(a) A P&A shall, at minimum, comply with the confidentiality provisions of all applicable Federal and State laws.

(b) Records maintained by the P&A system are the property of the P&A system which must protect them from loss, damage, tampering, unauthorized use, or tampering. The P&A system must:

(1) Except as provided elsewhere in this section, keep confidential all records and information, including information contained in any automated electronic database pertaining to:

(i) Clients;

(ii) Individuals who have been provided general information or technical assistance on a particular matter;

(iii) The identity of individuals who report incidents of abuse or neglect, or who furnish information that forms the basis for a determination that probable cause exists; and

(iv) Names of individuals who have received services, supports or other assistance, and who provided information to the P&A for the record.

(v) Peer review records.

(2) Have written policies governing the access, storage, duplication and release of information from client records, including the release of information peer review records.

(3) Obtain written consent from the client, or from his or her legal representative; individuals who have been provided general information or technical assistance on a particular matter; and individuals who furnish reports or information that form the basis for a determination of probable cause, before releasing information concerning such individuals to those not otherwise authorized to receive it.

(c) Nothing in this subpart shall prevent the P&A system from issuing a public report of the results of an investigation which maintains the confidentiality of the individuals listed in paragraph (a)(1) of this section, or reporting the results of an investigation in a manner which maintains the confidentiality of such individuals, to responsible investigative or enforcement agencies should an investigation reveal information concerning the service provider, its staff, or employees warranting possible sanctions or corrective action. This information may be reported to agencies responsible for service provider licensing or accreditation, employee discipline, employee licensing or certification, or criminal investigation or prosecution.

(d) Notwithstanding the confidentiality requirements of this section, the P&A may make a report to investigative or enforcement agencies, as described in paragraph (b) of this section, which reveals the identity of an individual with developmental disability, and information relating to his or her status or treatment:

(1) When the system has received a complaint that the individual has been or may be subject to abuse and neglect, or has probable cause (which can be the result of monitoring or other activities including media reports and newspaper articles) to believe that such individual has been or may be subject to abuse or neglect;

(2) When the system determines that there is probable cause to believe the health or safety of the individual is in serious and immediate jeopardy; or

(3) In any case of the death of an individual whom the system believes may have had a developmental disability.