CMS or any person, organization or agency authorized by the Department or Federal statute to monitor a QIO will have access to medical records maintained by institutions or health care practitioners on Medicare patients. The monitor can require copies of the records.