42 CFR §480.143

1. (a)Information collected by a QIO. Except as prohibited in paragraph (b) of this section, information collected by a QIO may be processed and stored by a cooperative health statistics system established under the Public Health Service Act (42 U.S.C. 242k) or other State or Federally authorized shared data system.
2. (b)QIO participation. A QIO may not participate in a cooperative health statistics system or other shared health data system if the disclosure rules of the system would prevent the QIO from complying with the rules of this part.
3. (c)Disclosure of QIO information obtained by a shared health data system. QIO information must not be disclosed by the shared health data system unless—
   1. (1)The source from which the QIO acquired the information consents to or requests disclosure; or
   2. (2)The QIO requests the disclosure of the information to carry out a disclosure permitted under a provision of this part.