HB 199: Health Data Amendments - Utah

Amended 1/23/2026 11:01:847 → Substitute #1 · 3 edits

MINOR

This substitute bill significantly expands the definition of 'direct identifiers' to include rare disease diagnosis codes, specific birth dates, and exact service dates, thereby tightening privacy protections. It also clarifies that the department can share data with local mental health and substance abuse authorities, provided the data does not contain direct identifiers. Additionally, the bill adds Section 26B-8-507 to the list of affected code sections, correcting the legislative record.

Scope change

The bill's scope regarding data sharing was expanded to explicitly include local mental health and substance abuse authorities, while the scope of protected data was broadened to include more specific identifiers.

DEFINITION

The definition of 'direct identifiers' was expanded to include rare disease diagnosis codes, full birth dates, and exact service dates to prevent re-identification of individuals.

SCOPE

The department is now explicitly authorized to share de-identified health data with local mental health authorities and local substance abuse authorities.

TECHNICAL

Section 26B-8-507 was added to the list of Utah Code sections affected by this bill, correcting an omission from the previous version.

Amended Excerpts 1/23/2026 11:01:847 → Amended 1/23/2026 11:01:847 · 4 edits

MODERATE

This bill updates the definitions and data authority for Utah's Department of Health and Human Services. It clarifies what constitutes 'health data' and 'identifiable health data' by referencing existing statutes rather than creating new definitions. The changes also adjust how facilities are defined and list specific types of direct identifiers that must be protected.

Scope change

The scope of applicability remains largely the same, but the specific criteria for who and what is included under health data definitions have been refined to align with other state laws.

DEFINITION

The definition of 'Health data' was changed to reference the definition in Section 26B-8-401 instead of listing specific categories of information.

The definition of 'Identifiable health data' was changed to reference the definition in Section 26B-8-401 instead of describing it as data that makes an individual identifiable.

New definitions were added for 'Health care facility' and 'Local mental health authority' to clarify which entities fall under the bill's jurisdiction.

REQUIREMENT

The requirement for the department to publish plans on its website was modified to allow the department to add, delete, or modify the list of facilities included in the definition by rule.

Enrolled → Amended Excerpts 1/23/2026 11:01:847 · 5 edits

MODERATE

This bill amends Utah's health data authority to strengthen privacy protections and clarify how data can be shared. Key changes include adding a specific requirement for the department to describe efforts to prevent individual re-identification in its data plans, expanding the list of entities that can receive de-identified data to include local mental health and substance abuse authorities, and extending the repeal date for the Health Data Committee to 2036. The bill also clarifies that the department cannot publish specific contract terms or reimbursement details.

Scope change

The bill expands the scope of data sharing by explicitly allowing the department to share de-identified data with local mental health and substance abuse authorities, which were not explicitly listed in the previous version.

REQUIREMENT

Added a new requirement for the department's data analytics plan to describe specific actions or efforts used to prevent individual re-identification.

Clarified that the department cannot publish specific contract terms, discounts, or fixed reimbursement arrangements between providers and payers.

Updated the definition of 'Disclosure' to clarify it applies to communication outside the department, its staff, and contractors.

DEFINITION

Modified the list of entities that can receive de-identified health data to explicitly include local mental health authorities and local substance abuse authorities.

TIMELINE

Extended the repeal date for the Health Data Committee from 2026 to 2036.

Introduced → Enrolled · 8 edits · Mar 17, 2026

MODERATE

This bill updates Utah's health data laws to modernize definitions, clarify how the Department of Health and Human Services can share data with other agencies, and extend the expiration date for the Utah Health Data Authority. It also adds specific protections for rare diseases and minors while establishing a new opt-out system for individuals who do not want their data used for research.

Scope change

The bill expands the scope of data sharing to include local mental health and substance abuse authorities and clarifies the department's authority to collect and analyze data for quality improvement and cost management.

DEFINITION

Updated the definition of 'Direct identifiers' to explicitly include rare disease diagnosis codes, full dates of birth, and exact service dates unless they are perturbed.

Changed the definition of 'Health data' to reference the existing statutory definition rather than repeating the full text, ensuring consistency with other laws.

REQUIREMENT

Added a new opt-out system allowing individuals to restrict the use of their identifiable health data for department research and analysis duties.

Clarified that the department can share data with public health, mental health, and substance abuse authorities, provided the data does not contain direct identifiers.

Added a requirement for the department to annually report to the Health and Human Services Interim Committee on privacy practices and efforts to enhance data security.

Repealed the requirement for the department to review state statutory mandates for health data collection that are older than 10 years.

TIMELINE

Extended the repeal date for the Utah Health Data Authority from July 1, 2026, to July 1, 2036.

TECHNICAL

Added Section 26B-8-507 to the list of affected code sections, indicating a new section was created or amended in the final version.

Health Data Amendments

What changed between versions

How they voted

Actions timeline

Sponsors