H.B. 177

1

GENETIC TESTING PRIVACY ACT
2 1999 GENERAL SESSION
3 STATE OF UTAH
4 Sponsor: Nora B. Stephens
5 AN ACT RELATING TO HEALTH; ENACTING THE GENETIC TESTING PRIVACY ACT;
6 DEFINING TERMS; REQUIRING VERBAL DISCLOSURE AND WRITTEN CONSENT
7 PRIOR TO COLLECTING A DNA SAMPLE FOR GENETIC ANALYSIS; REQUIRING
8 WRITTEN CONSENT TO DISCLOSE PRIVATE GENETIC INFORMATION TO A THIRD
9 PARTY; PLACING RESTRICTIONS ON EMPLOYERS AND INSURERS WITH LIMITED
10 EXCEPTIONS; ESTABLISHING EXCEPTIONS TO THE REQUIREMENT OF INFORMED
11 CONSENT; PERMITTING COMPELLED DISCLOSURE OF PRIVATE GENETIC
12 INFORMATION IN LIMITED CIRCUMSTANCES; PROVIDING A PRIVATE RIGHT OF
13 ACTION FOR VIOLATIONS; AUTHORIZING THE ATTORNEY GENERAL TO ENFORCE
14 THE ACT; AND PROVIDING AN EFFECTIVE DATE.
15 This act affects sections of Utah Code Annotated 1953 as follows:
16 AMENDS:
17 63-2-202, as last amended by Chapter 312, Laws of Utah 1994
18 63-2-302, as last amended by Chapter 303, Laws of Utah 1998
19 ENACTS:
20 26-44-101, Utah Code Annotated 1953
21 26-44-102, Utah Code Annotated 1953
22 26-44-103, Utah Code Annotated 1953
23 26-44-104, Utah Code Annotated 1953
24 26-44-105, Utah Code Annotated 1953
25 26-44-106, Utah Code Annotated 1953
26 26-44-107, Utah Code Annotated 1953
27 26-44-108, Utah Code Annotated 1953

28 26-44-109, Utah Code Annotated 1953
29 26-44-110, Utah Code Annotated 1953
30 26-44-111, Utah Code Annotated 1953
31 31A-22-1601, Utah Code Annotated 1953
32 31A-22-1602, Utah Code Annotated 1953
33 34A-9-101, Utah Code Annotated 1953
34 34A-9-102, Utah Code Annotated 1953
35 Be it enacted by the Legislature of the state of Utah:
36 Section 1. Section 26-44-101 is enacted to read:
37 CHAPTER 44. GENETIC TESTING PRIVACY ACT
38 26-44-101. Title.
39 This chapter is known as the "Genetic Testing Privacy Act."
40 Section 2. Section 26-44-102 is enacted to read:
41 26-44-102. Definitions.
42 As used in this chapter:
43 (1) "Blood relative" means a person's biologically related:
44 (a) parent;
45 (b) grandparent;
46 (c) child;
47 (d) grandchild;
48 (e) sibling;
49 (f) uncle;
50 (g) aunt;
51 (h) nephew;
52 (i) niece; or
53 (j) first cousin.
54 (2) "Compulsory disclosure" means any disclosure of private genetic information
55 mandated or required by federal law, state law, or Section 26-44-109 .
56 (3) "Disclose" or "disclosure" means to convey or to provide access to private genetic
57 information to a person other than the individual.
58 (4) "DNA" means deoxyribonucleic acid, ribonucleic acid, and chromosomes, which may

59 be analyzed to detect heritable diseases or conditions, including the identification of carriers,
60 predicting risk of disease, or establishing a clinical diagnosis.
61 (5) "DNA sample" means any human biological specimen from which DNA can be
62 extracted, or DNA extracted from such specimen.
63 (6) "DNA typing" means a scientifically reliable method for characterizing and comparing
64 sequences of DNA, and applying a statistical analysis of population frequency to determine that
65 if the DNA sequences match, the probability that the match occurs by chance.
66 (7) (a) "Genetic analysis" or "genetic test" means the testing or analysis of an identifiable
67 individual's DNA that results in information that is derived from the presence, absence, alteration,
68 or mutation of a gene or genes, or the presence or absence of a specific DNA marker or markers.
69 (b) "Genetic analysis" or "genetic test" does not mean:
70 (i) a routine physical examination;
71 (ii) a routine chemical, blood, or urine analysis, unless conducted purposefully to identify
72 genetic variation; or
73 (iii) a test to identify the presence of drugs or HIV infection.
74 (8) (a) "Individual" means the person from whose body the DNA sample originated unless
75 Subsection (b) or (c) applies.
76 (b) In the event that the person from whose body the DNA sample originated is a minor
77 or an incompetent person, "individual" means the person with the legal authority to make health
78 care decisions on behalf of the minor or incompetent person.
79 (c) In the event that the person from whose body the DNA sample originated is deceased,
80 "individual" means, in the following order of priority, the deceased person's:
81 (i) estate administrator or executor;
82 (ii) legal guardian;
83 (iii) spouse;
84 (iv) parent; or
85 (v) child 18 years of age or older.
86 (9) "Individual identifier" means a name, address, Social Security number, health insurance
87 identification number, or similar information by which the identity of an individual can be
88 determined with reasonable accuracy. The term does not include information that has been
89 anonymized through encryption or encoding.

