1. Disclosure to study entities. For health care improvement studies, regarding health care utilization, improvement, cost or quality and involving patients with whom the study entity has a treatment or payor relationship, whether the study is funded by the Federal Government or the State Government or private persons, the organization may disclose protected health information to a study entity who is a covered entity or to the covered entity’s business associates if those persons conducting the study do not disclose protected health information to any person not directly involved in the study without consent from the subject of the protected health information.

2. Recipients of information. A person receiving protected health information under subsection 1 may use that information only to the minimum extent necessary to accomplish the purposes of the study for which approval was granted and for no other purpose.

3. Confidentiality; protocol. The protocol for any study entity receiving protected health information under subsection 1 must be designed to preserve the confidentiality of all health care information that can be associated with identified patients, to specify the manner in which contact is made with patients and to maintain public confidence in the protection of confidential information.

4. Additional protection. The board may not grant approval to a study entity under this section for the disclosure of protected health information if the board finds that the proposed identification of or contact with patients would violate any state or federal law or diminish the confidentiality of health care information or the public’s confidence in the protection of that information in a manner that outweighs the expected benefit to the public of the proposed investigation.

5. Data use agreement. Prior to disclosing any data pursuant to subsection 1, the organization shall enter into a data use agreement with a study entity. The agreement must include protocols that have been approved by the board for safeguarding confidential information and for ensuring there will be no disclosures of protected health information. The protocols must include appropriate accountability and notification requirements as in business associate agreements under HIPAA.