This chapter provides one method by which the Commission may consider requests for encounter level data from the Maryland medical care data base and any other Commission data base that contains data elements that qualify as “individually identifiable health information”, as defined in the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191 (1996). The Commission may also use another recognized Institutional Review Board to consider requests for encounter level data from the Maryland medical care data base or any other requests for Commission information that require consideration by an Institutional Review Board. This chapter does not apply to: Requests for information from the Maryland medical care data base or any other Commission data base considered public under applicable laws and regulations; or Internal activities of the Commission that are required for it to conduct its lawful business of assembling the Maryland medical care data base, or any other data base that it is authorized to create, and performing research. In this chapter, the following terms have the meanings indicated. Terms Defined. “Application” means a request for information made pursuant to this chapter. “Commission” means the Maryland Health Care Access and Cost Commission. “Data base” means the Maryland medical care data base established at Health-General Article, §19-1507, Annotated Code of Maryland. “IRB” means the Institutional Review Board. “Personal records” has the meaning set forth in State Government Article, §10-624, Annotated Code of Maryland. The Commission shall appoint the IRB. The IRB shall consist of at least nine members of which: Each member shall have expertise in health services research and information security; and At least one member's primary expertise is ethics. The IRB shall be sufficiently qualified through the experience and diversity of its members, including consideration of race, gender, and cultural backgrounds, and sensitivity to such issues as community attitudes to promote respect for its advice and counsel. Commission members and Commission staff may not serve on the IRB. Commission staff may provide staff support to the IRB. The Commission shall solicit recommendations for appointment to the IRB from organizations and institutions whose mission is related to IRB matters, as the Commission considers appropriate. Members shall serve on a volunteer basis for a term not to exceed 3 years. A member may be reappointed. The Commission may remove a member for: Misconduct; or Dereliction of duty. The IRB shall review all applications submitted pursuant to this chapter. The IRB shall recommend: Approval, disapproval, or termination; or Modifications in research or security to secure approval. The IRB shall meet as necessary in order to provide timely responses to requests for information. Requests for information within the scope of this chapter shall include a description of the: Research use to be made of the information; Intent, if any, to present or publish the findings; Nature of the requested information; Safeguards and procedures that the applicant will take to protect the identity of the data; and A description of any potential risks or benefits. Upon receipt of an application within the scope of this chapter, the Commission shall immediately forward the request and all supporting documentation to the IRB for a recommendation. The IRB shall require an applicant to provide any: Documentation necessary to satisfy itself that the security of the released data will be preserved; and Information necessary to assist the IRB in making a decision on an application. The IRB shall make a timely recommendation concerning release of the requested information. An IRB recommendation shall be made on the basis of a majority of the full IRB membership. If the IRB denies an application, the IRB shall inform the applicant promptly in writing of the reasons for denial. Deliberations. In conducting its deliberations, the IRB shall be mindful of conflicts of interest and the appearance of conflict. IRB members with an actual or apparent conflict concerning a particular application shall recuse themselves from deliberating and voting upon that application. The IRB shall recommend approval of an application only if: It is satisfied that: The use proposed to be made of the requested information is in the public interest, The risks of release of the requested information are reasonable in relation to the anticipated benefits, and Safeguards adequate to prevent inappropriate disclosures will be implemented by the applicant; and The applicant agrees to comply with the requirements of Regulation .12 of this chapter. The Commission shall review: All IRB recommendations for approval of applications; and IRB denials of applications only for good cause shown by the applicant, which shall consist of evidence demonstrating that the IRB failed to follow the process set forth in this chapter. In order to secure Commission review of an IRB denial, an applicant shall file an appeal of the denial with the Commission, together with any supporting memoranda and documentation, within 15 days of the date of receipt of the IRB denial. In reviewing an IRB recommendation, the Commission shall consider all relevant factors and render its decision in a timely fashion. In reviewing an IRB recommendation to deny an application, the Commission shall affirm the IRB's decision or, if the evidence warrants, remand the case to the IRB for further consideration. In remanding the matter to the IRB, the Commission shall inform the IRB of the basis for its decision and instruct the IRB concerning any remedial measures which the IRB must take on remand. A request for data from the data base is not a contested case under the Administrative Procedure Act. The IRB may use an expedited review procedure to review applications relating to minor changes to already approved information requests. Under an expedited review procedure, the review shall be carried out by: The chairperson of the IRB; or An IRB member designated by the chairperson. In reviewing the application under an expedited process, the reviewer shall exercise all of the authority of the IRB, except that the reviewer may not disapprove an application. An application shall be disapproved only after review in accordance with the nonexpedited procedure set forth in Regulation .04 of this chapter. Under an expedited review, Commission approval of an IRB recommendation shall be made only by vote of a majority of the full Commission. The Commission shall require an applicant to file periodic progress reports concerning any aspect of the use of data released under this chapter. The Commission may: Investigate use made of data released under this chapter; and Require an applicant to provide information necessary to assist the Commission in its investigation. The Commission may delegate the function listed in §B of this regulation to the IRB. If an applicant fails to make use of the data in accordance with IRB requirements, including IRB data security and confidentiality requirements, the Commission, at the recommendation of the IRB or on its own motion, may: Immediately suspend or terminate its approval of the data release; and Require the applicant to: Return to the Commission, or Destroy previously released data. The applicant is entitled to a post-suspension or termination hearing in front of the IRB to show cause why the suspension or termination should be rescinded. Following the hearing, the IRB shall make a recommendation to the Commission concerning reinstatement of the applicant's use of the information. Data release to a party with which the Commission has contracted pursuant to the State procurement process may not be referred to the IRB. However, other cooperative research activities involving data within the scope of this chapter shall be referred to the IRB for its opinion and recommendation. The IRB shall maintain the following records: Minutes of all IRB meetings describing: Time and date of the meetings; Members present; Actions taken; Votes on the actions including the number: Voting for; Voting against; and Abstaining; The basis for requiring changes in or disapproving research; and A discussion of controverted issues and their resolution; Minutes which shall include: Copies of all applications, supporting documentation, related correspondence, and progress reports; Records of continuing review activities; A list of IRB members and current curriculum vitae sufficient to demonstrate the IRB members' areas of expertise and current employment or consultant relationships and board memberships; and Any written procedures or bylaws adopted by the IRB. The IRB shall adhere to the record retention guidelines applicable to the Commission. Upon completion of research conducted with data released under this chapter, the applicant, at the IRB's discretion, shall: Destroy or return to the Commission all data and copies of data obtained from the Commission; and Provide to the Commission and the IRB a copy of any report, article, paper, or other document prepared by the applicant with use of the released data. As a prerequisite for release of any information under this chapter, the applicant shall enter into an agreement with the Commission which: Defines the scope of the use to be made of the released information; Provides for safeguards for protecting the identity of data; States that a breach of any condition of the agreement is a breach of contract; Provides for the return or destruction of data upon a determination of breach of contract by the Commission; and Authorizes the Commission to seek all other appropriate remedies for breach of contract. Health-General Article, §§19-109(a)(1) and (7) and (b)(5), 19-103(c)(3), and 19-133(d), Annotated Code of Maryland Effective date: March 8, 1999 (26:5 Md. R. 391) Regulation .01 amended effective October 14, 2002 (29:20 Md. R. 1589) Regulation .01A amended effective August 22, 2011 (38:17 Md. R. 1013)