§ 26B-3-126 — Patient notice of health care provider privacy practices.

(1) (1)(a) For purposes of this section:
(1)(a)(i) "Health care provider" means a health care provider as defined in Section 78B-3-403 who:
(1)(a)(i)(A) receives payment for medical services from the Medicaid program established in this chapter, or the Children's Health Insurance Program established in Section 26B-3-902; and
(1)(a)(i)(B) submits a patient's personally identifiable information to the Medicaid eligibility database or the Children's Health Insurance Program eligibility database.
(1)(a)(ii) "HIPAA" means 45 C.F.R. Parts 160, 162, and 164, Health Insurance Portability and Accountability Act of 1996, as amended.
(1)(b) This section applies to the Medicaid program, the Children's Health Insurance Program created in Section 26B-3-902, and a health care provider.
(2) A health care provider shall, as part of the notice of privacy practices required by HIPAA, provide notice to the patient or the patient's personal representative that the health care provider either has, or may submit, personally identifiable information about the patient to the Medicaid eligibility database and the Children's Health Insurance Program eligibility database.
(3) The Medicaid program and the Children's Health Insurance Program may not give a health care provider access to the Medicaid eligibility database or the Children's Health Insurance Program eligibility database unless the health care provider's notice of privacy practices complies with Subsection (2).
(4) The department may adopt an administrative rule to establish uniform language for the state requirement regarding notice of privacy practices to patients required under Subsection (2).

Legislative History

Amended by Chapter 284, 2024 General Session