1     
CONTROLLED SUBSTANCE DATABASE AMENDMENTS

2     
2020 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Adam Robertson

5     
Senate Sponsor: ____________

6     

7     LONG TITLE
8     General Description:
9          This bill modifies provisions of the Controlled Substance Database Act.
10     Highlighted Provisions:
11          This bill:
12          ▸     modifies access to information from the controlled substance database for certain
13     law enforcement officers; and
14          ▸     makes technical changes.
15     Money Appropriated in this Bill:
16          None
17     Other Special Clauses:
18          None
19     Utah Code Sections Affected:
20     AMENDS:
21          58-37f-301, as last amended by Laws of Utah 2018, Chapter 123
22          58-37f-304, as last amended by Laws of Utah 2019, Chapter 128
23          58-37f-601, as last amended by Laws of Utah 2016, Chapters 112 and 238
24     

25     Be it enacted by the Legislature of the state of Utah:
26          Section 1. Section 58-37f-301 is amended to read:
27          58-37f-301. Access to database.
28          (1) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
29     Administrative Rulemaking Act, to:
30          (a) administer the provisions of this part;
31          [(a)] (b) effectively enforce the limitations on access to the database as described in
32     this part; and
33          [(b)] (c) establish standards and procedures to ensure accurate identification of
34     individuals requesting information or receiving information without request from the database.
35          (2) The division shall make information in the database and information obtained from
36     other state or federal prescription monitoring programs by means of the database available only
37     to the following individuals, in accordance with the requirements of this chapter and division
38     rules made in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act:
39          (a) [(i)] personnel of the division specifically assigned to conduct investigations related
40     to controlled substance laws under the jurisdiction of the division; [and]
41          [(ii) the following law enforcement officers, but the division may only provide
42     nonidentifying information, limited to gender, year of birth, and postal ZIP code, regarding
43     individuals for whom a controlled substance has been prescribed or to whom a controlled
44     substance has been dispensed:]
45          [(A) a law enforcement agency officer who is engaged in a joint investigation with the
46     division; and]
47          [(B) a law enforcement agency officer to whom the division has referred a suspected
48     criminal violation of controlled substance laws;]
49          (b) a federal, state, or local law enforcement officer who is engaged in a joint
50     investigation with the division;
51          (c) a federal, state, or local law enforcement officer to whom the division has referred a
52     suspected criminal violation of controlled substance laws;
53          (d) a federal, state, or local law enforcement officer if:
54          (i) the officer is appointed by the officer's law enforcement agency or department as a
55     designated officer assigned to investigate legally prescribed controlled substances cases;
56          (ii) the officer is registered with the division as a designated officer assigned to
57     investigate legally prescribed controlled substances cases;
58          (iii) the designated officer's law enforcement agency or department has entered into a
59     memorandum of understanding with the division that:
60          (A) is executed by the designated officer's chief, sheriff, or law enforcement chief
61     executive officer;
62          (B) notifies the law enforcement agency or department that the division may audit at
63     any time the designated officer's and the law enforcement agency's or department's use of
64     information from the database; and
65          (C) allows the division to immediately suspend access to the database by a designated
66     officer for any reason; and
67          (iv) the designated officer and the officer's agency or department meet the requirements
68     of any rules made by the division related to the requirements of this Subsection (2);
69          [(b)] (e) authorized division personnel engaged in analysis of controlled substance
70     prescription information as a part of the assigned duties and responsibilities of their
71     employment;
72          [(c)] (f) a board member if:
73          (i) the board member is assigned to monitor a licensee on probation; and
74          (ii) the board member is limited to obtaining information from the database regarding
75     the specific licensee on probation;
76          [(d)] (g) a member of a diversion committee established in accordance with Subsection
77     58-1-404(2) if:
78          (i) the diversion committee member is limited to obtaining information from the
79     database regarding the person whose conduct is the subject of the committee's consideration;
80     and
81          (ii) the conduct that is the subject of the committee's consideration includes a violation
82     or a potential violation of Chapter 37, Utah Controlled Substances Act, or another relevant
83     violation or potential violation under this title;
84          [(e)] (h) in accordance with a written agreement entered into with the department,
85     employees of the Department of Health:
86          (i) whom the director of the Department of Health assigns to conduct scientific studies
87     regarding the use or abuse of controlled substances, if the identity of the individuals and
88     pharmacies in the database are confidential and are not disclosed in any manner to any
89     individual who is not directly involved in the scientific studies;
90          (ii) when the information is requested by the Department of Health in relation to a
91     person or provider whom the Department of Health suspects may be improperly obtaining or
