In this chapter, the following terms have the meanings indicated. Terms Defined. “All-payor claims database” or “APCD” means a large-scale database that systematically collects and aggregates enrollment, claims, and provider information from private and public payors in a state. “Applicant” means a person, governmental entity, or other entity that submits an application requesting data from the Commission. “Application” means a written request for data submitted in the form and manner specified by the Commission. “Commission” means the Maryland Health Care Commission. “Data extract” means a subset of information from the Maryland medical care database or other data base maintained by the Commission based on criteria provided by an applicant. “Data recipient” means a person, governmental entity, or other entity whose application has been approved and who is authorized to access and use data requested in an application in accordance with a data use agreement. “Data release” means the process of providing a data recipient with access and use of data requested in an application in accordance with a data use agreement. “Data Release Advisory Committee” or “DRAC” means a multi-stakeholder group of individuals appointed by the Commission whose functions include but are not limited to that of privacy board review as described in 45 CFR §164.512, reviewing completed applications, and making a written recommendation to the Executive Director regarding whether an application should be approved, approved with conditions, or disapproved. “Data set” means a collection of separate data elements or variables that can be manipulated as a unit. “Data use agreement” means a written contractual document entered into between the Commission and a data recipient that contains terms and conditions that govern a data recipient’s access to and use of data provided by the Commission. “De-identified data” means information that does not identify an individual and for which there is no reasonable basis to believe that it can be used to identify an individual. “Direct individual identifier” means personal information such as name, Social Security number, and date of birth that uniquely identifies an individual or that can be combined with other readily available information to uniquely identify an individual. “Disclose” means the release, redisclosure, transfer, provision, access, transmission, communication, or divulgence in any other manner of data release pursuant to this chapter. Entity. “Entity” means a person, partnership, firm, association, limited liability company, limited liability partnership, or public or private corporation. “Entity includes a county or municipality of Maryland or a governmental entity of another state. “Executive Director” means the Executive Director of the Maryland Health Care Commission. “Funding source” means any federal or state governmental entity, public or private corporation or organization, educational or research institution or organization, foundation, person, individual, or other entity that has committed to give or grant, or has already given or granted, monetary funds to an applicant to cover all or part of the costs of the proposed use of the data described in an application submitted to the Commission. Governmental Entity. “Governmental entity” means any agency, authority, board, commission, council, department, instrumentality, unit, or other body of State government or the federal government that is established by law. “Governmental entity” does not include a county or municipality of Maryland or a governmental entity of another state. “HIPAA” means the United States Health Insurance Portability and Accountability Act of 1996, P.L.10491, as implemented and amended in federal regulations, including the HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164, as they may be amended, modified, or renumbered, including as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act. “Identifiable data” means information that contains data elements that can be used to identify a specific individual. “Indirect individual identifier” means a data element that can be used to identify an individual when combined with other information or data. “Institutional Review Board” or “IRB” has the meaning stated in 45 CFR Part 46, and any subsequent revisions of those regulations, as they may be amended, modified, or renumbered, regarding the protection of human subject research. “Medicaid” means the Maryland Medical Assistance Program. “Medical Care Data Base” or “MCDB” means the data base established and maintained by the Commission pursuant to Health-General Article, §19-133, Annotated Code of Maryland, that collects eligibility data, professional services claims, institutional services claims, pharmacy claims, and provider data for Maryland residents enrolled in private insurance, Medicaid, or Medicare. The MCDB is Maryland’s all-payer claims data base. “Person” means an individual, receiver, trustee, guardian, personal representative, fiduciary, representative of any kind, partnership, firm, association, corporation, or other entity. “Product” means any creation derived in whole or part from data released pursuant to this chapter, including an analysis, article, chart, compilation, display, finding, graph, information, manuscript, map, presentation, publication, report, service, software, study, subscription service, summary, table, or website. “Protected health information” or “PHI” means individually identifiable health information as defined in the HIPAA Privacy Rule at 45 CFR §160.103, as it may be amended, modified, or renumbered. “State” means: When capitalized, the State of Maryland; or When lowercase, any state, possession, territory, or commonwealth of the United States, or the District of Columbia.