90 (10) "Institutional Review Board" means a board established in accordance with 45 CFR
91 46.102(g)(1992) as such regulation may be amended.
92 (11) "Legal rights" means any statutory or contractual right that arises as a result of or in
93 connection with the provisions of this chapter.
94 (12) "Person" means any person, organization, or entity other than the individual.
95 (13) (a) "Private genetic information" means any information about an identifiable
96 individual that is derived from the presence, absence, alteration, or mutation of a gene or genes,
97 or the presence or absence of a specific DNA marker or markers, and which has been obtained:
98 (i) from a test or analysis of the individual's DNA; or
99 (ii) from a test or analysis of a person's DNA to whom the individual is a blood relative.
100 (b) "Private genetic information" does not include information that is derived from:
101 (i) a routine physical examination;
102 (ii) a routine chemical, blood, or urine analysis, unless conducted purposefully to identify
103 genetic variation; or
104 (iii) a test to identify the presence of drugs or HIV infection.
105 Section 3. Section 26-44-103 is enacted to read:
106 26-44-103. DNA samples collected before or after July 1, 1999.
107 Except as provided in Section 26-44-108 , an individually identifiable DNA sample
108 collected in this state:
109 (1) for genetic analysis on or after July 1,1999, may only be collected, analyzed, stored,
110 and used for research or other purposes to the extent expressly permitted by and in strict
111 accordance with informed consent obtained in compliance with the requirements of Section
112 26-44-104 ;
113 (2) before July 1, 1999, may be subject to genetic analysis for clinical purposes without
114 complying with the provisions of Section 26-44-104 ; and
115 (3) before July 1, 1999, may be subject to genetic analysis for research purposes:
116 (a) in accordance with the specific purpose for which the sample was originally collected;
117 (b) after the sample has been permanently anonymized through the removal and
118 destruction of individual identifiers; or
119 (c) in connection with a research protocol approved by an institutional review board and:
120 (i) the informed consent requirements of Section 26-44-104 are met; or

121 (ii) a person who serves as a custodian of records and is not directly involved in research
122 or genetic analysis:
123 (A) directs the removal of all individually identifying information from the DNA sample
124 before the sample is analyzed in connection with the approved research protocol;
125 (B) if the identifying information is not destroyed, maintains the confidentiality of
126 individually identifying information and stores the information in a manner in which only the
127 custodian of records and his direct subordinates have access to the information; and
128 (C) only uses stored individually identifying information if:
129 (I) the use is necessary to further a legitimate research purpose which is approved by an
130 institutional review board;
131 (II) the confidentiality of the information can be maintained in accordance with Subsection
132 (3)(c)(ii)(B); and
133 (III) the disclosure of individually identifying information is limited to the individual, the
134 individual's next of kin, and the individual's health care providers.
135 Section 4. Section 26-44-104 is enacted to read:
136 26-44-104. Informed consent for genetic testing.
137 (1) Except as provided in Section 26-44-108 , no person may collect or cause to be
138 collected an individually identifiable DNA sample in this state for genetic analysis without:
139 (a) verbally informing the individual in a face-to-face exchange:
140 (i) that consent to genetic analysis is voluntary;
141 (ii) of the specific purpose for and information that is likely to result from analyzing the
142 DNA sample in the manner contemplated;
143 (iii) of the predictive nature of genetic analysis, including the difference between carrying
144 a gene and manifesting a disorder;
145 (iv) that genetic analysis may result in important information about the individual's blood
146 relatives that may not be known and that if it does, the individual will have to decide whether or
147 not to disclose the information to them;
148 (v) that Utah law restricts the use of private genetic information in employment decisions
149 and insurance underwriting, but it is possible for someone to ask the individual in the future of the
150 existence of a genetic test or analysis and to potentially condition a benefit on the disclosure of
151 information regarding such testing or analysis;

