§ 2816-a. Cardiac services information. 1. Definitions. For the
purposes of this section, the following terms shall have the following
meanings:

(a) "Cardiac services information" shall mean the demographic,
clinical, procedural and outcome information collected from hospitals
and maintained by the department regarding patients who have been
diagnosed or treated for cardiac disease or conditions.

(b) "Cardiac data set" shall mean a subset of cardiac services
information consisting of data elements relevant to a research project.

2. Notwithstanding articles six and six-A of the public officers law,
the commissioner may collect and maintain cardiac services information
and prepare and release cardiac data sets for use in research projects
as set forth in this subdivision. Any cardiac data set released shall
contain the minimum amount of personally identifiable and demographic
information which the commissioner determines is necessary to conduct
the research project provided, however, that no cardiac data set shall
be released that contains patient names, social security numbers, or
other data elements that directly identify any patient.

3. The commissioner may release cardiac data sets for research
projects based on the following factors:

(a) the research project's potential contribution to improving the
quality of care and outcomes experienced by patients receiving cardiac
services, the appropriateness of cardiac services, access to cardiac
services, and/or the cost effectiveness of cardiac services;

(b) the technical feasibility of preparing the cardiac data set
requested;

(c) the scientific merit of the research project;

(d) the experience and qualifications of the researchers;

(e) the research project's feasibility;

(f) the applicant's capacity and agreement to protect the
confidentiality of the data;

(g) the research project's compliance with applicable state and
federal laws, policies and regulations governing the protection of human
subjects; and

(h) such other criteria as the commissioner develops in consultation
with experts in cardiac services.

4. Any researcher authorized by the commissioner to access a cardiac
data set shall:

(a) maintain the security and confidentiality of the information;

(b) not disclose the cardiac data set, or any portion thereof, unless
specifically permitted to do so by the commissioner;

(c) restrict the use of the data to the specific research project
approved by the commissioner;

(d) destroy, and document the destruction of, the data within a time
period specified by the commissioner; and

(e) execute and comply with a cardiac services data use agreement,
which includes but is not limited to provisions restricting the use and
disclosure of the data.

5. The commissioner shall charge a fee for each cardiac data set
released. Such fee shall be payable to the department, prior to the
release of any cardiac data set, for deposit into the general fund.

6. The commissioner may promulgate and enforce such rules and
regulations as he or she deems necessary to effectuate the purposes of
this section.