42 CFR § 431.306 - Release of information.
(a) The agency must have criteria specifying the conditions for release and use of information about applicants and beneficiaries.
(b) Access to information concerning applicants or beneficiaries must be restricted to persons or agency representatives who are subject to standards of confidentiality that are comparable to those of the agency.
(c) The agency must not publish names of applicants or beneficiaries.
(d) The agency must obtain permission from a family or individual, whenever possible, before responding to a request for information from an outside source, unless the information is to be used to verify income, eligibility and the amount of medical assistance payment under section 1137 of this Act and §§ 435.940 through 435.965 of this chapter.
(e) The agency's policies must apply to all requests for information from outside sources, including governmental bodies, the courts, or law enforcement officials.
(f) If a court issues a subpoena for a case record or for any agency representative to testify concerning an applicant or beneficiary, the agency must inform the court of the applicable statutory provisions, policies, and regulations restricting disclosure of information.
(g) Before requesting information from, or releasing information to, other agencies to verify income, eligibility and the amount of assistance under § 435.940 through § 435.965 of this subchapter, the agency must execute data exchange agreements with those agencies, as specified in § 435.945(i) of this subchapter.
(h) Before requesting information from, or releasing information to, other agencies to identify legally liable third party resources under § 433.138(d) of this chapter, the agency must execute data exchanges agreements, as specified in § 433.138(h)(2) of this chapter.