14 CFR §1241.50

1. (a)Records on individuals created or obtained pursuant to this regulation that are subject to the Privacy Act of 1974, as amended, 5 U.S.C. 552a, will be maintained in accordance with the NASA's Privacy Act System of Records.
2. (b)NASA will, as necessary, enter into data sharing agreements with other agencies and/or entities to receive such data and/or seek signed medical releases from the eligible individuals, or their authorized representatives, in accordance with law.
3. (c)NASA's collection, use, and disclosure of this data will be in accordance with the Privacy Act of 1974, NASA's implementing regulations at 14 CFR part 1212, and NASA's privacy policies, where applicable.