152 (vi) of the availability of genetic counseling;
153 (vii) that the DNA sample will be destroyed within six months or the time specified in
154 federal law after it has been analyzed in accordance with the individual's consent unless the
155 individual agrees otherwise; and
156 (viii) in the event that the DNA sample is to be used for research purposes, an explanation
157 of:
158 (A) the scope and purpose of the research project;
159 (B) the function of an institutional review board;
160 (C) the length of time the DNA sample will be stored;
161 (D) the intended and potential uses of the DNA sample both during the research project
162 and after its conclusion; and
163 (E) the protections established to protect private genetic information and individually
164 identifying information from disclosure; and
165 (b) the individual signing and dating a consent form, after verbally receiving the
166 information required by Subsection (1)(a), that includes:
167 (i) each provision required by Subsection (1)(a);
168 (ii) the individual's signed initials next to each provision required by Subsection (1)(a); and
169 (iii) a statement that verbal informed consent was given for each initialed provision.
170 (2) A person may not perform a genetic test on an individually identifiable DNA sample
171 if that person has actual knowledge that the individual:
172 (a) was in Utah at the time the sample was collected; and
173 (b) did not give informed consent in the manner required by Subsection (1).
174 (3) (a) Insurers and employers are prohibited from seeking an individual's informed
175 consent for genetic testing.
176 (b) Notwithstanding Subsection (3)(a), a health care provider who is employed by an
177 insurer to provide direct heath care services to insureds may seek an individual's informed consent
178 for genetic testing as long as:
179 (i) the request is for a legitimate medical purpose; and
180 (ii) the insurer does not have access to the resulting private genetic information, except to
181 the extent permitted in Subsection 26-44-107 (2).
182 (4) A copy of the consent form required by Subsection (1)(b) shall be provided to the

183 individual.
184 Section 5. Section 26-44-105 is enacted to read:
185 26-44-105. Disclosure of private genetic information.
186 (1) Except as provided in Sections 26-44-108 and 26-44-109 , no person who, in the
187 ordinary course of business, practice of a profession, or rendering of a service, creates, stores,
188 receives, or furnishes private genetic information, may disclose private genetic information to any
189 other person without the prior written authorization of the individual that is dated and signed and
190 includes at least the following:
191 (a) the identity of the person authorizing the disclosure;
192 (b) the identity of the person permitted to make the disclosure;
193 (c) the identity of those to whom the information is to be disclosed;
194 (d) a description of any class of persons who may handle the information in its processing,
195 transmission, or maintenance and a brief overview of the processes that are in place to protect the
196 confidentiality of the information;
197 (e) a description of the specific genetic information to be disclosed;
198 (f) a description of the purpose for which the disclosure is being made;
199 (g) an indication of whether the information may be stored indefinitely or destroyed at a
200 time certain;
201 (h) the date on which the written authorization for disclosure expires, which may not be
202 longer than 60 days after the date of authorization; and
203 (i) a statement that the authorization is subject to revocation at any time before the
204 disclosure is actually made.
205 (2) A copy of the authorization shall be provided to the individual.
206 (3) An individual may revoke or amend the authorization at any time by contacting the
207 person to whom authorization was given.
208 (4) An individual may not maintain an action against a person for disclosure of private
209 genetic information made in good faith reliance on a valid written authorization if the person had
210 no notice of the revocation of the authorization at the time the disclosure was made.
211 (5) Each disclosure made pursuant to a written authorization described in Subsection (1)
212 shall be accompanied by the following written statement: "This information has been disclosed to
213 you from private records protected under the Genetic Testing Privacy Act and any further

