42 CFR § 480.101
Scope. This subpart sets forth the policies and procedures governing
(1) Disclosure of information collected, acquired or generated by a Utilization and Quality Control Quality Improvement Organization (QIO) (or the review component of a QIO subcontractor) in performance of its responsibilities under the Act and these regulations; and
(2) Acquisition and maintenance of information by a QIO to comply with its responsibilities under the Act.