22 C.F.R. § 96.26 – Protection of information and documents by the accrediting entity.

(a) The accrediting entity must protect from unauthorized use and disclosure all documents and information about the agency or person it receives including, but not limited to, documents and proprietary information about the agency's or person's finances, management, and professional practices received in connection with the performance of its accreditation or approval, oversight, enforcement, renewal, data collection, or other functions under its agreement with the Secretary and this part.
(b) The documents and information received may not be disclosed to the public and may be used only for the purpose of performing the accrediting entity's accreditation or approval functions, monitoring and oversight, and related tasks under its agreement with the Secretary and this part, or to provide information to the Secretary, the Complaint Registry, or an appropriate Federal, State, tribal, or local authority, including, but not limited to, a public domestic authority or local law enforcement authority unless:
1. (1) Otherwise authorized by the agency or person in writing;
2. (2) Otherwise required under Federal or State laws; or
3. (3) Required pursuant to subpart M of this part.
(c) Unless the names and other information that identifies the birth parent(s), prospective adoptive parent(s), and adoptee(s) are requested by the accrediting entity for an articulated reason, the agency or person may withhold from the accrediting entity such information and substitute individually assigned codes in the documents it provides. The accrediting entity must have appropriate safeguards to protect from unauthorized use and disclosure of any information in its files that identifies birth parent(s), prospective adoptive parent(s), and adoptee(s). The accrediting entity must ensure that its officers, employees, contractors, and evaluators who have access to information or documents provided by the agency or person have signed a non-disclosure agreement reflecting the requirements of paragraphs (a) and (b) of this section.
(d) The accrediting entity must maintain a complete and accurate record of all information it receives related to an agency or person, and the basis for the accrediting entity's decisions concerning the agency or person for a period of at least ten years, or longer if otherwise set forth in its agreement with the Secretary.