LexLint.ioBeta

Know the law your code answers to.

Law / United States / Utah

Utah Health Data Authority, identifiable health data and re-identification

Utah Health Data Authority, Utah Code 26B-8-507 to 26B-8-509

In force since .

A de-identification rule binding public and private bodies.

Obligation class
Prohibition, Disclosure
Audit expectation
none

What it requires

  • Do not attempt to identify or re-identify an individual using data obtained under the Utah Health Data Authority part, including through data linking or correlation, except as sections 26B-8-506 and 26B-8-508 allow (Utah Code 26B-8-507(1)(c)).
  • If you are the department, use, release or publish information received under the Utah Health Data Authority part only in a way that identifies no person, except as sections 26B-8-506 and 26B-8-508 provide (Utah Code 26B-8-507(1)(b)).
  • To obtain identifiable health data from the department, make the request for a specified period or solely for bona fide research or statistical purposes, demonstrate that the data is required for those purposes, and enter into a written agreement satisfactory to the department to protect the data (Utah Code 26B-8-508(4)).
  • Once you hold identifiable health data under section 26B-8-508, do not disclose it further without the department's prior approval, and then only by control number, and delete it at the earlier of the end of the specified period or the day your need for it ceases (Utah Code 26B-8-508(5)).

These lines are LexLint's reading of the law's text.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Any use, release, or publication of health care data contrary to Utah Code 26B-8-507 and 26B-8-508 is a class A misdemeanor (Utah Code 26B-8-509(1)).

What record it asks for

Logging duty

Sections 26B-8-507 and 26B-8-508 limit identification, disclosure and retention of identifiable health data. They state no log or record duty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Utah Code 26B-8-507(1)(c) bars a person from attempting to identify or re-identify an individual using data obtained under the Utah Health Data Authority part, including through data linking or correlation, except as sections 26B-8-506 and 26B-8-508 allow.

Utah Code 26B-8-508(5) bars a person who accesses identifiable health data under the Utah Health Data Authority part from further disclosing it without the department's prior approval and unless it is disclosed or identified by control number only, and requires that person to delete it at the earlier of the end of the specified period or the day the person's need for it ceases.

Utah Code 26B-8-509(1) makes any use, release, or publication of health care data contrary to sections 26B-8-507 and 26B-8-508 a class A misdemeanor.

When LexLint raises it

When your app profile says your app handles health records, processes personal data or processes de-identified data.

Back to the example  ·  Lint your app

Page updated .