Md. Code Regs. 10.25.05.08

Current through Register Vol. 51, No. 22, November 1, 2024

Section 10.25.05.08 - Data Release Advisory Committee

A. The Commission shall establish a Data Release Advisory Committee (DRAC) that meets the membership composition requirements and performs the review functions of a privacy board as described in 45 CFR § 164.512.

B. The Commission shall appoint the members of the DRAC and a chairperson from among the appointed members.

C. The number of members appointed to the DRAC shall be at the discretion of the Commission but large enough to:

(1) Represent the appropriate range of stakeholder groups described in §D of this regulation; and

(2) Provide relevant experience, professional competency, and subject matter expertise in the areas of consumer privacy and advocacy, data analytics, data privacy, data security, health policy research, individual privacy issues, information technology, public health, and the use and analysis of health care claims data.

D. The membership of the DRAC shall include, but not be limited to:

(1) Representatives of various stakeholder groups, including academic research organizations, consumer advocacy organizations, employers, health care providers, health maintenance organizations, insurers, and nonprofit health service plans, that possess the relevant experience, professional competency, and subject matter expertise described in §C(2) of this regulation;

(2) At least one representative from Medicaid;

(3) At least one Commission staff member who shall serve as an ex-officio member; and

(4) Any additional representatives that the Commission determines are needed.

E. Members of the DRAC shall serve for a term not to exceed 3 years. At the end of a term, a member continues to serve until a successor is appointed. A member of the DRAC may be reappointed.

F. The DRAC shall meet as necessary to:

(1) Review completed applications requesting data;

(2) Prepare reports and recommendations, with the administrative support of Commission staff, and submit them to the Executive Director;

(3) If requested by Commission staff or the Executive Director, provide advice, consultation, and expertise on issues and questions that may arise:

(a) During Commission staff's review of applications under Regulations .05 and .06 of this chapter;

(b) During the Executive Director's review of applications under Regulation .10 of this chapter; and

(c) After an application has been approved and requested data has been released to a data recipient, regarding compliance and enforcement of a data use agreement under Regulations .13 and .14 of this chapter; and

(4) Perform any other duties and obligations required of the DRAC under this chapter.

G. Commission staff shall provide the necessary administrative support required for the DRAC to perform its duties and obligations under this chapter, such as facilitating the scheduling and conducting of DRAC meetings, providing DRAC meeting agendas and supporting reference materials, conducting research and obtaining additional information as requested by the DRAC, and assisting in the preparation of written reports and recommendations.

H. The Executive Director may remove a member of the DRAC for neglect of duty or misconduct by providing written notification to the DRAC member, stating the reason for the removal.

I. A member of the DRAC who receives written notification of removal under §H of this regulation may submit a written request for full Commission review of the Executive Director's removal decision within 20 business days of the date of the Executive Director's written notification of removal. The written request for full Commission review shall state with particularity the grounds and factual basis for the DRAC member's disagreement with the Executive Director's decision to remove the DRAC member.

Md. Code Regs. 10.25.05.08

Regulation .08 adopted effective 48:25 Md. R.1071-1098, eff. 12/13/2021