214 disclosure of the information without specific authorization from the individual is prohibited."
215 (6) A general authorization for the release of medical records or medical information may
216 not be used as a written authorization for the disclosure of private genetic information.
217 (7) An insurer may only use this section to access an individual's private genetic
218 information:
219 (a) to determine the insurer's obligation to pay for a genetic test or health care services
220 under Subsection 26-44-107 (2); or
221 (b) as permitted in Subsection 26-44-107 (4)(b).
222 (8) An employer may not use this section to access an individual's private genetic
223 information unless the individual has knowingly and voluntarily waived his right to have a court
224 or administrative law judge make a determination as to whether the disclosure of private genetic
225 information should be compelled under Section 26-44-108 .
226 (9) Private genetic information in the possession of an employer or insurer may not be
227 disclosed by means of a written authorization to any person other than:
228 (a) the individual; and
229 (b) the individual's health care provider.
230 Section 6. Section 26-44-106 is enacted to read:
231 26-44-106. Restrictions on employers.
232 (1) Except as provided in Subsection (2), an employer, as defined in Section 34A-2-103 ,
233 may not in connection with a hiring, promotion, retention, or any other employment-related
234 decision:
235 (a) access or otherwise take into consideration private genetic information about an
236 individual or his blood relative;
237 (b) request or require an individual to consent to a release for the purpose of accessing
238 private genetic information about the individual;
239 (c) request or require an individual or his blood relative to submit to a genetic test; and
240 (d) inquire into or otherwise take into consideration the fact that an individual or his blood
241 relative has taken or refused to take a genetic test.
242 (2) (a) Notwithstanding Subsection (1), an employer may seek an order compelling the
243 disclosure of private genetic information held by an individual or third party pursuant to Section
244 26-44-109 in connection with:

245 (i) an employment-related judicial or administrative proceeding in which the individual
246 has placed his health at issue; or
247 (ii) an employment-related decision in which the employer has a reasonable basis to
248 believe that the individual's health condition poses a real and unjustifiable safety risk requiring the
249 change or denial of an assignment.
250 (b) An order compelling the disclosure of private genetic information may only be entered
251 if the requirements of Subsections 26-44-109 (4) and (5) have been met.
252 Section 7. Section 26-44-107 is enacted to read:
253 26-44-107. Restrictions on insurers.
254 (1) Except as provided in Subsections (2) and (4), an insurer may not in connection with
255 the offer or renewal of an insurance product or in the determination of premiums, coverage,
256 renewal, cancellation, or any other underwriting decision that pertains directly to the individual
257 or any group of which the individual is a member that purchases insurance jointly:
258 (a) access or otherwise take into consideration private genetic information about an
259 individual or his blood relative;
260 (b) request or require an individual to consent to a release for the purpose of accessing
261 private genetic information about the individual;
262 (c) request or require an individual or his blood relative to submit to a genetic test; and
263 (d) inquire into or otherwise take into consideration the fact that an individual or his blood
264 relative has taken or refused to take a genetic test.
265 (2) With respect to health insurance, as defined in Subsection 31A-1-301 (35), an insurer:
266 (a) may request and obtain information regarding the necessity of a genetic test, but not
267 the results of the test, if a claim for payment for the test has been made against an individual's
268 health insurance policy;
269 (b) may request and obtain that portion of private genetic information that is necessary to
270 determine the insurer's obligation to pay for health care services where:
271 (i) the primary basis for rendering such services to an individual is the result of a genetic
272 test; and
273 (ii) a claim for payment for such services has been made against the individual's health
274 insurance policy;
275 (c) may only store information obtained under this Subsection (2) until the insurer's

276 obligation to pay for a genetic test or health care services has been fully resolved; and
277 (d) may only use or otherwise disclose the information in connection with a proceeding
278 to determine the obligation of an insurer to pay for a genetic test or health care services, provided
279 that:
280 (i) the disclosure of the information is limited to those persons who are direct participants
281 in the proceeding with a legitimate need to know the information; and
282 (ii) reasonable measures have been taken to limit disclosure for the protection of the
283 individual.
284 (3) (a) An insurer may, to the extent permitted by Subsection (2), seek an order compelling
285 the disclosure of private genetic information held by an individual or third party pursuant to
286 Section 26-44-109 .
287 (b) An action brought in accordance with Subsection (2) shall be presumed to meet the
288 finding requirement of Subsection 26-44-109 (4).
289 (c) An order authorizing the disclosure of private genetic information shall comply with
290 Subsection 26-44-109 (5).
291 (4) With respect to insurance other than health insurance, an insurer may in connection
292 with the offer or renewal of an insurance policy or in the determination of premiums, coverage,
293 or renewal:
294 (a) inquire into whether private genetic information from a personal or familial source was
295 a motivating factor in the decision to purchase insurance;
296 (b) if the individual's private genetic information was a motivating factor in the decision
297 to purchase insurance, request the individual to release his private genetic information to the
298 insurer;
299 (c) store information obtained under Subsection (4)(b) for 60 days before it must be
300 destroyed; and
301 (d) record the disposition of an application based on information obtained under
302 Subsection (4)(b) as long as there is no mention of a specific illness, disease, or other health
303 condition.
304 (5) Nothing in Subsection (4) may be construed as:
305 (a) permitting an insurer to disclose private genetic information or the insurer's disposition
306 of an insurance application based on private genetic information to a person other than the

