(A) Any information, data, and reports with respect to a case of malignant disease which are furnished to, or procured by, any cancer registry in this state or the department of health shall be confidential and shall be used only for statistical, scientific, and medical research for the purposes of reducing the morbidity or mortality of malignant disease. No physician, dentist, person, or hospital furnishing such information, data, or report to any such cancer registry or the department of health, with respect to a case of malignant disease treated or examined by such physician, dentist, or person, or confined in such hospital, shall by reason of such furnishing be deemed to have violated any confidential relationship, or be held liable in damages to any person, or be held to answer for willful betrayal of a professional confidence within the meaning and intent of section 4731.22 of the Revised Code.
(B) Information concerning individual cancer patients obtained by the department for the Ohio cancer incidence surveillance system is for the confidential use of the department. However, a person involved with a medical research project may be given access to confidential information if the medical research project meets the standards established in paragraph (C) of this rule and if all the following conditions are met:
(1) The person conducting the research provides written information about the purpose of the research project, the nature of the data to be collected and how the researcher intends to analyze it, the records the researcher seeks to review, and the safeguards the researcher will take to protect the identity of patients whose records the researcher will be reviewing;
(2) The person conducting the research submits verification of his credentials and of the credentials of other individuals involved in conducting the research;
(3) In the view of the director of health, the proposed safeguards are adequate to protect the identity of each patient whose records will be reviewed. Safeguards for the protection of the identity of patients shall include, but are not limited to, provisions to limit access to identifying data to only those individuals who during the course of the project need access to such information for research purposes and provisions for the maintenance of the confidentiality of identifying information after the termination of the project;
(4) An agreement is executed between the department and the researcher that specifies the terms of the researcher's use of the records and prohibits the publication or release of the names of individual cancer patients or any facts tending to lead to the identification of individual cancer patients.
(C) Based on the written information submitted to the director pursuant to paragraph (B) of this rule, the director shall determine that access to confidential information concerning individual cancer patients shall be made available to a person involved in a medical research project if the medical research project meets the following standards:
(1) The medical research project has clearly defined goals that pertain to cancer prevention and control;
(2) For case control studies, the research design used in the medical research project will involve a sufficiently large sample size that any meaningful difference between cases and controls will be statistically significant. For other studies, the research project will provide enough cases for meaningful analysis of the data for identification of potential risk factors and intervention strategies for cancer prevention and control; and
(3) The medical research project will be conducted at a university, hospital, or other medical research institution by competent researchers who have the ability to analyze and interpret data.
(D) Notwithstanding paragraphs (A) and (B) of this rule, a researcher may, with the approval of the department, use the names of individual cancer patients when requesting additional information for research purposes or soliciting a patient's participation in a research project. If a researcher requests additional information or a cancer patient's participation in a research project, the researcher shall first obtain the oral or written consent of the patient's attending physician. If the consent of the patient's attending physician is obtained, the researcher shall obtain the patient's written consent by having the patient complete a release of confidential information form.
(E) Notwithstanding paragraphs (A) and (B) of this rule, the department may release confidential information concerning individual cancer patients to physicians for diagnostic and treatment purposes if the patient's attending physician gives oral or written consent to the release of the information and the patient gives written consent by completing a release of confidential information form.
(F) Notwithstanding paragraph (A) and (B) of this rule the department may release confidential information concerning individual cancer patients to the cancer registry of another state, if the other state has entered into a reciprocal agreement with the department and the agreement provides that the state will comply with this section and that information identifying a patient will not be released to any person without the written consent of the patient.
(G) Nothing in this rule prevents the release to any person of epidemiological information that does not identify individual cancer patients.