N.Y. PBH Law § 2816-A

§ 2816-a. Cardiac services information. 1. Definitions. For the\npurposes of this section, the following terms shall have the following\nmeanings:\n (a) "Cardiac services information" shall mean the demographic,\nclinical, procedural and outcome information collected from hospitals\nand maintained by the department regarding patients who have been\ndiagnosed or treated for cardiac disease or conditions.\n (b) "Cardiac data set" shall mean a subset of cardiac services\ninformation consisting of data elements relevant to a research project.\n 2. Notwithstanding articles six and six-A of the public officers law,\nthe commissioner may collect and maintain cardiac services information\nand prepare and release cardiac data sets for use in research projects\nas set forth in this subdivision. Any cardiac data set released shall\ncontain the minimum amount of personally identifiable and demographic\ninformation which the commissioner determines is necessary to conduct\nthe research project provided, however, that no cardiac data set shall\nbe released that contains patient names, social security numbers, or\nother data elements that directly identify any patient.\n 3. The commissioner may release cardiac data sets for research\nprojects based on the following factors:\n (a) the research project's potential contribution to improving the\nquality of care and outcomes experienced by patients receiving cardiac\nservices, the appropriateness of cardiac services, access to cardiac\nservices, and/or the cost effectiveness of cardiac services;\n (b) the technical feasibility of preparing the cardiac data set\nrequested;\n (c) the scientific merit of the research project;\n (d) the experience and qualifications of the researchers;\n (e) the research project's feasibility;\n (f) the applicant's capacity and agreement to protect the\nconfidentiality of the data;\n (g) the research project's compliance with applicable state and\nfederal laws, policies and regulations governing the protection of human\nsubjects; and\n (h) such other criteria as the commissioner develops in consultation\nwith experts in cardiac services.\n 4. Any researcher authorized by the commissioner to access a cardiac\ndata set shall:\n (a) maintain the security and confidentiality of the information;\n (b) not disclose the cardiac data set, or any portion thereof, unless\nspecifically permitted to do so by the commissioner;\n (c) restrict the use of the data to the specific research project\napproved by the commissioner;\n (d) destroy, and document the destruction of, the data within a time\nperiod specified by the commissioner; and\n (e) execute and comply with a cardiac services data use agreement,\nwhich includes but is not limited to provisions restricting the use and\ndisclosure of the data.\n 5. The commissioner shall charge a fee for each cardiac data set\nreleased. Such fee shall be payable to the department, prior to the\nrelease of any cardiac data set, for deposit into the general fund.\n 6. The commissioner may promulgate and enforce such rules and\nregulations as he or she deems necessary to effectuate the purposes of\nthis section.\n