(a) In general. Reports and other SBA prepared review or examination related documents are the property of SBA and are loaned to an SBA Lender, Intermediary, or NTAP for its confidential use only. The Reports, Risk Ratings, and related Confidential Information are privileged and confidential as more fully explained in paragraph (b) of this section. The Report, Risk Rating, and Confidential Information must not be relied upon for any purpose other than SBA's Lender oversight and SBA's portfolio management purposes. An SBA Lender, Intermediary, or NTAP must not make any representations concerning the Report (including its findings, conclusions, and recommendations), the Risk Rating, or the Confidential Information. For purposes of this regulation, Report means the review or examination report and related documents. For purposes of this regulation, Confidential Information is defined in the SBA Lender information portal and by notice issued from time to time. Access to the Lender information portal may be obtained by contacting the OCRM.
(b) Disclosure prohibition. Each SBA Lender, Intermediary, and NTAP is prohibited from disclosing its Report, Risk Rating, and Confidential Information, in full or in part, in any manner, without SBA's prior written permission. An SBA Lender, Intermediary, and NTAP may use the Report, Risk Rating, and Confidential Information for confidential use within its own immediate corporate organization. SBA Lenders, Intermediaries, and NTAPs must restrict access to their Report, Risk Rating and Confidential Information to those of its officers and employees who have a legitimate need to know such information for the purpose of assisting them in improving the SBA Lender's, Intermediary's, or NTAP's SBA program operations in conjunction with SBA's Lender Oversight Program and SBA's portfolio management (for purposes of this regulation, each referred to as a ``permitted party''), and to those for whom SBA has approved access by prior written consent, and to those for whom access is required by applicable law or legal process. If such law or process requires SBA Lender, Intermediary, or NTAP to disclose the Report, Risk Rating, or Confidential Information to any person other than a permitted party, SBA Lender, Intermediary, or NTAP will promptly notify SBA and SBA's Information Provider in writing so that SBA and the Information Provider have, within their discretion, the opportunity to seek appropriate relief such as an injunction or protective order prior to disclosure. For purposes of this regulation, ``Information Provider'' means any contractor that provides SBA with the Risk Rating. Each SBA Lender, Intermediary, and NTAP must ensure that each permitted party is aware of these regulatory requirements and must ensure that each such permitted party abides by them. Any disclosure of the Report, Risk Rating, or Confidential Information other than as permitted by this regulation may result in appropriate action as authorized by law. An SBA Lender, Intermediary, and NTAP will indemnify and hold harmless SBA from and against any and all claims, demands, suits, actions, and liabilities to any degree based upon or resulting from any unauthorized use or disclosure of the Report, Risk Rating, or Confidential Information. Information Provider contact information is available from the Office of Capital Access. [73 FR 75519, Dec. 11, 2008]