Such information may be provided on a need-to-know basis only to persons authorized by law or regulation to receive it .
Information will never be provided , regardless of whether or not a person is authorized by law to receive it .