42 CFR § 438.224 - Confidentiality.
---
identifier: "/us/cfr/t42/s438.224"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "42 CFR § 438.224 - Confidentiality."
title_number: 42
title_name: "Public Health"
section_number: "438.224"
section_name: "Confidentiality."
chapter_name: "CENTERS FOR MEDICARE & MEDICAID SERVICES, DEPARTMENT OF HEALTH AND HUMAN SERVICES"
subchapter_number: "C"
subchapter_name: "MEDICAL ASSISTANCE PROGRAMS"
part_number: "438"
part_name: "MANAGED CARE"
positive_law: false
currency: "2026-03-24"
last_updated: "2026-03-24"
format_version: "1.1.0"
generator: "[email protected]"
authority: "42 U.S.C. 1302."
regulatory_source: "67 FR 41095, June 14, 2002, unless otherwise noted."
cfr_part: "438"
---
# 438.224 Confidentiality.
The State must ensure, through its contracts, that (consistent with subpart F of part 431 of this chapter), for medical records and any other health and enrollment information that identifies a particular enrollee, each MCO, PIHP, and PAHP uses and discloses such individually identifiable health information in accordance with the privacy requirements in 45 CFR parts 160 and 164, subparts A and E, to the extent that these requirements are applicable.