92     providing a controlled substance; or
93          (iii) in the medical examiner's office;
94          [(f)] (i) in accordance with a written agreement entered into with the department, a
95     designee of the director of the Department of Health, who is not an employee of the
96     Department of Health, whom the director of the Department of Health assigns to conduct
97     scientific studies regarding the use or abuse of controlled substances pursuant to an application
98     process established in rule by the Department of Health, if:
99          (i) the designee provides explicit information to the Department of Health regarding
100     the purpose of the scientific studies;
101          (ii) the scientific studies to be conducted by the designee:
102          (A) fit within the responsibilities of the Department of Health for health and welfare;
103          (B) are reviewed and approved by an Institutional Review Board that is approved for
104     human subject research by the United States Department of Health and Human Services; [and]
105          (C) are not conducted for profit or commercial gain; and
106          (D) are conducted in a research facility, as defined by division rule, that is associated
107     with a university or college accredited by one or more regional or national accrediting agencies
108     recognized by the United States Department of Education;
109          (iii) the designee protects the information as a business associate of the Department of
110     Health; and
111          (iv) the identity of the prescribers, patients, and pharmacies in the database are
112     de-identified, confidential, not disclosed in any manner to the designee or to any individual
113     who is not directly involved in the scientific studies;
114          [(g)] (j) in accordance with the written agreement entered into with the department and
115     the Department of Health, authorized employees of a managed care organization, as defined in
116     42 C.F.R. Sec. 438, if:
117          (i) the managed care organization contracts with the Department of Health under the
118     provisions of Section 26-18-405 and the contract includes provisions that:
119          (A) require a managed care organization employee who will have access to information
120     from the database to submit to a criminal background check; and
121          (B) limit the authorized employee of the managed care organization to requesting
122     either the division or the Department of Health to conduct a search of the database regarding a
123     specific Medicaid enrollee and to report the results of the search to the authorized employee;
124     and
125          (ii) the information is requested by an authorized employee of the managed care
126     organization in relation to a person who is enrolled in the Medicaid program with the managed
127     care organization, and the managed care organization suspects the person may be improperly
128     obtaining or providing a controlled substance;
129          [(h)] (k) a licensed practitioner having authority to prescribe controlled substances, to
130     the extent the information:
131          (i) (A) relates specifically to a current or prospective patient of the practitioner; and
132          (B) is provided to or sought by the practitioner for the purpose of:
133          (I) prescribing or considering prescribing any controlled substance to the current or
134     prospective patient;
135          (II) diagnosing the current or prospective patient;
136          (III) providing medical treatment or medical advice to the current or prospective
137     patient; or
138          (IV) determining whether the current or prospective patient:
139          (Aa) is attempting to fraudulently obtain a controlled substance from the practitioner;
140     or
141          (Bb) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
142     substance from the practitioner;
143          (ii) (A) relates specifically to a former patient of the practitioner; and
144          (B) is provided to or sought by the practitioner for the purpose of determining whether
145     the former patient has fraudulently obtained, or has attempted to fraudulently obtain, a
146     controlled substance from the practitioner;
147          (iii) relates specifically to an individual who has access to the practitioner's Drug
148     Enforcement Administration identification number, and the practitioner suspects that the
149     individual may have used the practitioner's Drug Enforcement Administration identification
150     number to fraudulently acquire or prescribe a controlled substance;
151          (iv) relates to the practitioner's own prescribing practices, except when specifically
152     prohibited by the division by administrative rule;
153          (v) relates to the use of the controlled substance database by an employee of the
154     practitioner, described in Subsection (2)(i); or
155          (vi) relates to any use of the practitioner's Drug Enforcement Administration
156     identification number to obtain, attempt to obtain, prescribe, or attempt to prescribe, a
157     controlled substance;
158          [(i)] (l) in accordance with Subsection (3)(a), an employee of a practitioner described
159     in Subsection (2)[(h)](k), for a purpose described in Subsection (2)[(h)](k)(i) or (ii), if:
160          (i) the employee is designated by the practitioner as an individual authorized to access
161     the information on behalf of the practitioner;
162          (ii) the practitioner provides written notice to the division of the identity of the
163     employee; and
164          (iii) the division:
165          (A) grants the employee access to the database; and
166          (B) provides the employee with a password that is unique to that employee to access
167     the database in order to permit the division to comply with the requirements of Subsection
168     58-37f-203(5) with respect to the employee;
169          [(j)] (m) an employee of the same business that employs a licensed practitioner under
