1. (a) Except as provided in subsection (b) of this section, an entity that receives a request for data under § 20-2404 of this subtitle shall:

   1. (1) For data that does not contain personally identifiable information, promptly transmit the data to the staff of the Commission provided by the Health Services Cost Review Commission; and

   2. (2) For data that contains personally identifiable information:

      1. (i) Promptly enter into an appropriate data sharing and use agreement with the Health Services Cost Review Commission; and
      2. (ii) On the approval of an appropriate agreement by the parties, promptly transmit the data, through a secure and encrypted manner, to the staff of the Commission provided by the Health Services Cost Review Commission.
2. (b) If an entity that receives a data request under § 20-2404 of this subtitle is prohibited from sharing the data under federal law, the Commission may not require the submission of the data.
3. (c) The Commission may use personally identifiable information requested under § 20-2404 of this subtitle only for the purpose of meeting the requirements of § 20-2403 of this subtitle and completing the reports required under § 20-2406 of this subtitle.

4. (d) Personally identifiable information submitted under subsection (a)(2) of this section may not be shared with:

   1. (1) A member of the Commission who is not an employee of the Health Services Cost Review Commission; or
   2. (2) Any other person that is not a party to the data sharing and use agreement for the information.

5. (e) Commission staff shall:

   1. (1) Analyze personally identifiable information shared with the Commission staff; and
   2. (2) Share the findings of the analysis with the members of the Commission in a manner that does not reveal personally identifiable information.

Added by Acts 2024, c. 844, § 1, eff. July 1, 2024.