Representative Raymond P. Ward proposes the following substitute bill:


1     
HEALTH DATA AUTHORITY AMENDMENTS

2     
2020 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Raymond P. Ward

5     
Senate Sponsor: Evan J. Vickers

6     

7     LONG TITLE
8     General Description:
9          This bill amends provisions relating to the disclosure of identifiable health data
10     collected by the Department of Health.
11     Highlighted Provisions:
12          This bill:
13          ▸     allows the Health Data Committee to disclose identifiable health data to the
14     Department of Health or a public health authority under certain circumstances; and
15          ▸     makes technical changes.
16     Money Appropriated in this Bill:
17          None
18     Other Special Clauses:
19          None
20     Utah Code Sections Affected:
21     AMENDS:
22          26-33a-109, as last amended by Laws of Utah 2016, Chapter 74
23     

24     Be it enacted by the Legislature of the state of Utah:
25          Section 1. Section 26-33a-109 is amended to read:
26          26-33a-109. Exceptions to prohibition on disclosure of identifiable health data.
27          (1) The committee may not disclose any identifiable health data unless:
28          (a) the individual has authorized the disclosure; [or]
29          (b) the disclosure is to the department or a public health authority in accordance with
30     Subsection (2); or
31          [(b)] (c) the disclosure complies with the provisions of:
32          (i) [this section] Subsection (3);
33          (ii) insurance enrollment and coordination of benefits under Subsection
34     26-33a-106.1(1)(d); or
35          (iii) risk adjusting under Subsection 26-33a-106.1(1)(b).
36          (2) (a) The committee may only disclose identifiable health data to the department or a
37     public health authority under Subsection (1)(b) if:
38          (i) the department of the public health authority has clear statutory authority to possess
39     the identifiable health data; and
40          (ii) the disclosure is solely for use in:
41          (A) the Utah Statewide Immunization Information System operated by the department;
42     or
43          (B) the Utah Cancer Registry operated by the University of Utah, in collaboration with
44     the department.
45          [(2)] (3) (a) The committee shall consider the following when responding to a request
46     for disclosure of information that may include identifiable health data:
47          [(a)] (i) whether the request comes from a person after that person has received
48     approval to do the specific research and statistical work from an institutional review board; and
49          [(b)] (ii) whether the requesting entity complies with the provisions of Subsection [(3)]
50     (4).
51          (b) Identifiable health data may not be disclosed if the identifiable health data is
52     confidential under 42 C.F.R. Part 2, Confidentiality of Substance Use Disorder Patient
53     Records.
54          [(3)] (4) A request for disclosure of information that may include identifiable health
55     data shall:
56          (a) be for a specified period; or
57          (b) be solely for bona fide research and statistical purposes as determined in
58     accordance with administrative rules adopted by the department in accordance with Title 63G,
59     Chapter 3, Utah Administrative Rulemaking Act , which shall require:
60          (i) the requesting entity to demonstrate to the department that the data is required for
61     the research and statistical purposes proposed by the requesting entity; and
62          (ii) the requesting entity to enter into a written agreement satisfactory to the department
63     to protect the data in accordance with this chapter or other applicable law.
64          [(4)] (5) A person accessing identifiable health data pursuant to Subsection [(3)] (4)
65     may not further disclose the identifiable health data:
66          (a) without prior approval of the department; and
67          (b) unless the identifiable health data is disclosed or identified by control number only.