26-3-7 - Disclosure of health data -- Limitations.
26-3-7. Disclosure of health data -- Limitations.
The department may not disclose any identifiable health data unless:
(1) one of the following persons has consented to the disclosure:
(a) the individual;
(b) the next-of-kin if the individual is deceased;
(c) the parent or legal guardian if the individual is a minor or mentally incompetent; or
(d) a person holding a power of attorney covering such matters on behalf of theindividual;
(2) the disclosure is to a governmental entity in this or another state or the federalgovernment, provided that:
(a) the data will be used for a purpose for which they were collected by the department;and
(b) the recipient enters into a written agreement satisfactory to the department agreeing toprotect such data in accordance with the requirements of this chapter and department rule and notpermit further disclosure without prior approval of the department;
(3) the disclosure is to an individual or organization, for a specified period, solely forbona fide research and statistical purposes, determined in accordance with department rules, andthe department determines that the data are required for the research and statistical purposesproposed and the requesting individual or organization enters into a written agreementsatisfactory to the department to protect the data in accordance with this chapter and departmentrule and not permit further disclosure without prior approval of the department;
(4) the disclosure is to a governmental entity for the purpose of conducting an audit,evaluation, or investigation of the department and such governmental entity agrees not to usethose data for making any determination affecting the rights, benefits, or entitlements of anyindividual to whom the health data relates;
(5) the disclosure is of specific medical or epidemiological information to authorizedpersonnel within the department, local health departments, official health agencies in other states,the United States Public Health Service, the Centers for Disease Control and Prevention (CDC),or agencies responsible to enforce quarantine, when necessary to continue patient services or toundertake public health efforts to control communicable, infectious, acute, chronic, or any otherdisease or health hazard that the department considers to be dangerous or important or that mayaffect the public health;
(6) the disclosure is of specific medical or epidemiological information to a "health careprovider" as defined in Section 78B-3-403, health care personnel, or public health personnel whohas a legitimate need to have access to the information in order to assist the patient or to protectthe health of others closely associated with the patient. This Subsection (6) does not create aduty to warn third parties;
(7) the disclosure is necessary to obtain payment from an insurer or other third-partypayor in order for the department to obtain payment or to coordinate benefits for a patient; or
(8) the disclosure is to the subject of the identifiable health data.
Amended by Chapter 3, 2008 General Session