Each licensee or other entity who is subject to this subpart who collects personal information about an individual for the purpose of complying with this part, shall establish, use, and maintain a system of files and procedures that protects the individual's privacy.

Licensees and other entities shall obtain a signed consent that authorizes the disclosure of the personal information collected and maintained under this part before disclosing the personal information, except for disclosures to the following individuals:

The subject individual or his or her representative, when the individual has designated the representative in writing for specified FFD matters;

Assigned MROs and MRO staff;

NRC representatives;

Appropriate law enforcement officials under court order;

A licensee's or other entity's representatives who have a need to have access to the information to perform their assigned duties under the FFD program, including determinations of fitness, FFD program audits, or some human resources functions;

The presiding officer in a judicial or administrative proceeding that is initiated by the subject individual;

Persons deciding matters under review in § 26.39; and

Other persons pursuant to court order.

Personal information that is collected under this subpart must be disclosed to other licensees and entities, including C/Vs, or their authorized representatives, who are legitimately seeking the information for authorization decisions as required by this part and who have obtained a signed release from the subject individual.

Upon receipt of a written request by the subject individual or his or her designated representative, the FFD program, including but not limited to, the collection site, HHS-certified laboratory, substance abuse expert (SAE), or MRO, possessing such records shall promptly provide copies of all FFD records pertaining to the individual, including, but not limited to, records pertaining to a determination that the individual has violated the FFD policy, drug and alcohol test results, MRO reviews, determinations of fitness, and management actions pertaining to the subject individual. The licensee or other entity shall obtain records related to the results of any relevant laboratory certification, review, or revocation-of-certification proceedings from the HHS-certified laboratory and provide them to the subject individual on request.

A licensee's or other entity's contracts with HHS-certified laboratories and C/Vs providing specimen collection services, and licensee testing facility procedures, must require test records to be maintained in confidence, except as provided in paragraphs (b), (c), and (d) of this section.

This section does not authorize the licensee or other entity to withhold evidence of criminal conduct from law enforcement officials.