26B-2-246. Medical record access for children.
(1) As used in this section: "Child" means an individual under the age of 18 years old. "Electronic medical record system" means an electronic system for maintaining medical records in a clinical setting. "EMRS vendor" means the vendor of an electronic medical record management system. "Health care system" means an entity that owns two or more health care facilities. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936, as amended. "Parent" means an individual who has a parent-child relationship, as defined in Section, with the child. 81-5-102
(2) A parent has the right to obtain and access the medical records that pertain to the parent's child unless: the parent's parental rights have been terminated; the child is emancipated or legally married; required by a court order; or the medical record relates to sexual assault counseling in accordance with Section. 77-38-204
(3) Subject to Subsection, a health care facility may not restrict a parent's access to the electronic medical record of the parent's child. (3)(b) A health care facility may: restrict a parent's access to an electronic medical record of the parent's child for a reason described in Subsection; and (2) only restrict access to the portion of the electronic medical record that would be restricted under Subsection. (2)
(4) An EMRS vendor providing an electronic medical record system for a health care facility shall ensure the electronic medical record system provided to the health care facility is capable of being modified by the health care facility to comply with Subsection. 26B-2-246(3)
(5) Subject to Subsection, a health care facility in violation of Subsectionis subject to a $1,000 civil fine for each day the health care facility does not comply with Subsectionafter December 31, 2027. (5)(f) (3) (3) An EMRS vendor in violation of Subsectionis subject to a $1,000 civil fine for each day the EMRS vendor's electronic medical record system does not comply with Subsectionafter December 31, 2027. (4) (4) The attorney general may bring a civil action against a health care facility or EMRS vendor to enforce this section. In enforcing this section, the attorney general may issue subpoenas in investigating a potential violation. A court shall award attorney fees to the attorney general if the attorney general is successful in an enforcement action described in this section. If two or more health care facilities are owned by a health care system and not in compliance with Subsection, the civil fine described in Subsectionshall be assessed against the health care system for each day of noncompliance as if the health care facilities were a single health care facility. (3) (5)(a)
(6) A health care facility shall: provide a notice to any parent that is unable to access a part of an electronic medical record if: the electronic medical record system is unable to provide the parent access; and the parent is not otherwise precluded from access to the records under HIPAA or Subsection; and (2) upon request, provide the parent medical records. A health care facility shall provide records under Subsection: (6)(a) without charge; and within five business days of the day on which the health care facility receives the request. A health care facility that fails to provide records in accordance with this Subsectionis subject to a $1,000 civil fine per record. (6) The notice described in Subsectionshall state the following "If your child's medical records are not visible, click here to request them. They must be provided within five business days or a $1,000 fine applies per Utah Code Section." (6)(a)(i) 26B-2-246
(7) A fine collected under this section shall be deposited into the fund described in Section. 26B-1-335
(8) Subsectionsthroughdo not apply to the Utah State Hospital. (3) (7)