(a) The accrediting entity must protect from unauthorized use and disclosure all documents and information about the agency or person it receives including, but not limited to, documents and proprietary information about the agency's or person's finances, management, and professional practices received in connection with the perf ormance of its accreditation or approval, oversight, enforcement, renewal, data collection, or other functions under its agreement with the Secretary and this part.

(b) The documents and information received may not be disclosed to the public and may be used only for the purpose of performing the accrediting entity's accreditation or approval functions and related tasks under its agreement with Secretary and this part, or to provide information to the Secretary, the Complaint Registry, or an appropriate Federal, State, or local authority, including, but not limited to, a public domestic authority or local law enforcement authority unless:

(1) Otherwise authorized by the agency or person in writing;

(2) Otherwise required under Federal or State laws; or

(3) Required pursuant to subpart M of this part.

(c) Unless the names and other information that identifies the birth parent(s), prospective adoptive parent(s), and adoptee(s) are requested by the accrediting entity for an articulated reason, the agency or person may withhold from the accrediting entity such information and substitute individually assigned codes in the documents it provides. The accrediting entity must have appropriate safeguards to protect from unauthorized use and disclosure of any information in its files that identifies birth parent(s), prospective adoptive parent(s), and adoptee(s). The accrediting entity must ensure that its officers, employees, contractors, and evaluators who have access to information or documents provided by the agency or person have signed a non-disclosure agreement reflecting the requirements of §96.26(a) and (b). The accrediting entity must maintain an accurate record of the agency's or person's application, the supporting documentation, and the basis for its decision.