Write a policy statement and simple procedure for handling requests for sensitive information.