All information, records, and data collected and maintained by the prepaid, capitated provider or its subcontractors that relate to enrollees shall be protected from unauthorized disclosure by the prepaid, capitated provider.
Except as otherwise provided by federal law or regulation, the use or disclosure of information concerning enrollees shall be restricted to purposes directly related to the administration of the Medicaid program in accordance with 42 C.F.R. §431.302.
The information to be safeguarded shall include all information listed in 42 C.F.R. §431.305.
D.C. Mun. Regs. tit. 29, r. 29-5311