(a) The department shall establish an institutional review board to review and approve requests for access to data not contained in public use data. The members of the institutional review board must have experience and expertise in ethics, patient confidentiality, and health care data.
(b) To assist the institutional review board in determining whether to approve a request for information, the executive commissioner shall adopt rules similar to the federal Centers for Medicare and Medicaid Services’ guidelines on releasing data.

(c) A request for information other than public use data must be made on the form prescribed by the department.
(d) Any approval to release information under this section must require that the confidentiality provisions of this chapter be maintained and that any subsequent use of the information conform to the confidentiality provisions of this chapter.