(a) "Cardiac services information" shall mean the demographic, clinical, procedural and outcome information collected from hospitals and maintained by the department regarding patients who have been diagnosed or treated for cardiac disease or conditions.

(b) "Cardiac data set" shall mean a subset of cardiac services information consisting of data elements relevant to a research project. 2. Notwithstanding articles six and six-A of the public officers law, the commissioner may collect and maintain cardiac services information and prepare and release cardiac data sets for use in research projects as set forth in this subdivision. Any cardiac data set released shall contain the minimum amount of personally identifiable and demographic information which the commissioner determines is necessary to conduct the research project provided, however, that no cardiac data set shall be released that contains patient names, social security numbers, or other data elements that directly identify any patient. 3. The commissioner may release cardiac data sets for research projects based on the following factors:

(a) the research project's potential contribution to improving the quality of care and outcomes experienced by patients receiving cardiac services, the appropriateness of cardiac services, access to cardiac services, and/or the cost effectiveness of cardiac services;

(b) the technical feasibility of preparing the cardiac data set requested;

(c) the scientific merit of the research project;

(d) the experience and qualifications of the researchers;

(e) the research project's feasibility;

(f) the applicant's capacity and agreement to protect the confidentiality of the data;

(g) the research project's compliance with applicable state and federal laws, policies and regulations governing the protection of human subjects; and

(h) such other criteria as the commissioner develops in consultation with experts in cardiac services. 4. Any researcher authorized by the commissioner to access a cardiac data set shall:

(a) maintain the security and confidentiality of the information;

(b) not disclose the cardiac data set, or any portion thereof, unless specifically permitted to do so by the commissioner;

(c) restrict the use of the data to the specific research project approved by the commissioner;

(d) destroy, and document the destruction of, the data within a time period specified by the commissioner; and

(e) execute and comply with a cardiac services data use agreement, which includes but is not limited to provisions restricting the use and disclosure of the data. 5. The commissioner shall charge a fee for each cardiac data set released. Such fee shall be payable to the department, prior to the release of any cardiac data set, for deposit into the general fund. 6. The commissioner may promulgate and enforce such rules and regulations as he or she deems necessary to effectuate the purposes of this section.