§323C-37 Health research. (a) A health care provider, health plan, public health authority, employer, insurer, or educational institution may disclose protected health information to a health researcher if the following requirements are met:
(1) The research shall have been approved by an institutional review board. In evaluating a research proposal, an institutional review board shall require that the proposal demonstrate a clear purpose, scientific integrity, and a realistic plan for maintaining the confidentiality of protected health information. Research not otherwise subjected by federal regulation to institutional review board review shall be subject only to the review requirements of this paragraph;
(2) The health care provider, health plan, public health authority, employer, insurer, or educational institution shall only disclose protected health information which it has previously created or collected; and
(3) The holder of protected health information shall keep a record of all health researchers to whom protected health information has been made available.
(b) A health researcher who receives protected health information shall remove and destroy, at the earliest opportunity consistent with the purposes of the project involved, any information that would enable an individual to be identified.
(c) A health researcher who receives protected health information shall not disclose or use the protected health information or unique patient identifiers for any purposes not reviewed by an institutional review board under this part or for any purposes other than the health research project for which the information was obtained, except that the health researcher may disclose the information pursuant to section 323C-35(a). [L 1999, c 87, pt of §2; am L 2000, c 140, §3]