7. The department shall take appropriate measures to protect the security of health data which it obtains, including:
a. limiting access to the data to authorized persons;
b. designating a person to be responsible for the physical security of the data;
c. developing and implementing a system for monitoring the security of the data;
d. periodically reviewing all health data to evaluate whether it is appropriate to remove identifying characteristics from the data; and
e. developing a program for the routine scheduled destruction of all forms, records or electronic files maintained by the department which contain identifiable health data.