2
3
4
5
6
7
8 LONG TITLE
9 General Description:
10 This bill amends the Controlled Substance Database Act.
11 Highlighted Provisions:
12 This bill:
13 ▸ authorizes the Division of Occupational and Professional Licensing to provide
14 information to a managed care organization under certain circumstances;
15 ▸ creates an exception to certain restrictions on access to the controlled substance
16 database; and
17 ▸ makes technical changes.
18 Money Appropriated in this Bill:
19 None
20 Other Special Clauses:
21 None
22 Utah Code Sections Affected:
23 AMENDS:
24 58-37f-301, as last amended by Laws of Utah 2020, Chapters 107, 147, and 339
25 58-37f-302, as last amended by Laws of Utah 2020, Chapter 339
26
27 Be it enacted by the Legislature of the state of Utah:
28 Section 1. Section 58-37f-301 is amended to read:
29 58-37f-301. Access to database.
30 (1) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
31 Administrative Rulemaking Act, to:
32 (a) effectively enforce the limitations on access to the database as described in this
33 part; and
34 (b) establish standards and procedures to ensure accurate identification of individuals
35 requesting information or receiving information without request from the database.
36 (2) The division shall make information in the database and information obtained from
37 other state or federal prescription monitoring programs by means of the database available only
38 to the following individuals, in accordance with the requirements of this chapter and division
39 rules:
40 (a) (i) personnel of the division specifically assigned to conduct investigations related
41 to controlled substance laws under the jurisdiction of the division; and
42 (ii) the following law enforcement officers, but the division may only provide
43 nonidentifying information, limited to gender, year of birth, and postal ZIP code, regarding
44 individuals for whom a controlled substance has been prescribed or to whom a controlled
45 substance has been dispensed:
46 (A) a law enforcement agency officer who is engaged in a joint investigation with the
47 division; and
48 (B) a law enforcement agency officer to whom the division has referred a suspected
49 criminal violation of controlled substance laws;
50 (b) authorized division personnel engaged in analysis of controlled substance
51 prescription information as a part of the assigned duties and responsibilities of their
52 employment;
53 (c) a board member if:
54 (i) the board member is assigned to monitor a licensee on probation; and
55 (ii) the board member is limited to obtaining information from the database regarding
56 the specific licensee on probation;
57 (d) a person the division authorizes to obtain that information on behalf of the Utah
58 Professionals Health Program established in Subsection 58-4a-103(1) if:
59 (i) the person the division authorizes is limited to obtaining information from the
60 database regarding the person whose conduct is the subject of the division's consideration; and
61 (ii) the conduct that is the subject of the division's consideration includes a violation or
62 a potential violation of Chapter 37, Utah Controlled Substances Act, or another relevant
63 violation or potential violation under this title;
64 (e) in accordance with a written agreement entered into with the department,
65 employees of the Department of Health:
66 (i) whom the director of the Department of Health assigns to conduct scientific studies
67 regarding the use or abuse of controlled substances, if the identity of the individuals and
68 pharmacies in the database are confidential and are not disclosed in any manner to any
69 individual who is not directly involved in the scientific studies;
70 (ii) when the information is requested by the Department of Health in relation to a
71 person or provider whom the Department of Health suspects may be improperly obtaining or
72 providing a controlled substance; or
73 (iii) in the medical examiner's office;
74 (f) in accordance with a written agreement entered into with the department, a designee
75 of the director of the Department of Health, who is not an employee of the Department of
76 Health, whom the director of the Department of Health assigns to conduct scientific studies
77 regarding the use or abuse of controlled substances pursuant to an application process
78 established in rule by the Department of Health, if:
79 (i) the designee provides explicit information to the Department of Health regarding
80 the purpose of the scientific studies;
81 (ii) the scientific studies to be conducted by the designee:
82 (A) fit within the responsibilities of the Department of Health for health and welfare;
83 (B) are reviewed and approved by an Institutional Review Board that is approved for
84 human subject research by the United States Department of Health and Human Services;
85 (C) are not conducted for profit or commercial gain; and
86 (D) are conducted in a research facility, as defined by division rule, that is associated
87 with a university or college accredited by one or more regional or national accrediting agencies
88 recognized by the United States Department of Education;
89 (iii) the designee protects the information as a business associate of the Department of
90 Health; and
91 (iv) the identity of the prescribers, patients, and pharmacies in the database are
92 de-identified, confidential, and not disclosed in any manner to the designee or to any individual
93 who is not directly involved in the scientific studies;
94 (g) in accordance with [
95 the Department of Health, authorized employees of a managed care organization, as defined in
96 42 C.F.R. Sec. 438, if:
97 (i) the managed care organization contracts with the Department of Health under the
98 provisions of Section 26-18-405 and the contract includes provisions that:
99 (A) require a managed care organization employee who will have access to information
100 from the database to submit to a criminal background check; and
101 (B) limit the authorized employee of the managed care organization to requesting
102 either the division or the Department of Health to conduct a search of the database regarding a
103 specific Medicaid enrollee and to report the results of the search to the authorized employee;
104 and
105 (ii) the information is requested by an authorized employee of the managed care
106 organization in relation to a person who is enrolled in the Medicaid program with the managed
107 care organization, and the managed care organization suspects the person may be improperly
108 obtaining or providing a controlled substance;
109 (h) a licensed practitioner having authority to prescribe controlled substances, to the
110 extent the information:
111 (i) (A) relates specifically to a current or prospective patient of the practitioner; and
112 (B) is provided to or sought by the practitioner for the purpose of:
113 (I) prescribing or considering prescribing any controlled substance to the current or
114 prospective patient;
115 (II) diagnosing the current or prospective patient;
116 (III) providing medical treatment or medical advice to the current or prospective
117 patient; or
118 (IV) determining whether the current or prospective patient:
119 (Aa) is attempting to fraudulently obtain a controlled substance from the practitioner;
120 or
121 (Bb) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
122 substance from the practitioner;
123 (ii) (A) relates specifically to a former patient of the practitioner; and
124 (B) is provided to or sought by the practitioner for the purpose of determining whether
125 the former patient has fraudulently obtained, or has attempted to fraudulently obtain, a
126 controlled substance from the practitioner;
127 (iii) relates specifically to an individual who has access to the practitioner's Drug
128 Enforcement Administration identification number, and the practitioner suspects that the
129 individual may have used the practitioner's Drug Enforcement Administration identification
130 number to fraudulently acquire or prescribe a controlled substance;
131 (iv) relates to the practitioner's own prescribing practices, except when specifically
132 prohibited by the division by administrative rule;
133 (v) relates to the use of the controlled substance database by an employee of the
134 practitioner, described in Subsection (2)(i); or
135 (vi) relates to any use of the practitioner's Drug Enforcement Administration
136 identification number to obtain, attempt to obtain, prescribe, or attempt to prescribe, a
137 controlled substance;
138 (i) in accordance with Subsection (3)(a), an employee of a practitioner described in
139 Subsection (2)(h), for a purpose described in Subsection (2)(h)(i) or (ii), if:
140 (i) the employee is designated by the practitioner as an individual authorized to access
141 the information on behalf of the practitioner;
142 (ii) the practitioner provides written notice to the division of the identity of the
143 employee; and
144 (iii) the division:
145 (A) grants the employee access to the database; and
146 (B) provides the employee with a password that is unique to that employee to access
147 the database in order to permit the division to comply with the requirements of Subsection
148 58-37f-203[
149 (j) an employee of the same business that employs a licensed practitioner under
150 Subsection (2)(h) if:
151 (i) the employee is designated by the practitioner as an individual authorized to access
152 the information on behalf of the practitioner;
153 (ii) the practitioner and the employing business provide written notice to the division of
154 the identity of the designated employee; and
155 (iii) the division:
156 (A) grants the employee access to the database; and
157 (B) provides the employee with a password that is unique to that employee to access
158 the database in order to permit the division to comply with the requirements of Subsection
159 58-37f-203[
160 (k) a licensed pharmacist having authority to dispense a controlled substance, or a
161 licensed pharmacy intern or pharmacy technician working under the general supervision of a
162 licensed pharmacist, to the extent the information is provided or sought for the purpose of:
163 (i) dispensing or considering dispensing any controlled substance;
164 (ii) determining whether a person:
165 (A) is attempting to fraudulently obtain a controlled substance from the pharmacy,
166 practitioner, or health care facility; or
167 (B) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
168 substance from the pharmacy, practitioner, or health care facility;
169 (iii) reporting to the controlled substance database; or
170 (iv) verifying the accuracy of the data submitted to the controlled substance database
171 on behalf of a pharmacy where the licensed pharmacist, pharmacy intern, or pharmacy
172 technician is employed;
173 (l) pursuant to a valid search warrant, federal, state, and local law enforcement officers
174 and state and local prosecutors who are engaged in an investigation related to:
175 (i) one or more controlled substances; and
176 (ii) a specific person who is a subject of the investigation;
177 (m) subject to Subsection (7), a probation or parole officer, employed by the
178 Department of Corrections or by a political subdivision, to gain access to database information
179 necessary for the officer's supervision of a specific probationer or parolee who is under the
180 officer's direct supervision;
181 (n) employees of the Office of Internal Audit and Program Integrity within the
182 Department of Health who are engaged in their specified duty of ensuring Medicaid program
183 integrity under Section 26-18-2.3;
184 (o) a mental health therapist, if:
