13-72a-201. Protection of personal information.
197 words·~1 min read·
/ut/title-13/chapter-72a/13-72a-201A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Effective 5/7/2025
13-72a-201. Protection of personal information.
(1)A supplier of a mental health chatbot may not sell to or share with any third party any:
(a)individually identifiable health information of a Utah user; or
(b)user input of a Utah user.
(2)Subsection
(1)does not apply to individually identifiable health information:
(a)requested by a health care provider with the consent of the Utah user;
(b)provided to a health plan of a Utah user upon request of the Utah user; or
(c)shared in compliance with Subsection
(3).
(a)A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality.
(b)When sharing information under Subsection (3)(a), the supplier and the other entity shall comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as such terms are defined in 45 C.F.R. 160.103.
Enacted by Chapter 269 , 2025 General Session