28 CFR §22.22

1. (a)Except as noted in paragraph (b) of this section, research and statistical information relating to a private person may be revealed in identifiable form on a need-to-know basis only to—
   1. (1)Officers, employees, and subcontractors of the recipient of assistance;
   2. (2)Such individuals as needed to implement sections 202(c)(3), 801, and 811(b) of the Act; and sections 223(a)(12)(A), 223(a)(13), 223(a)(14), and 243 of the Juvenile Justice and Delinquency Prevention Act.
   3. (3)Persons or organizations for research or statistical purposes. Information may only be transferred for such purposes upon a clear demonstration that the standards of § 22.26 have been met and that, except where information is transferred under paragraphs (a) (1) and (2) of this section, such transfers shall be conditioned on compliance with a § 22.24 agreement.
2. (b)Information may be revealed in identifiable form where prior consent is obtained from an individual or where the individual has agreed to participate in a project with knowledge that the findings cannot, by virtue of sample size, or uniqueness of subject, be expected to totally conceal subject identity.