170     Subsection (2)[(h)](k) if:
171          (i) the employee is designated by the practitioner as an individual authorized to access
172     the information on behalf of the practitioner;
173          (ii) the practitioner and the employing business provide written notice to the division of
174     the identity of the designated employee; and
175          (iii) the division:
176          (A) grants the employee access to the database; and
177          (B) provides the employee with a password that is unique to that employee to access
178     the database in order to permit the division to comply with the requirements of Subsection
179     58-37f-203(5) with respect to the employee;
180          [(k)] (n) a licensed pharmacist having authority to dispense a controlled substance to
181     the extent the information is provided or sought for the purpose of:
182          (i) dispensing or considering dispensing any controlled substance; or
183          (ii) determining whether a person:
184          (A) is attempting to fraudulently obtain a controlled substance from the pharmacist; or
185          (B) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
186     substance from the pharmacist;
187          [(l)] (o) in accordance with Subsection (3)(a), a licensed pharmacy technician and
188     pharmacy intern who is an employee of a pharmacy as defined in Section 58-17b-102, for the
189     purposes described in Subsection (2)[(j)](m)(i) or (ii), if:
190          (i) the employee is designated by the pharmacist-in-charge as an individual authorized
191     to access the information on behalf of a licensed pharmacist employed by the pharmacy;
192          (ii) the pharmacist-in-charge provides written notice to the division of the identity of
193     the employee; and
194          (iii) the division:
195          (A) grants the employee access to the database; and
196          (B) provides the employee with a password that is unique to that employee to access
197     the database in order to permit the division to comply with the requirements of Subsection
198     58-37f-203(5) with respect to the employee;
199          [(m)] (p) pursuant to a valid search warrant, federal, state, and local law enforcement
200     officers and state and local prosecutors who are engaged in an investigation related to:
201          (i) one or more controlled substances; and
202          (ii) a specific person who is a subject of the investigation;
203          [(n)] (q) subject to Subsection (7), a probation or parole officer, employed by the
204     Department of Corrections or by a political subdivision, to gain access to database information
205     necessary for the officer's supervision of a specific probationer or parolee who is under the
206     officer's direct supervision;
207          [(o)] (r) employees of the Office of Internal Audit and Program Integrity within the
208     Department of Health who are engaged in their specified duty of ensuring Medicaid program
209     integrity under Section 26-18-2.3;
210          [(p)] (s) a mental health therapist, if:
211          (i) the information relates to a patient who is:
212          (A) enrolled in a licensed substance abuse treatment program; and
213          (B) receiving treatment from, or under the direction of, the mental health therapist as
214     part of the patient's participation in the licensed substance abuse treatment program described
215     in Subsection (2)[(p)](s)(i)(A);
216          (ii) the information is sought for the purpose of determining whether the patient is
217     using a controlled substance while the patient is enrolled in the licensed substance abuse
218     treatment program described in Subsection (2)[(p)](s)(i)(A); and
219          (iii) the licensed substance abuse treatment program described in Subsection
220     (2)[(p)](s)(i)(A) is associated with a practitioner who:
221          (A) is a physician, a physician assistant, an advance practice registered nurse, or a
222     pharmacist; and
223          (B) is available to consult with the mental health therapist regarding the information
224     obtained by the mental health therapist, under this Subsection (2)[(p)](s), from the database;
225          [(q)] (t) an individual who is the recipient of a controlled substance prescription
226     entered into the database, upon providing evidence satisfactory to the division that the
227     individual requesting the information is in fact the individual about whom the data entry was
228     made;
229          [(r)] (u) an individual under Subsection (2)[(q)](t) for the purpose of obtaining a list of
230     the persons and entities that have requested or received any information from the database
231     regarding the individual, except if the individual's record is subject to a pending or current
232     investigation as authorized under this Subsection (2);
233          [(s)] (v) the inspector general, or a designee of the inspector general, of the Office of
234     Inspector General of Medicaid Services, for the purpose of fulfilling the duties described in
235     Title 63A, Chapter 13, Part 2, Office and Powers;
236          [(t)] (w) the following licensed physicians for the purpose of reviewing and offering an
237     opinion on an individual's request for workers' compensation benefits under Title 34A, Chapter
238     2, Workers' Compensation Act, or Title 34A, Chapter 3, Utah Occupational Disease Act:
239          (i) a member of the medical panel described in Section 34A-2-601;
240          (ii) a physician employed as medical director for a licensed workers' compensation
241     insurer or an approved self-insured employer; or
242          (iii) a physician offering a second opinion regarding treatment; and
243          [(u)] (x) members of Utah's Opioid Fatality Review Committee, for the purpose of
244     reviewing a specific fatality due to opioid use and recommending policies to reduce the
245     frequency of opioid use fatalities.