307 individual; or
308 (b) restricting the right of an insurer to deny a claim in accordance with the terms of an
309 insurance policy or otherwise seeking relief if information properly requested under Subsection
310 (4)(a) was knowingly withheld.
311 (6) Outside of private genetic information, nothing in this section may be construed as
312 restricting the ability of an insurer to take into account the health status of an individual, group,
313 or population in determining premiums or making other underwriting decisions.
314 Section 8. Section 26-44-108 is enacted to read:
315 26-44-108. Exceptions to informed consent.
316 (1) Notwithstanding any other provision in this chapter, a person may provide access to
317 an individually identifiable DNA sample, or to data derived from DNA typing, to assist in the
318 identification of a dead body, provided that the analysis of any sample so provided and the analysis
319 of any DNA sample from the dead body is limited to that which is necessary to determine the
320 identity of the dead body.
321 (2) Nothing in this chapter may be construed to affect the authority of law enforcement
322 agencies under Title 53, Chapter 5, Part 2, Criminal Identification Act, in collecting, storing,
323 testing, typing, and controlling access to DNA samples in the course of conducting criminal
324 investigations.
325 (3) (a) With the exception of Sections 26-44-106 and 26-44-107 , which apply to insurers
326 and employers, nothing in this chapter may be construed to prohibit the collection or analysis of
327 an individually identifiable DNA sample pursuant to Title 62A, Chapter 11, Recovery Services;
328 Title 78, Chapter 45a, Uniform Act on Paternity; or Rule 35 of the Utah Rules of Civil Procedure
329 if the provisions of this Subsection (3) have been met.
330 (b) An order or agency request under Subsection (3)(a) may only be entered upon a finding
331 that:
332 (i) the genetic condition of the individual has been placed at issue;
333 (ii) other ways of obtaining the private information are not available or would not be
334 effective; and
335 (iii) there is a compelling need for the private genetic information which substantially
336 outweighs the potential harm to the privacy interests of the individual.
337 (c) An order or agency request under Subsection (3)(a) shall specify:

338 (i) the manner of collection of the DNA sample;
339 (ii) the person or persons authorized to collect and analyze the DNA sample;
340 (iii) the purpose of the genetic analysis;
341 (iv) that the genetic analysis is limited to that which is necessary to fulfill the purpose of
342 the order or request;
343 (v) that the sample may only be stored until the matter underlying the order or agency
344 request has been resolved and the time for appeal has lapsed;
345 (vi) those persons to whom disclosure of the resulting private genetic information may be
346 made because of a compelling need to know such information; and
347 (vii) such other measures as may be necessary to limit disclosure of the resulting private
348 genetic information for the protection of the individual.
349 (d) A paternity action brought under Subsection (3)(a) shall be presumed to meet the
350 finding requirement of Subsection (3)(b).
351 Section 9. Section 26-44-109 is enacted to read:
352 26-44-109. Compulsory disclosure of private genetic information.
353 (1) No person, including an individual, who maintains private genetic information may be
354 compelled to disclose such information pursuant to a request for compulsory disclosure in any
355 judicial, legislative, or administrative proceeding unless:
356 (a) the person maintaining the genetic information has received the authorization of the
357 individual to release the information in response to the request for compulsory disclosure;
358 (b) the individual is a party to or the subject of the proceeding, the private genetic
359 information is at issue, and the requirements of Section 26-44-106 and 26-44-107 , if applicable,
360 have been met; or
361 (c) the genetic information is for use in a law enforcement proceeding or investigation in
362 which the person maintaining the information is the subject or a party.
363 (2) (a) A person requesting compulsory disclosure pursuant to Subsection (1)(b) or (c)
364 shall serve upon the person maintaining the genetic information and upon the individual:
365 (i) a copy of the request at least ten days prior to the date on which the compulsory
366 disclosure is requested; and
367 (ii) a statement of the right of the individual or person maintaining the genetic information
368 to have any objections to compulsory disclosure heard by the court, legislature, or administrative

