Every establishment keeping the records of HIV-related information of protected persons shall adopt data protection measures in accordance with the guidelines to ensure that such information is protected from disclosure.
     Explanation.— For the purpose of this section, data protection measures shall include procedures for protecting information from disclosure, procedures for accessing information, provision for security systems to protect the information stored in any form and mechanisms to ensure accountability and liability of persons in the establishment.