185 (i) the information relates to a patient who is:
186 (A) enrolled in a licensed substance abuse treatment program; and
187 (B) receiving treatment from, or under the direction of, the mental health therapist as
188 part of the patient's participation in the licensed substance abuse treatment program described
189 in Subsection (2)(o)(i)(A);
190 (ii) the information is sought for the purpose of determining whether the patient is
191 using a controlled substance while the patient is enrolled in the licensed substance abuse
192 treatment program described in Subsection (2)(o)(i)(A); and
193 (iii) the licensed substance abuse treatment program described in Subsection
194 (2)(o)(i)(A) is associated with a practitioner who:
195 (A) is a physician, a physician assistant, an advance practice registered nurse, or a
196 pharmacist; and
197 (B) is available to consult with the mental health therapist regarding the information
198 obtained by the mental health therapist, under this Subsection (2)(o), from the database;
199 (p) an individual who is the recipient of a controlled substance prescription entered into
200 the database, upon providing evidence satisfactory to the division that the individual requesting
201 the information is in fact the individual about whom the data entry was made;
202 (q) an individual under Subsection (2)(p) for the purpose of obtaining a list of the
203 persons and entities that have requested or received any information from the database
204 regarding the individual, except if the individual's record is subject to a pending or current
205 investigation as authorized under this Subsection (2);
206 (r) the inspector general, or a designee of the inspector general, of the Office of
207 Inspector General of Medicaid Services, for the purpose of fulfilling the duties described in
208 Title 63A, Chapter 13, Part 2, Office and Powers;
209 (s) the following licensed physicians for the purpose of reviewing and offering an
210 opinion on an individual's request for workers' compensation benefits under Title 34A, Chapter
211 2, Workers' Compensation Act, or Title 34A, Chapter 3, Utah Occupational Disease Act:
212 (i) a member of the medical panel described in Section 34A-2-601;
213 (ii) a physician employed as medical director for a licensed workers' compensation
214 insurer or an approved self-insured employer; or
215 (iii) a physician offering a second opinion regarding treatment; [
216 (t) members of Utah's Opioid Fatality Review Committee, for the purpose of reviewing
217 a specific fatality due to opioid use and recommending policies to reduce the frequency of
218 opioid use fatalities[
219 (u) a licensed pharmacist who is authorized by a managed care organization as defined
220 in Section 31A-1-301 to access the information on behalf of the managed care organization, if:
221 (i) the managed care organization believes that an enrollee of the managed care
222 organization has obtained or provided a controlled substance in violation of a medication
223 management program contract between the enrollee and the managed care organization; and
224 (ii) the managed care organization included a description of the medication
225 management program in the enrollee's outline of coverage described in Subsection
226 31A-22-605(7).
227 (3) (a) A practitioner described in Subsection (2)(h) may designate one or more
228 employees to access information from the database under Subsection (2)(i), (2)(j), or (4)(c).
229 (b) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
230 Administrative Rulemaking Act, to:
231 (i) establish background check procedures to determine whether an employee
232 designated under Subsection (2)(i), (2)(j), or (4)(c) should be granted access to the database;
233 (ii) establish the information to be provided by an emergency department employee
234 under Subsection (4); and
235 (iii) facilitate providing controlled substance prescription information to a third party
236 under Subsection (5).
237 (c) The division shall grant an employee designated under Subsection (2)(i), (2)(j), or
238 (4)(c) access to the database, unless the division determines, based on a background check, that
239 the employee poses a security risk to the information contained in the database.
240 (4) (a) An individual who is employed in the emergency department of a hospital may
241 exercise access to the database under this Subsection (4) on behalf of a licensed practitioner if
242 the individual is designated under Subsection (4)(c) and the licensed practitioner:
243 (i) is employed or privileged to work in the emergency department;
244 (ii) is treating an emergency department patient for an emergency medical condition;
245 and
246 (iii) requests that an individual employed in the emergency department and designated
247 under Subsection (4)(c) obtain information regarding the patient from the database as needed in
248 the course of treatment.
249 (b) The emergency department employee obtaining information from the database
250 shall, when gaining access to the database, provide to the database the name and any additional
251 identifiers regarding the requesting practitioner as required by division administrative rule
252 established under Subsection (3)(b).
253 (c) An individual employed in the emergency department under this Subsection (4)
254 may obtain information from the database as provided in Subsection (4)(a) if:
255 (i) the employee is designated by the hospital as an individual authorized to access the
256 information on behalf of the emergency department practitioner;
257 (ii) the hospital operating the emergency department provide written notice to the
258 division of the identity of the designated employee; and
259 (iii) the division:
260 (A) grants the employee access to the database; and
261 (B) provides the employee with a password that is unique to that employee to access
262 the database.
