Provides financial services, in Utah

Utah Admin. Code R590-206 · Read the law's page

• If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices no later than when you establish the customer relationship, and not less than once in a 12 consecutive month period during the relationship (R590-206-5 and R590-206-6).
• Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as R590-206-16 and R590-206-17 authorize (R590-206-5(1)(b)).
• Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt out notice that states you disclose or reserve the right to disclose it, that the consumer has the right to opt out and how, and allow a reasonable opportunity to opt out; do not disclose the information if the consumer opts out (R590-206-8 and R590-206-12).
• Do not disclose nonpublic personal health information about a consumer or customer without an authorization obtained before the disclosure, except for the insurance functions R590-206-18(2) lists; an authorization is written or electronic, states how long it is valid (not more than 24 months) and may be revoked at any time (R590-206-18 and R590-206-19).
• Do not discriminate against a consumer or customer because the person opted out from the disclosure of nonpublic personal financial information or did not authorize the disclosure of nonpublic personal health information (R590-206-24).

Utah Code 13-60-205 · Read the law's page

• If you are an insurer offering health care insurance, do not, in connection with the offer or renewal of an insurance product or in the determination of premiums, coverage, renewal, cancellation, or any other underwriting decision that pertains directly to the individual or to a group the individual belongs to that purchases insurance jointly, access or otherwise take into consideration private genetic information about an asymptomatic individual (Utah Code 13-60-205(1)(a)).
• Do not request or require an asymptomatic individual to consent to a release for the purpose of accessing private genetic information about the individual (Utah Code 13-60-205(1)(b)).
• Do not request or require an asymptomatic individual or the individual's blood relative to submit to a genetic test, or inquire into or otherwise take into consideration the fact that an asymptomatic individual or the individual's blood relative has taken or refused to take a genetic test (Utah Code 13-60-205(1)(c) and (d)).
• Do not request or require an individual or the individual's blood relative to submit to a genetic procedure, or inquire into the results of a genetic procedure that an individual or the individual's blood relative undergoes (Utah Code 13-60-205(1)(e) and (f)).
• Store information you obtain under Subsection (2) only in accordance with the Health Insurance Portability and Accountability Act of 1996, and use or disclose it only in connection with a proceeding to determine your obligation to pay for a genetic test or health care services, making a reasonable effort to limit disclosure to the minimum necessary (Utah Code 13-60-205(2)(d) and (e)).

Utah Code 31A-22-634 · Read the law's page

• If you are an accident and health insurer, health maintenance organization or third-party administrator the section covers, or a subcontractor of one (including a pharmacy benefit manager), do not publicly display or publicly post an individual's Social Security number in any manner (Utah Code 31A-22-634(2)(a)).
• Do not print an individual's Social Security number on any card the individual needs to access products or services provided or covered by the insurer (Utah Code 31A-22-634(2)(b)).

Utah Code 31A-21-110 · Read the law's page

• If you are an insurer not covered by Utah Code 31A-22-634, do not publicly display or publicly post an individual's Social Security number in any manner (Utah Code 31A-21-110(2)(a)).
• Do not print an individual's Social Security number on any card the individual needs to access products or services provided or covered by the insurer (Utah Code 31A-21-110(2)(b)).

Utah Admin. Code R590-216 · Read the law's page

• Applies to a licensee of the department, as the rule defines the term, that obtains nonpublic personal financial or health information from a customer, which you declare by stating that you are an insurer; it does not reach a purchasing group, an exempted warranty or service contract provider, or an unauthorized insurer for excess line business.
• Implement a comprehensive written information security program including administrative, technical, and physical safeguards to protect customer information, appropriate to the size and complexity of the licensee and the nature and scope of its activities.
• Design the program to ensure the security and confidentiality of customer information, to protect against any anticipated threat or hazard to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

Utah Code 31A-22-650, as amended · Read the law's page

• Disclose to the Insurance Department, to each network health care provider, and to each enrollee whether you use artificial intelligence in reviewing a preauthorization request, if you are a health insurerwhen it serves a financial business
• Post that disclosure and your preauthorization statistics on your websitewhen it serves a financial business
• Base an adverse preauthorization determination on clinical or medical necessity on independent medical judgment, not solely on a recommendation from any other sourcewhen it serves a financial business
• Set an authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition, and at least six months for an outpatient covered servicewhen it serves a financial business
• This duty takes effect 1 January 2027, so it is a duty to prepare for rather than one owed today