2
3
4
5
6
7
8 LONG TITLE
9 General Description:
10 This bill amends the Controlled Substance Database Act.
11 Highlighted Provisions:
12 This bill:
13 ▸ defines terms;
14 ▸ requires the Division of Occupational and Professional Licensing within the
15 Department of Commerce to make opioid prescription data information in its
16 controlled substance database accessible to an opioid prescriber or pharmacist via
17 the prescriber's or pharmacist's electronic data system;
18 ▸ limits access to and use of the information by an electronic data system, a
19 prescriber, or a pharmacist in accordance with rules established by the division;
20 ▸ requires rulemaking by the division;
21 ▸ requires the division to periodically audit use of the information; and
22 ▸ amends Controlled Substance Database Act penalty provisions.
23 Money Appropriated in this Bill:
24 None
25 Other Special Clauses:
26 None
27 Utah Code Sections Affected:
28 AMENDS:
29 58-37f-601, as last amended by Laws of Utah 2015, Chapter 326
30 ENACTS:
31 58-37f-303, Utah Code Annotated 1953
32
33 Be it enacted by the Legislature of the state of Utah:
34 Section 1. Section 58-37f-303 is enacted to read:
35 58-37f-303. Access to opioid prescription information via an electronic data
36 system.
37 (1) As used in this section:
38 (a) "Dispense" means the same as that term is defined in Section 58-17b-102.
39 (b) "EDS user":
40 (i) means:
41 (A) a prescriber;
42 (B) a pharmacist; or
43 (C) an individual granted access to the database under Subsection 58-37f-301(3)(c);
44 and
45 (ii) does not mean an individual whose access to the database has been revoked by the
46 division pursuant to Subsection 58-37f-301(5)(b).
47 (c) "Electronic data system" means a software product or an electronic service used by:
48 (i) a prescriber to manage electronic health records; or
49 (ii) a pharmacist to manage the dispensing of prescription drugs.
50 (d) "Opioid" means any substance listed in Subsection 58-37-4(2)(b)(i) or (2)(b)(ii).
51 (e) "Pharmacist" means the same as that term is defined in Section 58-17b-102.
52 (f) "Prescriber" means a practitioner, as that term is defined in Section 58-37-2, who is
53 licensed under Section 58-37-6 to prescribe an opioid.
54 (g) "Prescription drug" means the same as that term is defined in Section 58-17b-102.
55 (2) Subject to Subsections (3) through (6), no later than January 1, 2017, the division
56 shall make opioid prescription information in the database available to an EDS user via the
57 user's electronic data system.
58 (3) An electronic data system may be used to make opioid prescription information in
59 the database available to an EDS user only if the electronic data system complies with rules
60 established by the division under Subsection (4).
61 (4) (a) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
62 Administrative Rulemaking Act, specifying:
63 (i) an electronic data system's:
64 (A) allowable access to and use of opioid prescription information in the database; and
65 (B) minimum actions that must be taken to ensure that opioid prescription information
66 accessed from the database is protected from inappropriate disclosure or use; and
67 (ii) an EDS user's:
68 (A) allowable access to opioid prescription information in the database via an
69 electronic data system; and
70 (B) allowable use of the information.
71 (b) The rules shall establish:
72 (i) minimum user identification requirements that in substance are the same as the
73 database identification requirements in Section 58-37f-301;
74 (ii) user access restrictions that in substance are the same as the database identification
75 requirements in Section 58-37f-301; and
76 (iii) any other requirements necessary to ensure that in substance the provisions of
77 Sections 58-37f-301 and 58-37f-302 apply to opioid prescription information in the database
78 that has been made available to an EDS user via an electronic data system.
79 (5) The division may not make opioid prescription information in the database
80 available to an EDS user via the user's electronic data system if:
81 (a) the electronic data system does not comply with the rules established by the
82 division under Subsection (4); or
83 (b) the EDS user does not comply with the rules established by the division under
84 Subsection (4).
85 (6) (a) The division shall periodically audit the use of opioid prescription information
86 made available to an EDS user via the user's electronic data system.