263 (d) The division may impose a fee, in accordance with Section 63J-1-504, on a
264 practitioner who designates an employee under Subsection (2)(i), (2)(j), or (4)(c) to pay for the
265 costs incurred by the division to conduct the background check and make the determination
266 described in Subsection (3)(b).
267 (5) (a) (i) An individual may request that the division provide the information under
268 Subsection (5)(b) to a third party who is designated by the individual each time a controlled
269 substance prescription for the individual is dispensed.
270 (ii) The division shall upon receipt of the request under this Subsection (5)(a) advise
271 the individual in writing that the individual may direct the division to discontinue providing the
272 information to a third party and that notice of the individual's direction to discontinue will be
273 provided to the third party.
274 (b) The information the division shall provide under Subsection (5)(a) is:
275 (i) the fact a controlled substance has been dispensed to the individual, but without
276 identifying the controlled substance; and
277 (ii) the date the controlled substance was dispensed.
278 (c) (i) An individual who has made a request under Subsection (5)(a) may direct that
279 the division discontinue providing information to the third party.
280 (ii) The division shall:
281 (A) notify the third party that the individual has directed the division to no longer
282 provide information to the third party; and
283 (B) discontinue providing information to the third party.
284 (6) (a) An individual who is granted access to the database based on the fact that the
285 individual is a licensed practitioner or a mental health therapist shall be denied access to the
286 database when the individual is no longer licensed.
287 (b) An individual who is granted access to the database based on the fact that the
288 individual is a designated employee of a licensed practitioner shall be denied access to the
289 database when the practitioner is no longer licensed.
290 (7) A probation or parole officer is not required to obtain a search warrant to access the
291 database in accordance with Subsection (2)(m).
292 (8) The division shall review and adjust the database programming which
293 automatically logs off an individual who is granted access to the database under Subsections
294 (2)(h), (2)(i), (2)(j), and (4)(c) to maximize the following objectives:
295 (a) to protect patient privacy;
296 (b) to reduce inappropriate access; and
297 (c) to make the database more useful and helpful to a person accessing the database
298 under Subsections (2)(h), (2)(i), (2)(j), and (4)(c), especially in high usage locations such as an
299 emergency department.
300 Section 2. Section 58-37f-302 is amended to read:
301 58-37f-302. Other restrictions on access to database.
302 (1) A person who is a relative of a deceased individual is not entitled to access
303 information from the database relating to the deceased individual based on the fact or claim
304 that the person is:
305 (a) related to the deceased individual; or
306 (b) subrogated to the rights of the deceased individual.
307 (2) Except as provided in Subsections (3) and (4), data provided to, maintained in, or
308 accessed from the database that may be identified to, or with, a particular person is not subject
309 to discovery, subpoena, or similar compulsory process in [
310 or legislative proceeding, nor shall [
311 data be compelled to testify with regard to the data.
312 (3) The restrictions described in Subsection (2) do not apply to a civil, judicial, or
313 administrative action brought:
314 (a) to enforce the provisions of this chapter[
315 (b) against a managed care organization, as defined in 42 C.F.R. Sec. 438.2, if:
316 (i) the action is related to Medicaid coverage;
317 (ii) the managed care organization has entered into a written agreement with the
318 Department of Health as described in Subsection 58-37f-301(2)(g); and
319 (iii) the division and the Department of Health agree in writing not to apply the
320 restrictions described in Subsection (2).
321 (4) (a) Subject to the requirements of this Subsection (4), in a state criminal proceeding
322 a court may:
323 (i) order the release of information contained in the database if the court determines
324 good cause has been shown in accordance with Rule 16, Utah Rules of Criminal Procedure;
325 and
326 (ii) at any time order that information released under this Subsection (4) be restricted,
327 limited, or restrained from further dissemination as the court determines is appropriate.
328 (b) Upon the motion of a defendant, a court may only issue an order compelling the
329 production of database information under this Subsection (4) that pertains to a victim if the
330 court finds upon notice as provided in Subsection (4)(c), and after a hearing, that the defendant
331 is entitled to production of the information under applicable state and federal law.
332 (c) A motion by a defendant for database information pertaining to a victim shall be
333 served by the defendant on:
334 (i) the prosecutor and on counsel for the victim or victim's representative; or
335 (ii) the prosecutor if the victim is unrepresented by counsel.
336 (d) Upon a defendant's motion for database information pertaining to a victim, if the
337 court determines that good cause exists to order release of database information pertaining to
338 the victim, the court shall conduct an in camera review of the database information and may
339 only disclose to the defense and prosecution those portions of database information that are
340 relevant to the state criminal proceeding.