Under 42 CFR Part 2, which of the following is required before a substance use disorder treatment program may disclose patient records to a third party?