87 (b) The audit shall review compliance by:
88 (i) the electronic data system with rules established by the division under Subsection
89 (4); and
90 (ii) the EDS user with rules established by the division under Subsection (4).
91 (c) (i) If the division determines by audit or other means that an electronic data system
92 is not in compliance with rules established by the division under Subsection (4), the division
93 shall immediately suspend or revoke the electronic data system's access to opioid prescription
94 information in the database.
95 (ii) If the division determines by audit or other means that an EDS user is not in
96 compliance with rules established by the division under Subsection (4), the division shall
97 immediately suspend or revoke the EDS user's access to opioid prescription information in the
98 database via an electronic data system.
99 (iii) If the division suspends or revokes access to opioid prescription information in the
100 database under Subsection (6)(c)(i) or (6)(c)(ii), the division shall also take any other
101 appropriate corrective or disciplinary action authorized by this chapter or title.
102 Section 2. Section 58-37f-601 is amended to read:
103 58-37f-601. Unlawful release or use of database information -- Criminal and civil
104 penalties.
105 (1) (a) Any person who knowingly and intentionally releases:
106 (i) any information in the database or any information obtained from other state or
107 federal prescription monitoring programs by means of the database in violation of the
108 limitations under Part 3, Access, is guilty of a third degree felony; or
109 (ii) any information in the database accessed under Section 58-37f-303 by an electronic
110 data system, or accessed by a person via an electronic data system, in violation of rules
111 established by the division under Subsection 58-37f-303(4) is guilty of a third degree felony.
112 (b) Any person who negligently or recklessly releases:
113 (i) any information in the database or any information obtained from other state or
114 federal prescription monitoring programs by means of the database in violation of the
115 limitations under [
116 (ii) any information in the database accessed under Section 58-37f-303 by an electronic
117 data system, or accessed by a person via an electronic data system, in violation of rules
118 established by the division under Subsection 58-37f-303(4) is guilty of a class C misdemeanor.
119 (2) (a) Any person who obtains or attempts to obtain the following by
120 misrepresentation or fraud is guilty of a third degree felony:
121 (i) information from the database [
122 (ii) information from any other state or federal prescription monitoring [
123 program by means of the database [
124
125 (iii) information from the database or any other state or federal prescription monitoring
126 program via an electronic data system under Section 58-37f-303.
127 (b) Any person who obtains or attempts to obtain information from the database,
128 including via an electronic data system under Section 58-37f-303 that has access to the
129 database, for a purpose other than a purpose authorized by this chapter or by rule is guilty of a
130 third degree felony.
131 (3) (a) Except as provided in Subsection (3)(e), a person may not knowingly and
132 intentionally use, release, publish, or otherwise make available to any other person [
133 following information for any purpose other than those specified in Part 3, Access:
134 (i) information obtained from the database [
135 (ii) information obtained from any other state or federal prescription monitoring
136 [
137
138 (iii) information in the database accessed under Section 58-37f-303 by:
139 (A) an electronic data system; or
140 (B) a person via an electronic data system.
141 (b) Each separate violation of this Subsection (3) is a third degree felony and is also
142 subject to a civil penalty not to exceed $5,000.
143 (c) The procedure for determining a civil violation of this Subsection (3) is in
144 accordance with Section 58-1-108, regarding adjudicative proceedings within the division.
145 (d) Civil penalties assessed under this Subsection (3) shall be deposited in the General
146 Fund as a dedicated credit to be used by the division under Subsection 58-37f-502(1).
147 (e) This Subsection (3) does not prohibit a person who obtains information from the
148 database under Subsection 58-37f-301(2)(f), (g), (i), or (4)(c) from:
149 (i) including the information in the person's medical chart or file for access by a person
150 authorized to review the medical chart or file; or
151 (ii) providing the information to a person in accordance with the requirements of the
152 Health Insurance Portability and Accountability Act of 1996.
Legislative Review Note
Office of Legislative Research and General Counsel