Utah Code 26B-8-508. Exceptions to prohibition on disclosure of identifiable health data
Current as of: 2024 | Check for updates
|
Other versions
(1) The department may not disclose any identifiable health data unless:
Terms Used In Utah Code 26B-8-508
- Control number: means a number or other identifier that:(2)(a) is assigned by the department to an individual's health data;(2)(b) is consistent with the best practices of data privacy; and(2)(c) is used to ensure health data is not able to be readily associated with an individual when the health data is provided for research or statistical analysis. See Utah Code 26B-8-501
- Data supplier: means a health care facility, health care provider, self-funded employer, third-party payor, health maintenance organization, or government department which could reasonably be expected to provide health data under this part. See Utah Code 26B-8-501
- disclose: means the communication of health care data to any individual or organization outside the department, its staff, and contracting agencies. See Utah Code 26B-8-501
- Health data: means information relating to the health status of individuals, health services delivered, the availability of health manpower and facilities, and the use and costs of resources and services to the consumer, except vital records as defined in Section
26B-8-101 shall be excluded. See Utah Code 26B-8-501- Identifiable health data: means any item, collection, or grouping of health data that makes the individual supplying or described in the health data identifiable. See Utah Code 26B-8-501
- Person: means :
(24)(a) an individual;(24)(b) an association;(24)(c) an institution;(24)(d) a corporation;(24)(e) a company;(24)(f) a trust;(24)(g) a limited liability company;(24)(h) a partnership;(24)(i) a political subdivision;(24)(j) a government office, department, division, bureau, or other body of government; and(24)(k) any other organization or entity. See Utah Code 68-3-12.5- Public health authority: means an agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, or a person acting under a grant of authority from or a contract with such an agency, that is responsible for public health matters as part of the agency or authority's official mandate. See Utah Code 26B-1-102
(1)(a) the individual has authorized the disclosure;(1)(b) the disclosure is to the department or a public health authority in accordance with Subsection (2); or(1)(c) the disclosure complies with the provisions of:(1)(c)(i) Subsection (3);(1)(c)(ii) insurance enrollment and coordination of benefits under Subsection26B-8-504 (1)(d); or(1)(c)(iii) risk adjusting under Subsection26B-8-504 (1)(b).(2) The department may disclose identifiable health data to the department or a public health authority under Subsection (1)(b) if:(2)(a) the department or the public health authority has clear statutory authority to possess the identifiable health data; and(2)(b) the disclosure is solely for use:(2)(b)(i) in the Utah Statewide Immunization Information System operated by the department;(2)(b)(ii) in the Utah Cancer Registry operated by the University of Utah, in collaboration with the department; or(2)(b)(iii) by the medical examiner, as defined in Section26B-8-201 , or the medical examiner’s designee.(3) The department shall consider the following when responding to a request for disclosure of information that may include identifiable health data:(3)(a) whether the request comes from a person after that person has received approval to do the specific research or statistical work from an institutional review board; and(3)(b) whether the requesting entity complies with the provisions of Subsection (4).(4) A request for disclosure of information that may include identifiable health data shall:(4)(a) be for a specified period; or(4)(b) be solely for bona fide research or statistical purposes as determined in accordance with administrative rules adopted by the department in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act , which shall require:(4)(b)(i) the requesting entity to demonstrate to the department that the data is required for the research or statistical purposes proposed by the requesting entity; and(4)(b)(ii) the requesting entity to enter into a written agreement satisfactory to the department to protect the data in accordance with this part or other applicable law.(5) A person accessing identifiable health data pursuant to Subsection (4) may not further disclose the identifiable health data:(5)(a) without prior approval of the department; and(5)(b) unless the identifiable health data is disclosed or identified by control number only.(6) Identifiable health data that has been designated by a data supplier as being subject to regulation under 42 C.F.R. part 2, Confidentiality of Substance Use Disorder Patient Records, may only be used or disclosed in accordance with applicable federal regulations.