§ 26B-8-411 — Duty to establish standards for the electronic exchange of clinical health information -- Immunity.

(1) As used in this section:

(1)(a) "Affiliate" means an organization that directly or indirectly through one or more intermediaries controls, is controlled by, or is under common control with another organization.
(1)(b) "Clinical health information" shall be defined by the department by administrative rule adopted in accordance with Subsection (2).
(1)(c) "Electronic exchange":
(1)(c)(i) includes:

(1)(c)(i)(A) the electronic transmission of clinical health data via Internet or extranet; and
(1)(c)(i)(B) physically moving clinical health information from one location to another using magnetic tape, disk, or compact disc media; and
(1)(c)(ii) does not include exchange of information by telephone or fax.
(1)(d) "Health care provider" means a licensing classification that is either:
(1)(d)(i) licensed under Title 58, Occupations and Professions, to provide health care; or
(1)(d)(ii) licensed under Chapter 2, Part 2, Health Care Facility Licensing and Inspection.
(1)(e) "Health care system" shall include:
(1)(e)(i) affiliated health care providers;
(1)(e)(ii) affiliated third party payers; and
(1)(e)(iii) other arrangement between organizations or providers as described by the department by administrative rule.
(1)(f) "Qualified network" means an entity that:
(1)(f)(i) is a non-profit organization;
(1)(f)(ii) is accredited by the Electronic Healthcare Network Accreditation Commission, or another national accrediting organization recognized by the department; and
(1)(f)(iii) performs the electronic exchange of clinical health information among multiple health care providers not under common control, multiple third party payers not under common control, the department, and local health departments.
(1)(g) "Third party payer" means:
(1)(g)(i) all insurers offering health insurance who are subject to Section 31A-22-614.5; and
(1)(g)(ii) the state Medicaid program.
(2) (2)(a) The department shall make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to:
(2)(a)(i) define:

(2)(a)(i)(A) "clinical health information" subject to this section; and
(2)(a)(i)(B) "health system arrangements between providers or organizations" as described in Subsection (1)(e)(iii); and
(2)(a)(ii) adopt standards for the electronic exchange of clinical health information between health care providers and third party payers that are for treatment, payment, health care operations, or public health reporting, as provided for in 45 C.F.R. Parts 160, 162, and 164, Health Insurance Reform: Security Standards.
(2)(b) The department shall coordinate its rule making authority under the provisions of this section with the rule making authority of the Insurance Department under Section 31A-22-614.5.
(2)(c) The department shall establish procedures for developing the rules adopted under this section, which ensure that the Insurance Department is given the opportunity to comment on proposed rules.
(3) (3)(a) Except as provided in Subsection (3)(e), a health care provider or third party payer in Utah is required to use the standards adopted by the department under the provisions of Subsection (2) if the health care provider or third party payer elects to engage in an electronic exchange of clinical health information with another health care provider or third party payer.
(3)(b) A health care provider or third party payer may make a disclosure of information to the department or a local health department, by electronic exchange of clinical health information, as permitted by Subsection 45 C.F.R. Sec. 164.512(b).
(3)(c) When functioning in its capacity as a health care provider or payer, the department or a local health department may make a disclosure of clinical health information by electronic exchange to another health care provider or third party payer.
(3)(d) An electronic exchange of clinical health information by a health care provider, a third party payer, the department, a local health department, or a qualified network is a disclosure for treatment, payment, or health care operations if it complies with Subsection (3)(a) or (c) and is for treatment, payment, or health care operations, as those terms are defined in 45 C.F.R. Parts 160, 162, and 164.
(3)(e) A health care provider or third party payer is not required to use the standards adopted by the department under the provisions of Subsection (2) if the health care provider or third party payer engage in the electronic exchange of clinical health information within a particular health care system.
(4) Nothing in this section shall limit the number of networks eligible to engage in the electronic data interchange of clinical health information using the standards adopted by the department under Subsection (2)(a)(ii).
(5) (5)(a) The department, a local health department, a health care provider, a third party payer, or a qualified network is not subject to civil liability for a disclosure of clinical health information if the disclosure is in accordance with:
(5)(a)(i) Subsection (3)(a); and
(5)(a)(ii) Subsection (3)(b), (c), or (d).
(5)(b) The department, a local health department, a health care provider, a third party payer, or a qualified network that accesses or reviews clinical health information from or through the electronic exchange in accordance with the requirements in this section is not subject to civil liability for the access or review.
(6) Within a qualified network, information generated or for which a disclosure is made in the electronic exchange of clinical health information is not subject to discovery, use, or receipt in evidence in any legal proceeding of any kind or character.

Legislative History

Renumbered and Amended by Chapter 306, 2023 General Session