Utah Code Title 26B. Utah Health and Human Services Codes § 26B-8-508. Exceptions to prohibition on disclosure of identifiable health data

(a) the individual has authorized the disclosure;

(b) the disclosure is to the department or a public health authority in accordance with Subsection (2); or

(c) the disclosure complies with the provisions of:

(a) the department or the public health authority has clear statutory authority to possess the identifiable health data; and

(b) the disclosure is solely for use:

(a) whether the request comes from a person after that person has received approval to do the specific research or statistical work from an institutional review board; and

(b) whether the requesting entity complies with the provisions of Subsection (4).

(a) be for a specified period; or

(b) be solely for bona fide research or statistical purposes as determined in accordance with administrative rules adopted by the department in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, which shall require:

(a) without prior approval of the department; and

(b) unless the identifiable health data is disclosed or identified by control number only.