(a) Except as prohibited under any applicable federal law, in cases where access to confidential records containing personal information is desired by a researcher for research purposes, the agency shall grant access if:

1. (1) the researcher states in writing to the agency the purpose, including any intent to publish findings, the nature of the data sought, what personal information will be required, and what safeguards, including reasonable de-identification methods, will be taken to protect the identity of the data subjects;
2. (2) the proposed safeguards are determined by the agency to be adequate to prevent the identity of an individual data subject from being known;
3. (3) the researcher executes a data sharing agreement or similar agreement with the agency that is approved by the management performance hub established by IC 4-3-26-8 , which incorporates such safeguards for protection of individual data subjects, defines the scope of the research project, and informs the researcher that failure to abide by conditions of the approved agreement constitutes a breach of contract, could result in the researcher not obtaining further records from the agency, and could result in civil litigation by the data subject or subjects;
4. (4) the researcher agrees to pay all direct or indirect costs of the research; and
5. (5) the agency maintains a copy of the agreement or contract for a period equivalent to the life of the record.

(b) Improper disclosure of confidential information by a state employee is cause for action to dismiss the employee.

As added by Acts 1978, P.L.10, SEC.6. Amended by Acts 1979, P.L.40, SEC.5; P.L.19-1983, SEC.5; P.L.201-2023, SEC.51.