b.) Research Activities
Patient identifying information may be disclosed to conduct scientific research if the program director determines that the recipient of the information:
- Is qualified to conduct the research;132
- Has a research protocol under which s/he agrees to maintain the information in accordance with the security requirements discussed above in Section 2(c)(3)133 and only re-disclose the information134 back to the program that provided the information;135 and
- Has provided a satisfactory written statement that a group of at least three individuals independent of the research project have reviewed the protocol and determined that the rights and welfare of patients will be adequately protected136 and that the risks in disclosing information are outweighed by the potential benefits of the research.137
A person conducting research may not identify any individual patient in any report of that research or otherwise disclose patient identities.138