2 - The Act and Regulations

The State agency and the State unit must adopt and implement written policies and procedures to safeguard the confidentiality of all personal information, including photographs and lists of names...All applicants and recipients of services or their representatives are informed about the State unit’s need to collect personal information and the policies governing its use, including—

● Identification of the authority under which such information is collected;

● Explanation of the principal purposes for which the State unit intends to use or release the information;

● Explanation of whether providing requested information to the State unit is mandatory or voluntary and the effects of not providing requested information;

● Identification of those situations in which the State unit requires or does not require informed written consent of the individual before information may be released; and 

● Identification of other agencies to which information is routinely released...

(See 34 CFR 361.38 - Protection, use, and release of personal information.)