) suspend or revoke the access of the agency, entity, TAC, user, non-user, or employee of an agency or entity; and

  (b) refer the matter to the appropriate law enforcement agency for investigation and prosecution.

  (6) The bureau may suspend or revoke access to records by an agency, entity, TAC, user, non-user, or employee of an agency or entity if the agency, entity, TAC, user, non-user, or employee of an agency or entity fails to comply with any terms of the signed agreement.