42 CFR 55a.104: a.104 What confidentiality requirements must be met?

All information as to personal facts and circumstances obtained by the grantee's staff about recipients of services shall be held confidential and shall not be disclosed without the individual's consent except as may be required by law or as may be necessary to provide service to the individual or to provide for audits with appropriate safeguards for confidentiality of patient records. Otherwise, information may be disclosed only in summary, statistical, or other form which does not identify particular individuals.