Upon completion of a research or statistical project the security of identifiable research or statistical information shall be protected by:

(a) Complete physical destruction of all copies of the materials or the identifiable portion of such materials after a three-year required recipient retention period or as soon as authorized by law, or

(b) Removal of identifiers from data and separate maintenance of a name-code index in a secure location.