The CO APCD governance rules promulgated by the Department of Health Care Policy and Finance (HCPF) require that the Data Release Review Committee (DRRC) develop protocols for the release of CO APCD data. The DRRC is comprised of health care data and analytical experts representing a variety of organizations and stakeholder perspectives. The rules require that the DRRC review all requests and advise CIVHC on whether release of the data is consistent with the statutory purpose of the CO APCD, will contribute to efforts to improve health care for Colorado residents, complies with the requirements of HIPAA and will employ appropriate analytical methods. Requests must meet all these criteria in order to recommend for release. Recommended data requests then require the requestor to enter into a very strict Data Use Agreement. Additionally, CIVHC is required to report annually to HCPF listing data requests, their use and how they met HIPAA requirements.