2.52—Research activities.

(a) Patient identifying information may be disclosed for the purpose of conducting scientific research if the program director makes a determination that the recipient of the patient identifying information:
(1) Is qualified to conduct the research;
(2) Has a research protocol under which the patient identifying information:
(i) Will be maintained in accordance with the security requirements of § 2.16 of these regulations (or more stringent requirements); and
(ii) Will not be redisclosed except as permitted under paragraph (b) of this section; and
(3) Has provided a satisfactory written statement that a group of three or more individuals who are independent of the research project has reviewed the protocol and determined that:
(i) The rights and welfare of patients will be adequately protected; and
(ii) The risks in disclosing patient identifying information are outweighed by the potential benefits of the research.
(b) A person conducting research may disclose patient identifying information obtained under paragraph (a) of this section only back to the program from which that information was obtained and may not identify any individual patient in any report of that research or otherwise disclose patient identities.
[52 FR 21809, June 9, 1987, as amended at 52 FR 41997, Nov. 2, 1987]