; and (B) facilitating public recommendations for devices to be prioritized under the pilot project described in paragraph (1), including requirements for the data necessary to support such recommendation. (3) Implementation The Secretary may satisfy the requirements of paragraphs (1) and (2) by continuing or expanding existing projects, or by beginning new projects, that meet the criteria of subparagraphs (A) through (E) of paragraph (1) or by entering into contracts, cooperative agreements, grants, or other appropriate agreements with public or private entities that have a significant presence in the United States, and meet the following additional conditions: (A) If such public or private entities are a component of another organization, the entities have established appropriate security measures to maintain the confidentiality and privacy of the data described in paragraph (1)(D) and the entity shall not make an unauthorized disclosure of such data to the other components of the organization in breach of such confidentiality and privacy requirements. (B) In the case of the termination or nonrenewal of such contracts, cooperative agreements, grants, or other appropriate agreements, the entities shall comply with each of the following: (i) Continue to comply with the confidentiality and privacy requirements under this subsection with respect to all data disclosed to the entity. (ii) Return any data disclosed to such entity under this subsection to which it would not otherwise have access or, if returning the data is not practicable, destroy the data. (C) Have at least one of the following qualifications: (i) Research, statistical, epidemiologic, or clinical capability and expertise to conduct and complete the activities under this subsection, including the capability and expertise to provide the Secretary access to de-identified data consistent with the requirements of this subsection. (ii) An information technology infrastructure in place to support electronic data and operational standards to provide security