Consistent with statute and rule, written policies and procedures provide that individuals and agencies may have access to records for the purposes of research, evaluation, and statistical analysis in accordance with a formal written agreement that:

1. (1) Authorizes access;
2. (2) Specifies uses of data; and
3. (3) Ensures confidentiality and security.