(a) State agencies and area agencies on aging shall have procedures to protect the confidentiality of information about older individuals and family caregivers collected in the conduct of their responsibilities. The procedures shall ensure that no information about an older person or family caregiver, or obtained from an older person or family caregiver by a service provider or the State or area agencies, is disclosed by the provider or agency in a form that identifies the person without the informed consent of the person or of their legal representative, unless the disclosure is required by law or court order, or for program monitoring and evaluation by authorized Federal, State, or local monitoring agencies.

(b) A State agency, area agency on aging or other contracting or granting or auditing agency may not require a provider of long-term care ombudsman services under this part to reveal any information that is protected by disclosure provisions in 45 CFR part 1324, subpart A. State agencies must comply with confidentiality and disclosure of information provisions as directed in 45 CFR part 1324, as appropriate.

(c) A State or area agency on aging shall not require a provider of legal assistance under this part to reveal any information that is protected by attorney client privilege.

(d) State agencies must have policies and procedures that ensure that entities providing services under this title promote the rights of each older individual who receives such services. Such rights include the right to confidentiality of records relating to such individual.

(e) State agencies' policies and procedures must explain that individual information and records may be shared with other State and local agencies, community-based organizations, and health care providers and payers in order to provide services.

(f) State agencies' policies and procedures must comply with all applicable Federal laws as well as guidance as the State determines, for the collection, use, and exchange of both Personal Identifiable Information (PII) and personal health information in the provision of Title III services under the Act. State agencies are encouraged to consult with Tribes regarding any Tribal data sovereignty expectations that may apply.