1. (1)

   1. (a) Any person who knowingly and intentionally releases:

      1. (i) any information in the database or any information obtained from other state or federal prescription monitoring programs by means of the database in violation of the limitations under Part 3, Access and Utilization, is guilty of a third degree felony; or
      2. (ii) any information in the database accessed under Section 58-37f-303 by an electronic data system, or accessed by a person via an electronic data system, in violation of rules established by the division under Subsection 58-37f-303(4) is guilty of a third degree felony.

   2. (b) Any person who negligently or recklessly releases:

      1. (i) any information in the database or any information obtained from other state or federal prescription monitoring programs by means of the database in violation of the limitations under Part 3, Access and Utilization, is guilty of a class C misdemeanor; or
      2. (ii) any information in the database accessed under Section 58-37f-303 by an electronic data system, or accessed by a person via an electronic data system, in violation of rules established by the division under Subsection 58-37f-303(4) is guilty of a class C misdemeanor.

2. (2)

   1. (a) Any person who obtains or attempts to obtain the following by misrepresentation or fraud is guilty of a third degree felony:

      1. (i) information from the database;
      2. (ii) information from any other state or federal prescription monitoring program by means of the database; or
      3. (iii) information from the database or any other state or federal prescription monitoring program via an electronic data system under Section 58-37f-303.
   2. (b) Any person who obtains or attempts to obtain information from the database, including via an electronic data system under Section 58-37f-303 that has access to the database, for a purpose other than a purpose authorized by this chapter or by rule is guilty of a third degree felony.

3. (3)

   1. (a) Except as provided in Subsection (3)(e), a person may not knowingly and intentionally use, release, publish, or otherwise make available to any other person the following information for any purpose other than those specified in Part 3, Access and Utilization:

      1. (i) information obtained from the database;
      2. (ii) information obtained from any other state or federal prescription monitoring program by means of the database; or

      3. (iii) information in the database accessed under Section 58-37f-303 by:

         1. (A) an electronic data system; or
         2. (B) a person via an electronic data system.
   2. (b) Each separate violation of this Subsection (3) is a third degree felony and is also subject to a civil penalty not to exceed $5,000.
   3. (c) The procedure for determining a civil violation of this Subsection (3) is in accordance with Section 58-1-108, regarding adjudicative proceedings within the division.
   4. (d) Civil penalties assessed under this Subsection (3) shall be deposited in the General Fund as a dedicated credit to be used by the division under Subsection 58-37f-502(1).

   5. (e) This Subsection (3) does not prohibit a person who obtains information from the database under Subsection 58-37f-301(2) (h), (i), (k), or (4)(c) from:

      1. (i) including the information in the person's medical chart or file for access by a person authorized to review the medical chart or file; or
      2. (ii) providing the information to a person in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996.

Amended by Chapter 112, 2016 General Session