42 C.F.R. § 401.101 – Purpose and scope.

(a) The regulations in this subpart:
1. (1) Implement section 1106(a) of the Social Security Act as it applies to the Centers for Medicare & Medicaid Services (CMS). The rules apply to information obtained by officers or employees of CMS in the course of administering title XVIII of the Social Security Act (Medicare), information obtained by Medicare intermediaries or carriers in the course of carrying out agreements under sections 1816 and 1842 of the Social Security Act, and any other information subject to section 1106(a) of the Social Security Act;
2. (2) Relate to the availability to the public, under 5 U.S.C. 552, of records of CMS and its components. They set out what records are available and how they may be obtained; and
3. (3) Supplement the regulations of the Department of Health and Human Services relating to availability of information under 5 U.S.C. 552, codified in 45 CFR part 5, and do not replace or restrict them.
(b) Except as authorized by the rules in this subpart, no information described in paragraph (a)(1) of this section shall be disclosed. The procedural rules in this subpart (§§ 401.106 through 401.152) shall be applied to requests for information which is subject to the rules for disclosure in this subpart.
(c) Requests for information which may not be disclosed according to the provisions of this subpart shall be denied under authority of section 1106(a) of the Social Security Act and this subpart, and furthermore, such requests which have been made pursuant to the Freedom of Information Act shall be denied under authority of an appropriate Freedom of Information Act exemption, 5 U.S.C. 552(b).