26B-3-126. Patient notice of health care provider privacy practices.
(1) For purposes of this section: "Health care provider" means a health care provider as defined in Sectionwho: 78B-3-403 receives payment for medical services from the Medicaid program established in this chapter, or the Children's Health Insurance Program established in Section; and 26B-3-902 submits a patient's personally identifiable information to the Medicaid eligibility database or the Children's Health Insurance Program eligibility database. "HIPAA" means 45 C.F.R. Parts 160, 162, and 164, Health Insurance Portability and Accountability Act of 1996, as amended. This section applies to the Medicaid program, the Children's Health Insurance Program created in Section, and a health care provider. 26B-3-902
(2) A health care provider shall, as part of the notice of privacy practices required by HIPAA, provide notice to the patient or the patient's personal representative that the health care provider either has, or may submit, personally identifiable information about the patient to the Medicaid eligibility database and the Children's Health Insurance Program eligibility database.
(3) The Medicaid program and the Children's Health Insurance Program may not give a health care provider access to the Medicaid eligibility database or the Children's Health Insurance Program eligibility database unless the health care provider's notice of privacy practices complies with Subsection (2).
(4) The department may adopt an administrative rule to establish uniform language for the state requirement regarding notice of privacy practices to patients required under Subsection (2).