2
3
4
5
6
7
8 LONG TITLE
9 General Description:
10 This bill addresses retention of information by an agency.
11 Highlighted Provisions:
12 This bill:
13 ▸ grants rulemaking authority related to retention of personally identifiable
14 information;
15 ▸ requires a study on the retention of information;
16 ▸ prohibits the Division of Occupational and Professional Licensing from retaining
17 personally identifiable information in the database beyond a specified time period;
18 and
19 ▸ makes technical changes.
20 Money Appropriated in this Bill:
21 None
22 Other Special Clauses:
23 This bill provides a special effective date.
24 Utah Code Sections Affected:
25 AMENDS:
26 58-37f-203 (Effective 07/01/19), as last amended by Laws of Utah 2018, Third Special
27 Session, Chapter 1
28
29 Be it enacted by the Legislature of the state of Utah:
30 Section 1. Section 58-37f-203 (Effective 07/01/19) is amended to read:
31 58-37f-203 (Effective 07/01/19). Submission, collection, and maintenance of data.
32 (1) (a) The division shall implement on a statewide basis, including non-resident
33 pharmacies as defined in Section 58-17b-102, the following two options for a pharmacist to
34 submit information:
35 (i) real-time submission of the information required to be submitted under this part to
36 the controlled substance database; and
37 (ii) 24-hour daily or next business day, whichever is later, batch submission of the
38 information required to be submitted under this part to the controlled substance database.
39 (b) [
40 [
41 Subsection (1)(a)(i); or
42 [
43 Subsection (1)(a)(ii).
44 [
45
46 (c) The division shall comply with Title 63G, Chapter 6a, Utah Procurement Code.
47 (2) (a) The pharmacist-in-charge and the pharmacist of the drug outlet where a
48 controlled substance is dispensed shall submit the data described in this section to the division
49 in accordance with:
50 (i) the requirements of this section;
51 (ii) the procedures established by the division;
52 (iii) additional types of information or data fields established by the division; and
53 (iv) the format established by the division.
54 (b) A dispensing medical practitioner licensed under Chapter 17b, Part 8, Dispensing
55 Medical Practitioner and Dispensing Medical Practitioner Clinic Pharmacy, shall comply with
56 the provisions of this section and the dispensing medical practitioner shall assume the duties of
57 the pharmacist under this chapter.
58 (3) The pharmacist-in-charge and the pharmacist described in Subsection (2) shall, for
59 each controlled substance dispensed by a pharmacist under the pharmacist's supervision other
60 than those dispensed for an inpatient at a health care facility, submit to the division any type of
61 information or data field established by the division by rule in accordance with Subsection (6).
62 (4) An individual whose records are in the database may obtain those records upon
63 submission of a written request to the division.
64 (5) (a) A patient whose record is in the database may contact the division in writing to
65 request correction of any of the patient's database information that is incorrect. The patient
66 shall provide a postal address for the division's response.
67 (b) The division shall grant or deny the request within 30 days from receipt of the
68 request and shall advise the requesting patient of its decision by mail postmarked within 35
69 days of receipt of the request.
70 (c) If the division denies a request under this Subsection (5) or does not respond within
71 35 days, the patient may submit an appeal to the Department of Commerce, within 60 days
72 after the postmark date of the patient's letter making a request for a correction under this
73 Subsection (5).
74 (6) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
75 Administrative Rulemaking Act, to establish submission requirements under this part,
76 including:
77 (a) electronic format;
78 (b) submission procedures; and
79 (c) required information and data fields.
80 (7) The division shall ensure that the database system records and maintains for
81 reference:
82 (a) the identification of each individual who requests or receives information from the
83 database;
84 (b) the information provided to each individual; and
85 (c) the date and time that the information is requested or provided.
86 (8) (a) As used in this Subsection (8), "personally identifiable information" means
87 information that could:
88 (i) potentially identify a specific individual;
89 (ii) be used to distinguish one person from another; or
90 (iii) be used for dis-anonymizing anonymous data.
91 (b) Subject to Subsection (8)(d), the division may make rules, in accordance with Title
92 63G, Chapter 3, Utah Administrative Rulemaking Act, establishing a retention schedule for
93 personally identifiable information in the database.
94 (c) The division shall conduct a study of the appropriate retention schedule of records
95 in the database, both personally identifiable information and anonymized information, and
96 report the conclusions of the study to the Health and Human Services Interim Committee
97 before November 1, 2019.
98 (d) On and after July 1, 2020, the division may not retain personally identifiable
99 information in the database for more than 24 months from the day on which the controlled
100 substance is dispensed that gives rise to the personally identifiable information.
101 Section 2. Effective date.
102 This bill takes effect on July 1, 2019.