Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584 and the following paragraphs, patient medical record information covered by §§ 1.460 through 1.499 of this part may be disclosed for the purpose of conducting scientific research.

1. (a) Information in individually identifiable form may be disclosed from records covered by §§ 1.460 through 1.499 of this part for the purpose of conducting scientific research if the Under Secretary for Health or designee makes a determination that the recipient of the patient identifying information:

   1. (1) Is qualified to conduct the research.

   2. (2) Has a research protocol under which the information:

      1. (i) Will be maintained in accordance with the security requirements of § 1.466 of this part (or more stringent requirements); and
      2. (ii) Will not be redisclosed except as permitted under paragraph (b) of this section.
   3. (3) Has furnished a written statement that the research protocol has been reviewed by an independent group of three or more individuals who found that the rights of patients would be adequately protected and that the potential benefits of the research outweigh any potential risks to patient confidentiality posed by the disclosure of records.

2. (b) A person conducting research may disclose information obtained under paragraph (a) of this section only back to VA and may not identify any individual patient in any report of that research or otherwise disclose patient identities.

   (Authority: 38 U.S.C. 7332(b)(2)(B))