All Roll Calls
Yes: 146 • No: 4
UtahH.B. 1992026 General SessionHouse
Health Data Amendments
Sponsored By: Norman K Thurston (Republican)
Signed by Governor
Substance AbuseHealth and Human ServicesMental HealthLegislative OperationsSunsets and RepealersHealth Care StatisticsDepartment of Health and Human ServicesLocal Health DepartmentsLocal Mental Health AuthoritiesLocal Substance Abuse AuthoritiesPublic Health
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
8 provisions identified: 4 benefits, 1 costs, 3 mixed.
Patients can stop identifiable health data use
Beginning May 6, 2026, Utah's health department must offer an opt-out system and clearly post instructions online. After you opt out, the department cannot share, analyze, or use your identifiable data, including data collected earlier. It must maintain a list of people who opt out; this requirement ends July 1, 2026. Covered recipients must delete department-provided data they hold about you when the department tells them you restricted its use. That recipient deletion rule ends July 1, 2036.
Stronger privacy rules for patients' health data
Beginning May 6, 2026, Utah's health department must use privacy safeguards and encrypt identifiable data when stored and sent. It must use only necessary data and limit direct identifiers to quality checks, record links, breach notices, geographic work, and identity matching. Addresses and geographic codes must be removed immediately after covered location work; no part of a received Social Security number can be shared. These department requirements end July 1, 2026. A separate ban on identifying people through covered data, including linked data, ends July 1, 2036, with specified statutory exceptions. The law also preserves claims for damages from legally actionable conduct through July 1, 2036; it guarantees no recovery amount.
Researchers face tighter health data safeguards
Beginning May 6, 2026, requests for potentially identifiable data must cover a set period or genuine research or statistical purposes. Requesters must show the data is needed and sign an agreement accepted by Utah's health department. Research disclosures also require review-board approval. Covered research users must use control numbers instead of personal identifiers and obtain department approval before further sharing. They must delete data when the approved period ends or their need ends, whichever comes first. Recipients must use required federal safeguards and encrypt stored and transmitted identifiable data; these rules end July 1, 2036.
Utah keeps health claims tracking through 2036
Beginning May 6, 2026, Utah's health department must create an All Payer Claims Database for claims and costs. The law extends the Health Data Authority repeal date from July 1, 2026, to July 1, 2036. Covered suppliers include insurers with at least 2,500 Utah enrollees; additional collection depends on funding and the adopted plan. Required uses include insurer rate reviews, geographic cost reports, air-ambulance charge publication, and the state auditor's price-transparency tool. Provider price increases above the medical-care Consumer Price Index are reported using June-to-June comparisons. Monthly enrollment feeds to a designated nonprofit insurer-provider coalition support Medicaid payment coordination and claims submission. The law specifies no new appropriation and does not guarantee households access to raw database records.
Health data users must pay fees
Beginning May 6, 2026, Utah's health department must establish fees for users of data collected under this framework. The fees help cover collection costs. The law sets no fee amount or rule for passing those costs to households. This requirement ends July 1, 2026.
Health authorities get limited data sharing
Beginning May 6, 2026, Utah defines disclosure as communication outside its Division of Data, Systems, and Evaluation. Division staff and contractors are not outside recipients; this definition change ends July 1, 2026. Through July 1, 2036, the department may share identifiable data internally or with local health, mental-health, and substance-abuse authorities. For purposes other than the specified immunization, cancer-registry, and medical-examiner uses, those disclosures cannot include direct identifiers.
Conflicting rules for provider payment reporting
The supplied provisions conflict about reimbursement reporting beginning May 6, 2026. One authorizes required reporting after plan adoption, where federal law permits, through July 1, 2036. It covers fee schedules, costs, contract terms, discounts, and actual payments, including consumer payments. A companion provision bars publishing covered data that reveals current provider-payer contract terms through July 1, 2036. Another provision removes reporting authority for specified payment arrangements and its related publication limit, with a July 1, 2026 sunset. These conflicting descriptions do not establish a clear reporting obligation or publication rule.
New safeguards for health data requests
Beginning May 6, 2026, Utah's health department must publish plans before requesting the health data those plans cover. Plans must describe data needs, suppliers, costs, checks, uses, sharing, and steps to prevent identifying people again. Collection must serve listed health-system or public-health purposes; suppliers need not provide identifiable data beyond approved needs. The department must review identification methods and may require shared patient, facility, and provider identifiers if necessary. It must consider changing requests with unreasonable costs and pay costs suppliers prove unreasonable if requests remain unchanged. These requirements end July 1, 2026.
Sponsors & Cosponsors
Sponsor
Norman K Thurston
Republican • House
Cosponsors
Kirk A. Cullimore
Republican • Senate
Roll Call Votes
Senate vote • 2/12/2026
Senate/ passed 3rd reading
Yes: 29 • No: 0
Senate vote • 2/11/2026
Senate/ passed 2nd reading
Yes: 28 • No: 0
Senate vote • 2/11/2026
Senate/ uncircled
Yes: 0 • No: 0
Senate vote • 2/5/2026
Senate/ circled
Yes: 0 • No: 0
Senate vote • 2/3/2026
Senate Comm - Favorable Recommendation
Yes: 5 • No: 0
House vote • 1/29/2026
House/ substituted
Yes: 0 • No: 0
House vote • 1/29/2026
House/ passed 3rd reading
Yes: 70 • No: 1
House vote • 1/22/2026
House Comm - Favorable Recommendation
Yes: 5 • No: 3
House vote • 1/22/2026
House Comm - Amendment Recommendation
Yes: 9 • No: 0
Actions Timeline
Governor Signed
3/17/2026House/ to Governor
3/12/2026HouseHouse/ received enrolled bill from Printing
3/12/2026HouseHouse/ enrolled bill to Printing
3/5/2026HouseEnrolled Bill Returned to House or Senate
3/5/2026Draft of Enrolled Bill Prepared
2/17/2026Bill Received from House for Enrolling
2/17/2026House/ signed by Speaker/ sent for enrolling
2/17/2026HouseHouse/ received from Senate
2/17/2026HouseSenate/ to House
2/12/2026SenateSenate/ signed by President/ returned to House
2/12/2026SenateSenate/ passed 3rd reading
2/12/2026SenateSenate/ 3rd reading
2/12/2026SenateSenate/ passed 2nd reading
2/11/2026SenateSenate/ uncircled
2/11/2026SenateSenate/ circled
2/5/2026SenateSenate/ 2nd reading
2/5/2026SenateSenate/ placed on 2nd Reading Calendar
2/4/2026SenateSenate/ committee report favorable
2/4/2026SenateSenate Comm - Favorable Recommendation
2/3/2026Senate/ to standing committee
2/3/2026SenateSenate/ 1st reading (Introduced)
1/30/2026SenateSenate/ received from House
1/29/2026SenateHouse/ to Senate
1/29/2026HouseHouse/ passed 3rd reading
1/29/2026House
Bill Text
Enrolled
3/5/2026
Substitute #1
1/27/2026
Amended 1/23/2026 11:01:847
1/23/2026
Introduced
1/8/2026