Question 2 Answer

Correct!

Institutions or organizations may not give investigators any identifiable private information about potential subjects without prior permission.