369 agency prior to the issuance of a compulsory disclosure order, and the procedure to be followed
370 to have any such objections heard.
371 (b) Service under Subsection (2)(a) may be sent by certified mail, return receipt requested,
372 or hand-delivered.
373 (3) Service of a compulsory disclosure request upon a person maintaining private genetic
374 information shall be accompanied by a written certification, signed by the person seeking to obtain
375 the private genetic information or his authorized representative:
376 (a) identifying at least one subsection of Section (1) in justification of compulsory
377 disclosure; and
378 (b) indicating that the notice requirement of Subsection (2)(a) has been met.
379 (4) An order under this section may only be entered upon a finding that:
380 (a) other ways of obtaining the private information are not available or would not be
381 effective; and
382 (b) there is a compelling need for the private genetic information which substantially
383 outweighs the potential harm to the privacy interests of the individual.
384 (5) An order under this section which authorizes the disclosure of private genetic
385 information shall:
386 (a) limit disclosure to those parts of the record containing such information as is essential
387 to fulfill the objective of the order;
388 (b) limit disclosure to those persons whose need for the information is the basis of the
389 order; and
390 (c) include such other measures as may be necessary to limit disclosure for the protection
391 of the individual.
392 Section 10. Section 26-44-110 is enacted to read:
393 26-44-110. Private right of action.
394 (1) An individual whose legal rights arising under this chapter have been violated may
395 recover damages and be granted equitable relief in a civil action.
396 (2) Any person who unintentionally violates the legal rights of an individual arising from
397 this chapter shall be liable to the individual for each separate violation in an amount equal to:
398 (a) actual damages sustained as a result of the violation or $5,000, whichever is greater;
399 (b) treble damages, if the violation resulted in profit or monetary gain; and

400 (c) reasonable attorneys' fees and costs.
401 (3) Any person who intentionally induces a person to violate the legal rights of an
402 individual arising from this chapter, or who, himself, intentionally violates the legal rights of an
403 individual arising from this chapter shall be liable to the individual for each separate violation in
404 an amount equal to:
405 (a) actual damages sustained as a result of the violation or $15,000, whichever is greater;
406 (b) punitive damages as the court may allow; and
407 (c) reasonable attorneys' fees and costs.
408 Section 11. Section 26-44-111 is enacted to read:
409 26-44-111. Enforcement.
410 (1) Whenever the attorney general has reason to believe that any person is using or is about
411 to use any method, act, or practice in violation of the provisions of this chapter, and that
412 proceedings would be in the public interest, the attorney general may bring an action against the
413 person to restrain or enjoin the use of such method, act, or practice.
414 (2) In addition to restraining or enjoining the use of a method, act, or practice, the court
415 may require the payment of:
416 (a) a civil fine of not more than:
417 (i) $10,000 for each separate unintentional violation; and
418 (ii) $30,000 for each separate intentional violation; and
419 (b) reasonable costs of investigation and litigation, including reasonable attorneys' fees.
420 Section 12. Section 31A-22-1601 is enacted to read:
421 Part 16. Genetic Testing Restrictions
422 31A-22-1601. Title.
423 This part is known as the "Genetic Testing Restrictions on Insurers Act."
424 Section 13. Section 31A-22-1602 is enacted to read:
425 31A-22-1602. Genetic testing restrictions.
426 With respect to matters related to genetic testing and private genetic information, an insurer
427 shall comply with Section 26-44-107 and the other applicable provisions of Title 26, Chapter 44,
428 Genetic Testing Privacy Act.
429 Section 14. Section 34A-9-101 is enacted to read:
430 CHAPTER 9. GENETIC TESTING RESTRICTIONS

431 34A-9-101. Title.
432 This part is known as the "Genetic Testing Restrictions on Employers Act."
433 Section 15. Section 34A-9-102 is enacted to read:
434 34A-9-102. Restrictions on employers.
435 With respect to matters related to genetic testing and private genetic information, an
436 employer shall comply with Section 26-44-106 and the other applicable provisions of Title 26,
437 Chapter 44, Genetic Testing Privacy Act.
438 Section 16. Section 63-2-202 is amended to read:
439 63-2-202. Access to private, controlled, and protected documents.
440 (1) Upon request, a governmental entity shall disclose a private record to:
441 (a) the subject of the record;
442 (b) the parent or legal guardian of an unemancipated minor who is the subject of the
443 record;
444 (c) the legal guardian of a legally incapacitated individual who is the subject of the record;
445 (d) any other individual who:
446 (i) has a power of attorney from the subject of the record;
447 (ii) submits a notarized release from the subject of the record or his legal representative
448 dated no more than 90 days before the date the request is made; or
449 (iii) if the record is a medical record described in Subsection 63-2-302 (1)(b), is a health
450 care provider, as defined in Subsection 26-33a-102 (7), if releasing the record or information in the
451 record is consistent with normal professional practice and medical ethics and Title 26, Chapter 44,
452 Genetic Testing Privacy Act; or
453 (e) any person to whom the record must be provided pursuant to court order as provided
454 in Subsection (7) or a legislative subpoena as provided in Title 36, Chapter 14, Legislative
455 Subpoena Powers.
456 (2) (a) Upon request, a governmental entity shall disclose a controlled record to:
457 (i) a physician, psychologist, certified social worker, insurance provider or agent, or a
458 government public health agency upon submission of a release from the subject of the record that
459 is dated no more than 90 days prior to the date the request is made and a signed acknowledgment
460 of the terms of disclosure of controlled information as provided by Subsection (2)(b); and
461 (ii) any person to whom the record must be disclosed pursuant to court order as provided

