Start with what keeps repeating.

A direct line to the principal. Where records are involved, confidentiality comes first.