(a) CMS shares aggregate reports with the ACO.

(b) CMS shares beneficiary identifiable data with ACOs on the condition that the ACO, its ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to the ACO's activities observe all relevant statutory and regulatory provisions regarding the appropriate use of data and the confidentiality and privacy of individually identifiable health information and comply with the terms of the data use agreement described in this subpart.

(c) The ACO must not limit or restrict appropriate sharing of medical record data with providers and suppliers both within and outside the ACO in accordance with applicable law.