There has never been a "rule" as you explain; however, it was a best practice. You have a contract between the consumer reporting agency (CRA) and your institution. In the past, most said something like "bankers eyes only". Since the FACT Act now allows consumers to get a free copy of their credit report each year, many CRA's have modified their contract to allow bankers to hand out this information - but not all.
First, check your contract. Second, discuss this among management and have a procedure that all follow.