[§323C-37] Health research.
(a) A health care provider, health plan, public health authority, employer, insurer, or educational institution may disclose protected health information to a health researcher if the following requirements are met:(1) The research shall have been approved by an institutional review board. In evaluating a research proposal, an institutional review board shall require that the proposal demonstrate a clear purpose, scientific integrity, and a realistic plan for maintaining the confidentiality of protected health information;
(2) The health care provider, health plan, public health authority, employer, insurer, or educational institution shall only disclose protected health information which it has previously created or collected; and
(3) The holder of protected health information shall keep a record of all health researchers to whom protected health information has been made available.
(b) A health researcher who receives protected health information shall remove and destroy, at the earliest opportunity consistent with the purposes of the project involved, any information that would enable an individual to be identified.
(c) A health researcher who receives protected health information shall not disclose or use the protected health information for any purposes obtained, except that the health researcher may disclose the information pursuant to section 323C-35(a). [L 1999, c 87, pt of §2]