and implement these policies and procedures for protecting and disposing of personal information, including procedures relating to incidents of unauthorized access to or misuse of personal information.8 The periods of time for which records would have to be preserved would vary from institution to institution and are specifically provided in the proposed amendments.'