§ 26-3-7. Disclosure of health data -- Limitations.

     The department may not disclose any identifiable health data unless:

(1) one of the following persons has consented to the disclosure:

(a) the individual;

(b) the next-of-kin if the individual is deceased;

(c) the parent or legal guardian if the individual is a minor or mentally incompetent; or

(d) a person holding a power of attorney covering such matters on behalf of the individual;

(2) the disclosure is to a governmental entity in this or another state or the federal government, provided that:

(a) the data will be used for a purpose for which they were collected by the department; and

(b) the recipient enters into a written agreement satisfactory to the department agreeing to protect such data in accordance with the requirements of this chapter and department rule and not permit further disclosure without prior approval of the department;

(3) the disclosure is to an individual or organization, for a specified period, solely for bona fide research and statistical purposes, determined in accordance with department rules, and the department determines that the data are required for the research and statistical purposes proposed and the requesting individual or organization enters into a written agreement satisfactory to the department to protect the data in accordance with this chapter and department rule and not permit further disclosure without prior approval of the department;

(4) the disclosure is to a governmental entity for the purpose of conducting an audit, evaluation, or investigation of the department and such governmental entity agrees not to use those data for making any determination affecting the rights, benefits, or entitlements of any individual to whom the health data relates;

(5) the disclosure is of specific medical or epidemiological information to authorized personnel within the department, local health departments, public health authorities, official health agencies in other states, the United States Public Health Service, the Centers for Disease Control and Prevention (CDC), or agencies responsible to enforce quarantine, when necessary to continue patient services or to undertake public health efforts to control communicable, infectious, acute, chronic, or any other disease or health hazard that the department considers to be dangerous or important or that may affect the public health;

(6)

(a) the disclosure is of specific medical or epidemiological information to a "health care provider" as defined in Section 78B-3-403, health care personnel, or public health personnel who has a legitimate need to have access to the information in order to assist the patient or to protect the health of others closely associated with the patient; and

(b) this Subsection (6) does not create a duty to warn third parties;

(7) the disclosure is necessary to obtain payment from an insurer or other third-party payor in order for the department to obtain payment or to coordinate benefits for a patient; or

(8) the disclosure is to the subject of the identifiable health data.

Amended by Chapter 278, 2013 General Session