Utah Code Title 26. Utah Health Code § 26-3-7. Disclosure of health data--Limitations

(1) one of the following persons has consented to the disclosure:

(2) the disclosure is to a governmental entity in this or another state or the federal government, provided that:

(3) the disclosure is to an individual or organization, for a specified period, solely for bona fide research and statistical purposes, determined in accordance with department rules, and the department determines that the data are required for the research and statistical purposes proposed and the requesting individual or organization enters into a written agreement satisfactory to the department to protect the data in accordance with this chapter and department rule and not permit further disclosure without prior approval of the department;

(4) the disclosure is to a governmental entity for the purpose of conducting an audit, evaluation, or investigation of the department and such governmental entity agrees not to use those data for making any determination affecting the rights, benefits, or entitlements of any individual to whom the health data relates;

(5) the disclosure is of specific medical or epidemiological information to authorized personnel within the department, local health departments, public health authorities, official health agencies in other states, the United States Public Health Service, the Centers for Disease Control and Prevention (CDC), or agencies responsible to enforce quarantine, when necessary to continue patient services or to undertake public health efforts to control communicable, infectious, acute, chronic, or any other disease or health hazard that the department considers to be dangerous or important or that may affect the public health;

(7) the disclosure is necessary to obtain payment from an insurer or other third-party payor in order for the department to obtain payment or to coordinate benefits for a patient;  or

(8) the disclosure is to the subject of the identifiable health data.