58-37f-301 - Access to database.
58-37f-301. Access to database.
(1) The division shall make rules, in accordance with Title 63G, Chapter 3, UtahAdministrative Rulemaking Act, to:
(a) effectively enforce the limitations on access to the database as described in this part;and
(b) establish standards and procedures to ensure accurate identification of individualsrequesting information or receiving information without request from the database.
(2) The division shall make information in the database available only to the followingindividuals, in accordance with the requirements of this chapter and division rules:
(a) personnel of the division specifically assigned to conduct investigations related tocontrolled substance laws under the jurisdiction of the division;
(b) authorized division personnel engaged in analysis of controlled substanceprescription information as a part of the assigned duties and responsibilities of their employment;
(c) in accordance with a written agreement entered into with the department, employeesof the Department of Health:
(i) whom the director of the Department of Health assigns to conduct scientific studiesregarding the use or abuse of controlled substances, provided that the identity of the individualsand pharmacies in the database are confidential and are not disclosed in any manner to anyindividual who is not directly involved in the scientific studies; or
(ii) when the information is requested by the Department of Health in relation to a personwhom the Department of Health suspects may be improperly obtaining or providing a controlledsubstance;
(d) a licensed practitioner having authority to prescribe controlled substances, to theextent the information:
(i) (A) relates specifically to a current or prospective patient of the practitioner; and
(B) is sought by the practitioner for the purpose of:
(I) prescribing or considering prescribing any controlled substance to the current orprospective patient;
(II) diagnosing the current or prospective patient;
(III) providing medical treatment or medical advice to the current or prospective patient;or
(IV) determining whether the current or prospective patient:
(Aa) is attempting to fraudulently obtain a controlled substance from the practitioner; or
(Bb) has fraudulently obtained, or attempted to fraudulently obtain, a controlledsubstance from the practitioner;
(ii) (A) relates specifically to a former patient of the practitioner; and
(B) is sought by the practitioner for the purpose of determining whether the formerpatient has fraudulently obtained, or has attempted to fraudulently obtain, a controlled substancefrom the practitioner;
(iii) relates specifically to an individual who has access to the practitioner's DrugEnforcement Administration identification number, and the practitioner suspects that theindividual may have used the practitioner's Drug Enforcement Administration identificationnumber to fraudulently acquire or prescribe a controlled substance;
(iv) relates to the practitioner's own prescribing practices, except when specificallyprohibited by the division by administrative rule;
(v) relates to the use of the controlled substance database by an employee of thepractitioner, described in Subsection (2)(e); or
(vi) relates to any use of the practitioner's Drug Enforcement Administrationidentification number to obtain, attempt to obtain, prescribe, or attempt to prescribe, a controlledsubstance;
(e) in accordance with Subsection (3)(a), an employee of a practitioner described inSubsection (2)(d), for a purpose described in Subsection (2)(d)(i) or (ii), if:
(i) the employee is designated by the practitioner as an individual authorized to accessthe information on behalf of the practitioner;
(ii) the practitioner provides written notice to the division of the identity of the employee;and
(iii) the division:
(A) grants the employee access to the database; and
(B) provides the employee with a password that is unique to that employee to access thedatabase in order to permit the division to comply with the requirements of Subsection58-37f-203(3)(b) with respect to the employee;
(f) a licensed pharmacist having authority to dispense a controlled substance to the extentthe information is sought for the purpose of:
(i) dispensing or considering dispensing any controlled substance; or
(ii) determining whether a person:
(A) is attempting to fraudulently obtain a controlled substance from the pharmacist; or
(B) has fraudulently obtained, or attempted to fraudulently obtain, a controlled substancefrom the pharmacist;
(g) federal, state, and local law enforcement authorities, and state and local prosecutors,engaged as a specified duty of their employment in enforcing laws:
(i) regulating controlled substances; or
(ii) investigating insurance fraud, Medicaid fraud, or Medicare fraud;
(h) a mental health therapist, if:
(i) the information relates to a patient who is:
(A) enrolled in a licensed substance abuse treatment program; and
(B) receiving treatment from, or under the direction of, the mental health therapist as partof the patient's participation in the licensed substance abuse treatment program described inSubsection (2)(h)(i)(A);
(ii) the information is sought for the purpose of determining whether the patient is usinga controlled substance while the patient is enrolled in the licensed substance abuse treatmentprogram described in Subsection (2)(h)(i)(A); and
(iii) the licensed substance abuse treatment program described in Subsection (2)(h)(i)(A)is associated with a practitioner who:
(A) is a physician, a physician assistant, an advance practice registered nurse, or apharmacist; and
(B) is available to consult with the mental health therapist regarding the informationobtained by the mental health therapist, under this Subsection (2)(h), from the database; and
(i) an individual who is the recipient of a controlled substance prescription entered intothe database, upon providing evidence satisfactory to the division that the individual requestingthe information is in fact the individual about whom the data entry was made.
(3) (a) A practitioner described in Subsection (2)(d) may designate up to three employeesto access information from the database under Subsection (2)(e).
(b) The division shall make rules, in accordance with Title 63G, Chapter 3, UtahAdministrative Rulemaking Act, to establish background check procedures to determine whetheran employee designated under Subsection (2)(e)(i) should be granted access to the database.
(c) The division shall grant an employee designated under Subsection (2)(e)(i) access tothe database, unless the division determines, based on a background check, that the employeeposes a security risk to the information contained in the database.
(d) The division may impose a fee, in accordance with Section 63J-1-504, on apractitioner who designates an employee under Subsection (2)(e)(i), to pay for the costs incurredby the division to conduct the background check and make the determination described inSubsection (3)(b).
(4) (a) An individual who is granted access to the database based on the fact that theindividual is a licensed practitioner or a mental health therapist shall be denied access to thedatabase when the individual is no longer licensed.
(b) An individual who is granted access to the database based on the fact that theindividual is a designated employee of a licensed practitioner shall be denied access to thedatabase when the practitioner is no longer licensed.
Enacted by Chapter 287, 2010 General Session
Amended by Chapter 312, 2010 General Session, (Coordination Clause)