. "Programs' legal responsibilities in this area may vary, but as a general rule, confidentiality is the best policy." . . .