The Privacy Act requires: that covered employers adopt written workplace privacy policies that employees be informed if they are subject to monitoring or surveillance in the workplace that medical records must be kept confidential and separate from personnel files that violations of the Act must be intentional