The Federal Privacy Rules require us to disclose your personal health information in two instances: to you at your request, and to the Secretary of Health and Human Services when requested as part of an investigation or compliance review.