Utah § 13-72a-201 Protection of personal information.

Utah Statutes

§ 13-72a-201 — Protection of personal information.

Utah § 13-72a-201

Title 13Commerce and Trade

Ch. 13-72aArtificial Intelligence Applications Relating to Mental Health

Part 13-72a-2Protections for Users of Mental Health Chatbots

This text of Utah § 13-72a-201 (Protection of personal information.) is published on Counsel Stack Legal Research, covering Utah primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Utah Code Ann. § 13-72a-201 (2026).

Text

(1)A supplier of a mental health chatbot may not sell to or share with any third party any:

(1)(a) individually identifiable health information of a Utah user; or

(1)(b) user input of a Utah user.

(2)Subsection (1) does not apply to individually identifiable health information:

(2)(a) requested by a health care provider with the consent of the Utah user;

(2)(b) provided to a health plan of a Utah user upon request of the Utah user; or

(2)(c) shared in compliance with Subsection (3).

(3)(3)(a) A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality.

(3)(b) When sharing information under Subsection (3)(a), the suppli

Free access — add to your briefcase to read the full text and ask questions with AI

(1) A supplier of a mental health chatbot may not sell to or share with any third party any:
(1)(a) individually identifiable health information of a Utah user; or
(1)(b) user input of a Utah user.
(2) Subsection (1) does not apply to individually identifiable health information:
(2)(a) requested by a health care provider with the consent of the Utah user;
(2)(b) provided to a health plan of a Utah user upon request of the Utah user; or
(2)(c) shared in compliance with Subsection (3).
(3) (3)(a) A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality.
(3)(b) When sharing information under Subsection (3)(a), the supplier and the other entity shall comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as such terms are defined in 45 C.F.R. 160.103.