Utah Code Ann. § 63A-13-301 – Access to records -- Retention of designation under Government Records Access and Management Act.

(1) In order to fulfill the duties described in Section 63A-13-202, and in the manner provided in Subsection (4), the office shall have unrestricted access to all records of state executive branch entities, all local government entities, and all providers relating, directly or indirectly, to:
1. (a) the state Medicaid program;
2. (b) state or federal Medicaid funds;
3. (c) the provision of Medicaid related services;
4. (d) the regulation or management of any aspect of the state Medicaid program;
5. (e) the use or expenditure of state or federal Medicaid funds;
6. (f) suspected or proven fraud, waste, or abuse of state or federal Medicaid funds;
7. (g) Medicaid program policies, practices, and procedures;
8. (h) monitoring of Medicaid services or funds; or
9. (i) a fatality review of a person who received Medicaid funded services.
(2) The office shall have access to information in any database maintained by the state or a local government to verify identity, income, employment status, or other factors that affect eligibility for Medicaid services.
(3) The records described in Subsections (1) and (2) include records held or maintained by the department, the division, the Department of Human Services, the Department of Workforce Services, a local health department, a local mental health authority, or a school district. The records described in Subsection (1) include records held or maintained by a provider. When conducting an audit of a provider, the office shall, to the extent possible, limit the records accessed to the scope of the audit.
(4) A record, described in Subsection (1) or (2), that is accessed or copied by the office:
1. (a) may be reviewed or copied by the office during normal business hours, unless otherwise requested by the provider or health care professional under Subsection (4)(b);
2. (b) unless there is a credible allegation of fraud, shall be accessed, reviewed, and copied in a manner, on a day, and at a time that is minimally disruptive to the health care professional's or provider's care of patients, as requested by the health care professional or provider;
3. (c) may be submitted electronically;
4. (d) may be submitted together with other records for multiple claims; and
5. (e) if it is a government record, shall retain the classification made by the entity responsible for the record, under Title 63G, Chapter 2, Government Records Access and Management Act.
(5) Notwithstanding any provision of state law to the contrary, the office shall have the same access to all records, information, and databases to which the department or the division have access.
(6) The office shall comply with the requirements of federal law, including the Health Insurance Portability and Accountability Act of 1996 and 42 C.F.R., Part 2, relating to the office's:
1. (a) access, review, retention, and use of records; and
2. (b) use of information included in, or derived from, records.