34 C.F.R. § 381.31 – What are the requirements pertaining to the protection, use, and release of personal information?

(a) All personal information about individuals served by any eligible system under this part, including lists of names, addresses, photographs, and records of evaluation, must be held confidential.
(b) The eligible system's use of information and records concerning individuals must be limited only to purposes directly connected with the protection and advocacy program, including program evaluation activities. Except as provided in paragraph (c) of this section, an eligible system may not disclose personal information about an individual, directly or indirectly, other than in the administration of the protection and advocacy program, unless the consent of the individual to whom the information applies, or his or her guardian, parent, or other authorized representative or advocate (including the individual's advocate from the eligible system), has been obtained in writing. An eligible system may not produce any report, evaluation, or study that reveals any personally identifying information without the written consent of the individual or his or her representative.
(c) Except as limited in paragraph (d) of this section, the Secretary or other Federal or State officials responsible for enforcing legal requirements must be given complete access to all—
1. (1) Records of the eligible system receiving funds under this program; and
2. (2) All individual case records of clients served under this part without the consent of the client.
(d)
1. (1) The privilege of a person or eligible system not to produce documents or provide information pursuant to paragraph (c) of this section is governed by the principles of common law as interpreted by the courts of the United States, except that, for purposes of any periodic audit, report, or evaluation of the performance of the eligible system established or assisted under this part, the Secretary does not require the eligible system to disclose the identity of, or any other personally identifiable information related to, any individual requesting assistance under the PAIR program.
2. (2) However, notwithstanding paragraph (d)(1) of this section, if an audit, monitoring review, State plan assurance review, evaluation, or other investigation has already produced independent and reliable evidence that there is probable cause to believe that the eligible system has violated its legislative mandate or misused Federal funds, the eligible system shall disclose, if the Secretary so requests, the identity of, or any other personally identifiable information (i.e., name, address, telephone number, social security number, or other official code or number by which an individual may be readily identified) related to, any individual requesting assistance under the PAIR program, in accordance with the principles of common law as interpreted by the courts of the United States.
  (Authority: Sections 12(c) and 509(h) of the Rehabilitation Act of 1973, as amended; 29 U.S.C. 709(c) and 794e(h))