Such procedures must include document routing and other procedures or security arrangements, including separate physical locations, which would maintain the independence of their activities; provided, however, that such procedures may provide for the disclosure of information which is reasonably necessary for an eligible entity to maintain the level of control consistent with its fiduciary respons