Which of the following describes the applicabiity rule according to the Confidentiality of Substance Use Disorder Patient Records Rules? Question 5 options: An individual or entity (other than a general medical facility) who holds itself out as providing, and provides, "alcohol or substance abuse diagnosis, treatment, or referral for treatment". Redisclosing information obtained from a program is prohibited when that information would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment. An entity lawfully holding patient-identifying information must have formal policies and procedures in place to protect the security of this information. There are separate requirements for paper and electronic records. Disclosure and use of patient identifying information by treatment programs for alcohol and substance abuse