(a) Except as provided in paragraph (b) of this section, the following information may be released to an officer or employee of an agency of the Federal or a State government lawfully charged with the administration of a program receiving grants-in-aid under title V and XIX of the Social Security Act for the purpose of administration of those titles, or to any officer or employee of the Department of Army, Department of Defense, solely for the administration of its Civilian Health and Medical Program of the Uniformed Services (CHAMPUS):

(1) Information, including the identification number, concerning charges made by physicians, other practitioners, or suppliers, and amounts paid under Medicare for services furnished to beneficiaries by such physicians, other practioners, or suppliers, to enable the agency to determine the proper amount of benefits payable for medical services performed in accordance with those programs; or

(2) Information as to physicians or other practioners that has been disclosed under §401.105.

(3) Information relating to the qualifications and certification status of hospitals and other health care facilities obtained in the process of determining whether, and certifying as to whether, institutions or agencies meet or continue to meet the conditions of participation of providers of services or whether other entities meet or continue to meet the conditions for coverage of services they furnish.

(b) The release of such information shall not be authorized by a fiscal intermediary or carrier.

(c) The following information may be released to any officer or employee of an agency of the Federal or a State government lawfully charged with the duty of conducting an investigation or prosecution with respect to possible fraud or abuse against a program receiving grants-in-aid under Medicaid, but only for the purpose of conducting such an investigation or prosecution, or to any officer or employee of the Department of the Army, Department of Defense, solely for the administration of its Civilian Health and Medical Program of the Uniformed Services (CHAMPUS), provided that the agency has filed an agreement with CMS that the information will be released only to the agency's enforcement branch and that the agency will preserve the confidentiality of the information received and will not disclose that information for other than program purposes:

(1) The name and address of any provider of medical services, organization, or other person being actively investigated for possible fraud in connection with Medicare, and the nature of such suspected fraud. An active investigation exists when there is significant evidence supporting an initial complaint but there is need for further investigation.

(2) The name and address of any provider of medical services, organization, or other person found, after consultation with an appropriate professional association or a program review team, to have provided unnecessary services, or of any physician or other individual found to have violated the assignment agreement on at least three occasions.

(3) The name and address of any provider of medical services, organization or other person released under paragraph (c)(1) or (2) of this section concerning which an active investigation is concluded with a finding that there is no fraud or other prosecutable offense.