5/7/2025Enacted by Chapter 269, 2025 General Session2025Protection of personal information.A supplier of a mental health chatbot may not sell to or share with any third party any:individually identifiable health information of a Utah user; oruser input of a Utah user.Subsection (1) does not apply to individually identifiable health information:requested by a health care provider with the consent of the Utah user;provided to a health plan of a Utah user upon request of the Utah user; orshared in compliance with Subsection (3).A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality.When sharing information under Subsection (3)(a), the supplier and the other entity shall comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as such terms are defined in 45 C.F.R. 160.103.