246          (3) (a) (i) A practitioner described in Subsection (2)[(h)](k) may designate one or more
247     employees to access information from the database under Subsection (2)[(i)](l), (2)[(j)](m), or
248     (4)(c).
249          (ii) A pharmacist described in Subsection (2)[(k)](n) who is a pharmacist-in-charge
250     may designate up to five employees to access information from the database under Subsection
251     (2)[(l)](o).
252          (b) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
253     Administrative Rulemaking Act, to:
254          (i) establish background check procedures to determine whether an employee
255     designated under Subsection (2)[(i)](l), (2)[(j)](m), or (4)(c) should be granted access to the
256     database; and
257          (ii) establish the information to be provided by an emergency department employee
258     under Subsection (4); and
259          (iii) facilitate providing controlled substance prescription information to a third party
260     under Subsection (5).
261          (c) The division shall grant an employee designated under Subsection (2)[(i)](l),
262     (2)[(j)](m), or (4)(c) access to the database, unless the division determines, based on a
263     background check, that the employee poses a security risk to the information contained in the
264     database.
265          (4) (a) An individual who is employed in the emergency department of a hospital may
266     exercise access to the database under this Subsection (4) on behalf of a licensed practitioner if
267     the individual is designated under Subsection (4)(c) and the licensed practitioner:
268          (i) is employed in the emergency department;
269          (ii) is treating an emergency department patient for an emergency medical condition;
270     and
271          (iii) requests that an individual employed in the emergency department and designated
272     under Subsection (4)(c) obtain information regarding the patient from the database as needed in
273     the course of treatment.
274          (b) The emergency department employee obtaining information from the database
275     shall, when gaining access to the database, provide to the database the name and any additional
276     identifiers regarding the requesting practitioner as required by division administrative rule
277     established under Subsection (3)(b).
278          (c) An individual employed in the emergency department under this Subsection (4)
279     may obtain information from the database as provided in Subsection (4)(a) if:
280          (i) the employee is designated by the practitioner as an individual authorized to access
281     the information on behalf of the practitioner;
282          (ii) the practitioner and the hospital operating the emergency department provide
283     written notice to the division of the identity of the designated employee; and
284          (iii) the division:
285          (A) grants the employee access to the database; and
286          (B) provides the employee with a password that is unique to that employee to access
287     the database in order to permit the division to comply with the requirements of Subsection
288     58-37f-203(5) with respect to the employee.
289          (d) The division may impose a fee, in accordance with Section 63J-1-504, on a
290     practitioner who designates an employee under Subsection (2)[(i)](l), (2)[(j)](m), or (4)(c) to
291     pay for the costs incurred by the division to conduct the background check and make the
292     determination described in Subsection (3)(b).
293          (5) (a) (i) An individual may request that the division provide the information under
294     Subsection (5)(b) to a third party who is designated by the individual each time a controlled
295     substance prescription for the individual is dispensed.
296          (ii) The division shall upon receipt of the request under this Subsection (5)(a) advise
297     the individual in writing that the individual may direct the division to discontinue providing the
298     information to a third party and that notice of the individual's direction to discontinue will be
299     provided to the third party.
300          (b) The information the division shall provide under Subsection (5)(a) is:
301          (i) the fact a controlled substance has been dispensed to the individual, but without
302     identifying the controlled substance; and
303          (ii) the date the controlled substance was dispensed.
304          (c) (i) An individual who has made a request under Subsection (5)(a) may direct that
305     the division discontinue providing information to the third party.
306          (ii) The division shall:
307          (A) notify the third party that the individual has directed the division to no longer
308     provide information to the third party; and
309          (B) discontinue providing information to the third party.
310          (6) (a) An individual who is granted access to the database based on the fact that the
311     individual is a licensed practitioner or a mental health therapist shall be denied access to the
312     database when the individual is no longer licensed.
313          (b) An individual who is granted access to the database based on the fact that the
314     individual is a designated employee of a licensed practitioner shall be denied access to the
315     database when the practitioner is no longer licensed.
