The Secretary may make a grant under section 300x or 300x–21 of this title only if the State involved has in effect a system to protect from inappropriate disclosure patient records maintained by the State in connection with an activity funded under the program involved or by any entity which is receiving amounts from the grant.
42 U.S. Code § 300x–53 - Additional requirements
(a) In generalA funding agreement for a grant under section 300x or 300x–21 of this title is that the State involved will—
permit and cooperate with Federal investigations undertaken in accordance with section 300x–55 of this title; and
(b) Patient records