(a) The custodian of records shall be responsible for the security of pupil records maintained by the district and shall devise procedures for assuring that access to such records is limited to authorized persons.
(b) Records for each individual pupil shall be maintained in a central file at the school attended by the pupil, or when records are maintained in different locations a notation in the central file as to where such other records may be found is required.