316          (7) A probation or parole officer is not required to obtain a search warrant to access the
317     database in accordance with Subsection (2)[(n)](q).
318          (8) The division shall review and adjust the database programming which
319     automatically logs off an individual who is granted access to the database under Subsections
320     (2)[(h)](k), (2)[(i)](l), (2)[(j)](m), and (4)(c) to maximize the following objectives:
321          (a) to protect patient privacy;
322          (b) to reduce inappropriate access; and
323          (c) to make the database more useful and helpful to a person accessing the database
324     under Subsections (2)[(h)](k), (2)[(i)](l), (2)[(j)](m), and (4)(c), especially in high usage
325     locations such as an emergency department.
326          Section 2. Section 58-37f-304 is amended to read:
327          58-37f-304. Database utilization.
328          (1) As used in this section:
329          (a) "Dispenser" means a licensed pharmacist, as described in Section 58-17b-303, or
330     the pharmacist's licensed intern, as described in Section 58-17b-304, who is also licensed to
331     dispense a controlled substance under Title 58, Chapter 37, Utah Controlled Substances Act.
332          (b) "Outpatient" means a setting in which an individual visits a licensed healthcare
333     facility or a healthcare provider's office for a diagnosis or treatment but is not admitted to a
334     licensed healthcare facility for an overnight stay.
335          (c) "Prescriber" means an individual authorized to prescribe a controlled substance
336     under Title 58, Chapter 37, Utah Controlled Substances Act.
337          (d) "Schedule II opioid" means those substances listed in Subsection 58-37-4(2)(b)(i)
338     or (2)(b)(ii).
339          (e) "Schedule III opioid" means those substances listed in Subsection 58-37-4(2)(c)
340     that are opioids.
341          (2) (a) A prescriber shall check the database for information about a patient before the
342     first time the prescriber gives a prescription to a patient for a Schedule II opioid or a Schedule
343     III opioid.
344          (b) If a prescriber is repeatedly prescribing a Schedule II opioid or Schedule III opioid
345     to a patient, the prescriber shall periodically review information about the patient in:
346          (i) the database; or
347          (ii) other similar records of controlled substances the patient has filled.
348          (c) A prescriber may assign the access and review required under Subsection (2)(a) to
349     one or more employees in accordance with Subsections [58-37f-301(2)(i) and (j)]
350     58-37f-301(2)(l) and (m).
351          (d) (i) A prescriber may comply with the requirements in Subsections (2)(a) and (b) by
352     checking an electronic health record system if the electronic health record system:
353          (A) is connected to the database through a connection that has been approved by the
354     division; and
355          (B) displays the information from the database in a prominent manner for the
356     prescriber.
357          (ii) The division may not approve a connection to the database if the connection does
358     not satisfy the requirements established by the division under Section 58-37f-301.
359          (e) A prescriber is not in violation of the requirements of Subsection (2)(a) or (b) if the
360     failure to comply with Subsection (2)(a) or (b):
361          (i) is necessary due to an emergency situation;
362          (ii) is caused by a suspension or disruption in the operation of the database; or
363          (iii) is caused by a failure in the operation or availability of the Internet.
364          (f) The division may not take action against the license of a prescriber for failure to
365     comply with this Subsection (2) unless the failure occurs after the earlier of:
366          (i) December 31, 2018; or
367          (ii) the date that the division has the capability to establish a connection that meets the
368     requirements established by the division under Section 58-37f-301 between the database and an
369     electronic health record system.
370          (3) The division shall, in collaboration with the licensing boards for prescribers and
371     dispensers:
372          (a) develop a system that gathers and reports to prescribers and dispensers the progress
373     and results of the prescriber's and dispenser's individual access and review of the database, as
374     provided in this section; and
375          (b) reduce or waive the division's continuing education requirements regarding opioid
376     prescriptions, described in Section 58-37-6.5, including the online tutorial and test relating to
377     the database, for prescribers and dispensers whose individual utilization of the database, as
378     determined by the division, demonstrates substantial compliance with this section.
379          (4) If the dispenser's access and review of the database suggest that the individual
380     seeking an opioid may be obtaining opioids in quantities or frequencies inconsistent with
381     generally recognized standards as provided in this section and Section 58-37f-201, the
382     dispenser shall reasonably attempt to contact the prescriber to obtain the prescriber's informed,
383     current, and professional decision regarding whether the prescribed opioid is medically
384     justified, notwithstanding the results of the database search.
