(1) No individually identifiable health information is released by the Department of Health and adequate safeguards are put into place to ensure the protection of the identify of each patient whose records will be reviewed;
(2) The person or entity conducting the research provides written information about:
(A) The purpose of the research project;
(B) The nature of the data to be collected and how the research intends to analyze the data; and
(C) The records the researcher wishes to review; and
(3) An agreement is executed between the Department of Health and the researcher that specifies the terms of the researcher’s use of the records and prohibits the release of any individually identifiable health information inadvertently disclosed by the Department of Health.