462 in Subsection (7) or a legislative subpoena as provided in Title 36, Chapter 14.
463 (b) A person who receives a record from a governmental entity in accordance with
464 Subsection (2)(a)(i) may not disclose controlled information from that record to any person,
465 including the subject of the record.
466 (3) If there is more than one subject of a private or controlled record, the portion of the
467 record that pertains to another subject shall be segregated from the portion that the requester is
468 entitled to inspect.
469 (4) Upon request, a governmental entity shall disclose a protected record to:
470 (a) the person who submitted the record;
471 (b) any other individual who:
472 (i) has a power of attorney from all persons, governmental entities, or political
473 subdivisions whose interests were sought to be protected by the protected classification; or
474 (ii) submits a notarized release from all persons, governmental entities, or political
475 subdivisions whose interests were sought to be protected by the protected classification or from
476 their legal representatives dated no more than 90 days prior to the date the request is made; or
477 (c) any person to whom the record must be provided pursuant to a court order as provided
478 in Subsection (7) or a legislative subpoena as provided in Title 36, Chapter 14.
479 (5) A governmental entity may disclose a private, controlled, or protected record to another
480 governmental entity, political subdivision, another state, the United States, or a foreign government
481 only as provided by Section 63-2-206 .
482 (6) Before releasing a private, controlled, or protected record, the governmental entity shall
483 obtain evidence of the requester's identity.
484 (7) A governmental entity shall disclose a record pursuant to the terms of a court order
485 signed by a judge from a court of competent jurisdiction, provided that:
486 (a) the record deals with a matter in controversy over which the court has jurisdiction;
487 (b) the court has considered the merits of the request for access to the record; and
488 (c) the court has considered and, where appropriate, limited the requester's use and further
489 disclosure of the record in order to protect privacy interests in the case of private or controlled
490 records, business confidentiality interests in the case of records protected under Subsections
491 63-2-304 (1) and (2), and privacy interests or the public interest in the case of other protected
492 records;

493 (d) to the extent the record is properly classified private, controlled, or protected, the
494 interests favoring access, considering limitations thereon, outweigh the interests favoring
495 restriction of access; and
496 (e) where access is restricted by a rule, statute, or regulation referred to in Subsection
497 63-2-201 (3)(b), the court has authority independent of this chapter to order disclosure.
498 (8) (a) A governmental entity may disclose or authorize disclosure of private or controlled
499 records for research purposes if the governmental entity:
500 (i) determines that the research purpose cannot reasonably be accomplished without use
501 or disclosure of the information to the researcher in individually identifiable form;
502 (ii) determines that the proposed research is bona fide, and that the value of the research
503 outweighs the infringement upon personal privacy;
504 (iii) requires the researcher to assure the integrity, confidentiality, and security of the
505 records and requires the removal or destruction of the individual identifiers associated with the
506 records as soon as the purpose of the research project has been accomplished;
507 (iv) prohibits the researcher from disclosing the record in individually identifiable form,
508 except as provided in Subsection (8)(b), or from using the record for purposes other than the
509 research approved by the governmental entity; [and]
510 (v) secures from the researcher a written statement of his understanding of and agreement
511 to the conditions of this subsection and his understanding that violation of the terms of this
512 subsection may subject him to criminal prosecution under Section 63-2-801 [.]; and
513 (vi) requires that the researcher complies with the provisions of Title 26, Chapter 44,
514 Genetic Testing Privacy Act, if the research involves genetic information.
515 (b) A researcher may disclose a record in individually identifiable form if the record is
516 disclosed for the purpose of auditing or evaluating the research program and no subsequent use or
517 disclosure of the record in individually identifiable form will be made by the auditor or evaluator
518 except as provided by this section.
519 (c) A governmental entity may require indemnification as a condition of permitting
520 research under this subsection.
521 (9) (a) Under Subsections 63-2-201 (5)(b) and 63-2-401 (6) a governmental entity may
522 disclose records that are private under Section 63-2-302 , or protected under Section 63-2-304 to
523 persons other than those specified in this section.

