Subject to the requirements of 42 CFR 431F (1994), the PCP and its subcontractors may not release or disclose any information concerning an enrollee except with the written permission of the: Department; Enrollee; or Enrollee's attorney, legal representative, or guardian.