1. (1) Identifiable health data collected by the department is not subject to subpoena or similar compulsory process in any civil or criminal, judicial, administrative, or legislative proceeding, nor shall any individual or organization with lawful access to identifiable health data be compelled to testify with regard to such health data, except that data pertaining to a party in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of such individual to enforce any liability arising under this part.
2. (2) Data collected by the department are not public, and as such are exempt from the classification and release requirements specified in Title 63g, Chapter 2, Government Records Access and Management Act.

3. (3) Any person having access to data collected or produced by the department under Title 26B, Chapter 8, Part 5, Utah Health Data Authority may not:

   1. (a) take any action that might provide information to any unauthorized individual or agency;
   2. (b) scan, copy, remove, or review any information to which specific authorization has not been granted;
   3. (c) discuss information with unauthorized persons which could lead to the identification of individuals; or
   4. (d) give access to any information by sharing passwords or file access codes.

4. (4) Any person having access to data collected or produced by the department under Title 26B, Chapter 8, Part 5, Utah Health Data Authority shall:

   1. (a) maintain the data in a safe manner which restricts unauthorized access;
   2. (b) limit the use of the data to the purposes for which access is authorized; and
   3. (c) immediately report any unauthorized access to the program or its designated security officer.
5. (5) A failure to report known violations by others is subject to the same punishment as a personal violation.
6. (6) The department shall deny a person access to the facilities, services, and data as a result of any violation of the responsibilities specified in this section.

KEY: health, health policy, health planning

Date of Last Change: January 27, 2025

Notice of Continuation: August 13, 2021

Authorizing, and Implemented or Interpreted Law: 26B-1-413