(a) All personal information about individuals served by any designated agency under this part, including lists of names, addresses, photographs, and records of evaluation, must be held strictly confidential.

(b) The designated agency's use of information and records concerning individuals must be limited only to purposes directly connected with the CAP, including program evaluation activities. Except as provided in paragraphs (c) and (e) of this section, this information may not be disclosed, directly or indirectly, other than in the administration of the CAP, unless the consent of the individual to whom the information applies, or his or her parent, legal guardian, or other legally authorized representative or advocate (including the individual's advocate from the designated agency), has been obtained in writing. A designated agency may not produce any report, evaluation, or study that reveals any personally identifying information without the written consent of the individual or his or her representative.

(c) Except as limited in paragraphs (d) and (e) of this section, the Secretary or other Federal or State officials responsible for enforcing legal requirements are to have complete access to all—

(1) Records of the designated agency that receives funds under this program; and

(2) All individual case records of clients served under this part without the consent of the client.

(d) For purposes of conducting any periodic audit, preparing or producing any report, or conducting any evaluation of the performance of the CAP established or assisted under this part, the Secretary does not require the designated agency to disclose the identity of, or any other personally identifiable information related to, any individual requesting assistance under the CAP.

(e) Notwithstanding paragraph (d) of this section and consistent with paragraph (f) of this section, a designated agency shall disclose to the Secretary, if the Secretary so requests, the identity of, or any other personally identifiable information (i.e., name, address, telephone number, social security number, or any other official code or number by which an individual may be readily identified) related to, any individual requesting assistance under the CAP if—

(1) An audit, evaluation, monitoring review, State plan assurance review, or other investigation produces reliable evidence that there is probable cause to believe that the designated agency has violated its legislative mandate or misused Federal funds; or

(2) The Secretary determines that this information may reasonably lead to further evidence that is directly related to alleged misconduct of the designated agency.

(f) In addition to the protection afforded by paragraph (d) of this section, the right of a person or designated agency not to produce documents or disclose information to the Secretary is governed by the common law of privileges, as interpreted by the courts of the United States.