(a) General. An inpatient rehabilitation facility may release information from the patient assessment instrument only as specified in §482.24(b)(3) of this chapter.

(b) Release to the inpatient rehabilitation facility's agent. An inpatient rehabilitation facility may release information that is patient-identifiable to an agent only in accordance with a written contract under which the agent agrees not to use or disclose the information except for the purposes specified in the contract and only to the extent the facility itself is permitted to do so under paragraph (a) of this section.