1. (1) Except as provided in Subsection (11)(a), a governmental entity:

   1. (a) shall, upon request, disclose a private record to:

      1. (i) the subject of the record;
      2. (ii) the parent or legal guardian of an unemancipated minor who is the subject of the record;
      3. (iii) the legal guardian of a legally incapacitated individual who is the subject of the record;

      4. (iv) any other individual who:

         1. (A) has a power of attorney from the subject of the record;
         2. (B) submits a notarized release from the subject of the record or the individual's legal representative dated no more than 90 days before the date the request is made; or
         3. (C) if the record is a medical record described in Subsection 63G-2-302(1)(b), is a health care provider, as defined in Section 26B-8-501, if releasing the record or information in the record is consistent with normal professional practice and medical ethics; or

      5. (v) any person to whom the record must be provided pursuant to:

         1. (A) court order as provided in Subsection (7); or
         2. (B) a legislative subpoena as provided in Title 36, Chapter 14, Legislative Subpoena Powers; and

   2. (b) may disclose a private record described in Subsections 63G-2-302(1)(j) through (n), without complying with Section 63G-2-206, to another governmental entity for a purpose related to administering:

      1. (i) the voter registration list; or
      2. (ii) an election.

2. (2)

   1. (a) Upon request, a governmental entity shall disclose a controlled record to:

      1. (i) a physician, physician assistant, psychologist, certified social worker, insurance provider or producer, or a government public health agency upon submission of:

         1. (A) a release from the subject of the record that is dated no more than 90 days prior to the date the request is made; and
         2. (B) a signed acknowledgment of the terms of disclosure of controlled information as provided by Subsection (2)(b); and

      2. (ii) any person to whom the record must be disclosed pursuant to:

         1. (A) a court order as provided in Subsection (7); or
         2. (B) a legislative subpoena as provided in Title 36, Chapter 14, Legislative Subpoena Powers.
   2. (b) A person who receives a record from a governmental entity in accordance with Subsection (2)(a)(i) may not disclose controlled information from that record to any person, including the subject of the record.
3. (3) If there is more than one subject of a private or controlled record, the portion of the record that pertains to another subject shall be segregated from the portion that the requester is entitled to inspect.

4. (4) Upon request, and except as provided in Subsection (11)(b), a governmental entity shall disclose a protected record to:

   1. (a) the person that submitted the record;

   2. (b) any other individual who:

      1. (i) has a power of attorney from all persons, governmental entities, or political subdivisions whose interests were sought to be protected by the protected classification; or
      2. (ii) submits a notarized release from all persons, governmental entities, or political subdivisions whose interests were sought to be protected by the protected classification or from their legal representatives dated no more than 90 days prior to the date the request is made;

   3. (c) any person to whom the record must be provided pursuant to:

      1. (i) a court order as provided in Subsection (7); or
      2. (ii) a legislative subpoena as provided in Title 36, Chapter 14, Legislative Subpoena Powers; or
   4. (d) the owner of a mobile home park, subject to the conditions of Subsection 41-1a-116(5).
5. (5) Except as provided in Subsection (1)(b), a governmental entity may disclose a private, controlled, or protected record to another governmental entity, political subdivision, state, the United States, or a foreign government only as provided by Section 63G-2-206.
6. (6) Before releasing a private, controlled, or protected record, the governmental entity shall obtain evidence of the requester's identity.

7. (7) A governmental entity shall disclose a record pursuant to the terms of a court order signed by a judge from a court of competent jurisdiction, provided that:

   1. (a) the record deals with a matter in controversy over which the court has jurisdiction;
   2. (b) the court has considered the merits of the request for access to the record;

   3. (c) the court has considered and, where appropriate, limited the requester's use and further disclosure of the record in order to protect:

      1. (i) privacy interests in the case of private or controlled records;
      2. (ii) business confidentiality interests in the case of records protected under Subsection 63G-2-305(1), (2), (40)(b), or (40)(f); and
      3. (iii) privacy interests or the public interest in the case of other protected records;
   4. (d) to the extent the record is properly classified private, controlled, or protected, the interests favoring access, considering limitations thereon, are greater than or equal to the interests favoring restriction of access; and
   5. (e) where access is restricted by a rule, statute, or regulation referred to in Subsection 63G-2-201(3)(b), the court has authority independent of this chapter to order disclosure.

8. (8)

   1. (a) Except as provided in Subsection (8)(d), a governmental entity may disclose or authorize disclosure of private or controlled records for research purposes if the governmental entity:

      1. (i) determines that the research purpose cannot reasonably be accomplished without use or disclosure of the information to the researcher in individually identifiable form;

      2. (ii) determines that:

         1. (A) the proposed research is bona fide; and
         2. (B) the value of the research is greater than or equal to the infringement upon personal privacy;

      3. (iii)

         1. (A) requires the researcher to assure the integrity, confidentiality, and security of the records; and
         2. (B) requires the removal or destruction of the individual identifiers associated with the records as soon as the purpose of the research project has been accomplished;

      4. (iv) prohibits the researcher from:

         1. (A) disclosing the record in individually identifiable form, except as provided in Subsection (8)(b); or
         2. (B) using the record for purposes other than the research approved by the governmental entity; and
      5. (v) secures from the researcher a written statement of the researcher's understanding of and agreement to the conditions of this Subsection (8) and the researcher's understanding that violation of the terms of this Subsection (8) may subject the researcher to criminal prosecution under Section 63G-2-801.
   2. (b) A researcher may disclose a record in individually identifiable form if the record is disclosed for the purpose of auditing or evaluating the research program and no subsequent use or disclosure of the record in individually identifiable form will be made by the auditor or evaluator except as provided by this section.
   3. (c) A governmental entity may require indemnification as a condition of permitting research under this Subsection (8).
   4. (d) A governmental entity may not disclose or authorize disclosure of a private record for research purposes as described in this Subsection (8) if the private record is a record described in Subsection 63G-2-302(1)(x).

9. (9)

   1. (a) Under Subsections 63G-2-201(5)(b) and 63G-2-401(6), a governmental entity may disclose to persons other than those specified in this section records that are:

      1. (i) private under Section 63G-2-302; or
      2. (ii) protected under Section 63G-2-305, subject to Section 63G-2-309 if a claim for business confidentiality has been made under Section 63G-2-309.

   2. (b) Under Subsection 63G-2-403(11)(b), the State Records Committee may require the disclosure to persons other than those specified in this section of records that are:

      1. (i) private under Section 63G-2-302;
      2. (ii) controlled under Section 63G-2-304; or
      3. (iii) protected under Section 63G-2-305, subject to Section 63G-2-309 if a claim for business confidentiality has been made under Section 63G-2-309.
   3. (c) Under Subsection 63G-2-404(7), the court may require the disclosure of records that are private under Section 63G-2-302, controlled under Section 63G-2-304, or protected under Section 63G-2-305 to persons other than those specified in this section.

10. (10)

    1. (a) A private record described in Subsection 63G-2-302(2)(f) may only be disclosed as provided in Subsection (1)(a)(v).
    2. (b) A protected record described in Subsection 63G-2-305(43) may only be disclosed as provided in Subsection (4)(c) or Section 26B-6-212.

11. (11)

    1. (a) A private, protected, or controlled record described in Section 26B-1-506 shall be disclosed as required under:

       1. (i) Subsections 26B-1-506(1)(b) and (2); and
       2. (ii) Subsections 26B-1-507(1) and (6).
    2. (b) A record disclosed under Subsection (11)(a) shall retain its character as private, protected, or controlled.

Amended by Chapter 324, 2026 General Session