524 (b) Under Subsection 63-2-403 (11)(b) the Records Committee may require the disclosure
525 of records that are private under Section 63-2-302 , controlled under Section 63-2-303 , or protected
526 under Section 63-2-304 to persons other than those specified in this section.
527 (c) Under Subsection 63-2-404 (8) the court may require the disclosure of records that are
528 private under Section 63-2-302 , controlled under Section 63-2-303 , or protected under Section
529 63-2-304 to persons other than those specified in this section.
530 Section 17. Section 63-2-302 is amended to read:
531 63-2-302. Private records.
532 (1) The following records are private:
533 (a) records concerning an individual's eligibility for unemployment insurance benefits,
534 social services, welfare benefits, or the determination of benefit levels;
535 (b) records containing data on individuals describing medical history, diagnosis, condition,
536 treatment, evaluation, private genetic information, or similar medical data;
537 (c) records of publicly funded libraries that when examined alone or with other records
538 identify a patron;
539 (d) records received or generated for a Senate or House Ethics Committee concerning any
540 alleged violation of the rules on legislative ethics, prior to the meeting, and after the meeting, if
541 the ethics committee meeting was closed to the public;
542 (e) records received or generated for a Senate confirmation committee concerning
543 character, professional competence, or physical or mental health of an individual:
544 (i) if prior to the meeting, the chair of the committee determines release of the records:
545 (A) reasonably could be expected to interfere with the investigation undertaken by the
546 committee; or
547 (B) would create a danger of depriving a person of a right to a fair proceeding or impartial
548 hearing;
549 (ii) after the meeting, if the meeting was closed to the public;
550 (f) records concerning a current or former employee of, or applicant for employment with,
551 a governmental entity that would disclose that individual's home address, home telephone number,
552 social security number, insurance coverage, marital status, or payroll deductions; and
553 (g) that part of a record indicating a person's social security number if provided under
554 Section 31A-23-202 , 31A-26-202 , 58-1-301 , 61-1-4 , or 61-2-6 .

555 (2) The following records are private if properly classified by a governmental entity:
556 (a) records concerning a current or former employee of, or applicant for employment with
557 a governmental entity, including performance evaluations and personal status information such as
558 race, religion, or disabilities, but not including records that are public under Subsection
559 63-2-301 (1)(b) or 63-2-301 (2)(o), or private under Subsection 63-2-302 (1)(b);
560 (b) records describing an individual's finances, except that the following are public:
561 (i) records described in Subsection 63-2-301 (1);
562 (ii) information provided to the governmental entity for the purpose of complying with a
563 financial assurance requirement; or
564 (iii) records that must be disclosed in accordance with another statute;
565 (c) records of independent state agencies if the disclosure of those records would conflict
566 with the fiduciary obligations of the agency;
567 (d) other records containing data on individuals the disclosure of which constitutes a
568 clearly unwarranted invasion of personal privacy; and
569 (e) records provided by the United States or by a government entity outside the state that
570 are given with the requirement that the records be managed as private records, if the providing
571 entity states in writing that the record would not be subject to public disclosure if retained by it.
572 (3) (a) As used in this Subsection (3), "medical records" means medical reports, records,
573 statements, history, diagnosis, condition, treatment, and evaluation.
574 (b) Medical records in the possession of the University of Utah Hospital, its clinics,
575 doctors, or affiliated entities are not private records or controlled records under Section 63-2-303
576 when the records are sought:
577 (i) in connection with any legal or administrative proceeding in which the patient's
578 physical, mental, or emotional condition is an element of any claim or defense; or
579 (ii) after a patient's death, in any legal or administrative proceeding in which any party
580 relies upon the condition as an element of the claim or defense.
581 (c) Medical records are subject to production in a legal or administrative proceeding
582 according to state or federal statutes or rules of procedure and evidence as if the medical records
583 were in the possession of a nongovernmental medical care provider.
584 Section 18. Effective date.
585 This act takes effect on July 1, 1999.

Legislative Review Note
as of 11-20-98 10:45 AM

A limited legal review of this legislation raises no obvious constitutional or statutory concerns.

Office of Legislative Research and General Counsel

Committee Note

The Health and Human Services Interim Committee recommended this bill.