Law / United States / 
Utah
Utah Health Data Authority, direct identifiers and minimum necessary use
Utah Health Data Authority, Utah Code 26B-8-501(2) and (4) and 26B-8-501.1(9)
In force since .
A de-identification rule binding government bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- If you are the department, use the minimum necessary identifiable health data to accomplish the duties described in the Utah Health Data Authority part (Utah Code 26B-8-501.1(9)(a)(i)).
- If you are the department, use direct identifiers in identifiable health data only for quality assurance, referential integrity, complying with breach notification requirements, calculating the distance between addresses or linking external geographically-based data, or identity resolution (Utah Code 26B-8-501.1(9)(a)(ii)).
- If you are the department and receive an individual's social security number with data obtained under the Utah Health Data Authority part, do not share any part of it with any person (Utah Code 26B-8-501.1(9)(b)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 26B-8-501.1(9) limits the department's use of identifiable health data and direct identifiers. It states no log or record duty.
- Kind
- None
- As of
What this law does
Utah Code 26B-8-501.1(9)(a)(i) requires the department, for identifiable health data, to use the minimum necessary data to accomplish its duties under the Utah Health Data Authority part. Utah Code 26B-8-501.1(9)(a)(ii) allows the department to use direct identifiers only for quality assurance, referential integrity, complying with breach notification requirements, calculating the distance between addresses or linking external geographically-based data, and identity resolution.
Utah Code 26B-8-501.1(9)(b) bars the department from sharing any part of an individual's social security number received with data obtained under the Utah Health Data Authority part.
Utah Code 26B-8-501(2) defines a control number as a number or other identifier that the department assigns to identifiable health data, that is consistent with the best practices of data privacy, and that is used to ensure health data is not able to be readily associated with an individual when it is provided for research or statistical analysis.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .