The Department shall provide to the grantee all instructions, data elements, and other components necessary to carry out program requirements. The grantee shall transmit to providers the forms that are applicable to the providers. The grantee shall make reports required by the Department. The grantee shall retain all records relating to services for a period of time defined by the program guide, and for a minimum of 3 years. Confidentiality. The grantee may not disclose identifying information regarding an applicant or client without written authorization to do so from the applicant or client, except to the Department’s employees authorized to monitor or audit the program. The grantee shall maintain all written records regarding applicants and clients in a secure, locked location.