385          (5) (a) The division shall review the database to identify any prescriber who has a
386     pattern of prescribing opioids not in accordance with the recommendations of:
387          (i) the CDC Guideline for Prescribing Opioids for Chronic Pain, published by the
388     Centers for Disease Control and Prevention;
389          (ii) the Utah Clinical Guidelines on Prescribing Opioids for Treatment of Pain,
390     published by the Department of Health; or
391          (iii) other publications describing best practices related to prescribing opioids as
392     identified by division rule in accordance with Title 63G, Chapter 3, Utah Administrative
393     Rulemaking Act, and in consultation with the Physicians Licensing Board.
394          (b) The division shall offer education to a prescriber identified under this Subsection
395     (5) regarding best practices in the prescribing of opioids.
396          (c) A decision by a prescriber to accept or not accept the education offered by the
397     division under this Subsection (5) is voluntary.
398          (d) The division may not use an identification the division has made under this
399     Subsection (5) or the decision by a prescriber to accept or not accept education offered by the
400     division under this Subsection (5) in a licensing investigation or action by the division.
401          (e) Any record created by the division as a result of this Subsection (5) is a protected
402     record under Section 63G-2-305.
403          (6) The division may consult with a prescriber or health care system to assist the
404     prescriber or health care system in following evidence-based guidelines regarding the
405     prescribing of controlled substances, including the recommendations listed in Subsection
406     (5)(a).
407          Section 3. Section 58-37f-601 is amended to read:
408          58-37f-601. Unlawful release or use of database information -- Criminal and civil
409     penalties.
410          (1) (a) Any person who knowingly and intentionally releases:
411          (i) any information in the database or any information obtained from other state or
412     federal prescription monitoring programs by means of the database in violation of the
413     limitations under Part 3, Access and Utilization, is guilty of a third degree felony; or
414          (ii) any information in the database accessed under Section 58-37f-303 by an electronic
415     data system, or accessed by a person via an electronic data system, in violation of rules
416     established by the division under Subsection 58-37f-303(4) is guilty of a third degree felony.
417          (b) Any person who negligently or recklessly releases:
418          (i) any information in the database or any information obtained from other state or
419     federal prescription monitoring programs by means of the database in violation of the
420     limitations under Part 3, Access and Utilization, is guilty of a class C misdemeanor; or
421          (ii) any information in the database accessed under Section 58-37f-303 by an electronic
422     data system, or accessed by a person via an electronic data system, in violation of rules
423     established by the division under Subsection 58-37f-303(4) is guilty of a class C misdemeanor.
424          (2) (a) Any person who obtains or attempts to obtain the following by
425     misrepresentation or fraud is guilty of a third degree felony:
426          (i) information from the database;
427          (ii) information from any other state or federal prescription monitoring program by
428     means of the database; or
429          (iii) information from the database or any other state or federal prescription monitoring
430     program via an electronic data system under Section 58-37f-303.
431          (b) Any person who obtains or attempts to obtain information from the database,
432     including via an electronic data system under Section 58-37f-303 that has access to the
433     database, for a purpose other than a purpose authorized by this chapter or by rule is guilty of a
434     third degree felony.
435          (3) (a) Except as provided in Subsection (3)(e), a person may not knowingly and
436     intentionally use, release, publish, or otherwise make available to any other person the
437     following information for any purpose other than those specified in Part 3, Access and
438     Utilization:
439          (i) information obtained from the database;
440          (ii) information obtained from any other state or federal prescription monitoring
441     program by means of the database; or
442          (iii) information in the database accessed under Section 58-37f-303 by:
443          (A) an electronic data system; or
444          (B) a person via an electronic data system.
445          (b) Each separate violation of this Subsection (3) is a third degree felony and is also
446     subject to a civil penalty not to exceed $5,000.
447          (c) The procedure for determining a civil violation of this Subsection (3) is in
448     accordance with Section 58-1-108, regarding adjudicative proceedings within the division.
449          (d) Civil penalties assessed under this Subsection (3) shall be deposited in the General
450     Fund as a dedicated credit to be used by the division under Subsection 58-37f-502(1).
451          (e) This Subsection (3) does not prohibit a person who obtains information from the
452     database under Subsection 58-37f-301(2)[(h), (i),] (k), (l), (n) or (4)(c) from:
453          (i) including the information in the person's medical chart or file for access by a person
454     authorized to review the medical chart or file; or
455          (ii) providing the information to a person in accordance with the requirements of the
456     Health Insurance Portability and Accountability Act of 1996.