In Utah, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. You must be told when AI is used in your care. Also signed, not yet in force: Preauthorization: AI disclosure to enrollees (S.B. 319, 2026, Ch. 240) (January 1, 2027); Preauthorization: adverse determinations by an individual using independent judgment (S.B. 319, 2026, Ch. 240) (January 1, 2027). Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Level 2 rests on 13-60-104, which requires express consent from direct-to-consumer genetic testing companies (one class of holder). The general privacy act gives only an opt-out for health data (level 1 alone).
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
In force · effective · read October 3, 2026 · source(le.utah.gov)
obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data
Who it binds, in our words: Utah Code 13-60-102: a company that "offers consumer genetic testing products or services directly to consumers"
Genetic Information Privacy Act: prohibited disclosures. Utah Code 13-60-105
In force · effective · read October 3, 2026 · source(le.utah.gov)
A direct-to-consumer genetic testing company may not disclose a consumer's genetic data without the consumer's written consent to:
Who it binds, in our words: Direct-to-consumer genetic testing companies; disclosures to health, life or long-term care insurers or the consumer's employer.
Utah Consumer Privacy Act: sensitive data processing. Utah Code 13-61-302(3)
In force · effective · read October 3, 2026 · source(le.utah.gov)
first presenting the consumer with clear notice and an opportunity to opt out of the processing
Who it binds, in our words: Utah Code 13-61-102(1)(b): a controller or processor that "has annual revenue of $25,000,000 or more" and processes data of 100,000 consumers, or 25,000 with over 50% revenue from data sales. Covered entities and PHI excluded.
In force · effective · read October 3, 2026 · source(le.utah.gov)
information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional;
Who it binds, in our words: Controllers under 13-61-102; excludes such data processed by licensed health care providers.
In force · effective · read October 3, 2026 · source(le.utah.gov)
has annual revenue of $25,000,000 or more; and
Who it binds, in our words: Controllers or processors doing business in Utah or targeting Utah residents. A 2026 amendment (Ch. 193) effective 2027-01-01 adds motor vehicle manufacturers; no change to health data terms.
Mental health chatbots: protection of personal information. Utah Code 13-72a-201
In force · effective · read October 3, 2026 · source(le.utah.gov)
A supplier of a mental health chatbot may not sell to or share with any third party any:
Who it binds, in our words: Suppliers of a mental health chatbot (generative AI represented as able to provide mental health therapy), for Utah users. Exception for provider requests with user consent.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy element met: a first copy for a benefits claim or appeal is free, and copies are free for indigent people. Both go beyond HIPAA and 45 CFR 171.302. The deadline follows HIPAA, so no shorter deadline.
Free copy: First copy for each date of service needed for a qualified claim or appeal (Social Security Act or a federal or state needs-based benefit program), once per calendar year (78B-5-618(12)(a))
Free copy: All fees waived for an indigent individual (household income at or below 100% of the federal poverty level), one free copy per date of service per provider per year (78B-5-618(13))
Fee rule: Patient or personal representative: "may charge a reasonable cost-based fee provided that the fee includes only the cost of:" copying and postage (78B-5-618(4)(b))
Fee rule: Attorney or other third party: $30 per request to locate records; 53 cents per page for first 40 pages, 32 cents after; $20 certification; $20 expedite fee; inflation-adjusted yearly (78B-5-618(5), (11))
Fee rule: Electronic copy: per page fee is 50% of the paper fee; cap of $150; cap falls to $75 if late past 30 days and free if late past 60 days (78B-5-618(10))
Fee rule: Second or later copy for a qualified claim or appeal: up to 60 cents per page, no administrative fee (78B-5-618(12)(b))
Goes beyond the federal floor: yes.
Patient access to medical records: free copy for qualified claim or appeal. Utah Code 78B-5-618(12)
In force · effective · read October 3, 2026 · source(le.utah.gov)
may not charge a fee for the first copy of the record for each date of service that is necessary to support the qualified claim or appeal in each calendar year;
Who it binds, in our words: Health care providers (as defined in 78B-3-403) and their third-party record services.
Patient access to medical records: fee waiver for indigent individuals. Utah Code 78B-5-618(13)
In force · effective · read October 3, 2026 · source(le.utah.gov)
shall waive all fees under this section for an indigent individual.
Who it binds, in our words: Health care providers and their third-party record services; indigent means household income at or below 100% of the federal poverty level.
Patient access to medical records: deadline for patient copies. Utah Code 78B-5-618(4)(a)
In force · effective · read October 3, 2026 · source(le.utah.gov)
shall provide the copy within the deadlines required by the Health Insurance Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec. 164.524(b);
Who it binds, in our words: Health care providers giving a copy to the patient or personal representative.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute 26B-3-108(2)(b)(iv) sets opt-out for Medicaid enrollees; UHIN policy covers others. UHIN page publishes a notarized opt-out form. The 2019 state Medicaid HIT plan calls cHIE state-designated but describes opt-out only for Medicaid and public employees, and opt-in for others.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Clinical Health Information Exchange (cHIE), operated by Utah Health Information Network (UHIN).
UHIN cHIE patient information and participation policy. UHIN, For Patients (cHIE participation)
If you do not want your information to be available through the CHIE, or if you have not been participating with the CHIE but now want your information to be included, you may change your CHIE participation status.
Who it binds, in our words: Patients whose providers contribute data to the Utah cHIE. Opt-out needs a signed, notarized form mailed to the CHIE.
Duty to establish standards for the electronic exchange of clinical health information. Utah Code 26B-8-411(3)(d)
In force · effective · read October 3, 2026 · source(le.utah.gov)
An electronic exchange of clinical health information by a health care provider, a third party payer, the department, a local health department, or a qualified network is a disclosure for treatment, payment, or health care operations
Who it binds, in our words: Health care providers, third party payers, the department, local health departments and qualified networks. The statute sets no consent rule.
26B-3-108(2)(b)(iv)
In force · effective · read October 3, 2026 · source(le.utah.gov)
a person receiving Medicaid services shall participate in the electronic exchange of clinical health records established in accordance with Section 26B-8-411 unless the individual opts out of participation;
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports held by the state health department. No separate rule on disclosure of reproductive records by providers was found in this search.
Physician's report to department on abortions: confidentiality. Utah Code 76-7-313(4)
In force · effective · read October 3, 2026 · source(le.utah.gov)
All information supplied to the department shall be confidential and privileged pursuant to Section 26B-1-229.
Who it binds, in our words: Abortion reports, affidavits and pathologist reports that physicians file with the Department of Health and Human Services.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure needs the person's consent, a purpose under the part, or a court order. Unauthorized disclosure is a class B misdemeanor.
Confidentiality of information and records: Utah State Hospital and other mental health facilities. Utah Code 26B-5-312
In force · effective · read October 3, 2026 · source(le.utah.gov)
All certificates, applications, records, and reports made for the purpose of this part, including those made on judicial proceedings for involuntary commitment, that directly or indirectly identify a patient or former patient or an individual whose commitment has been sought under this part, shall be kept confidential
Who it binds, in our words: Records made under Title 26B, Chapter 5, Part 3 (state hospital, mental health facilities, commitment). Disclosure allowed with consent, to carry out the part, or by court order.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV and AIDS are named communicable diseases, so 26B-7-217 limits release of health department information about them, including in legal proceedings.
Information regarding communicable or reportable diseases confidentiality. Utah Code 26B-7-217(1)(b)
In force · effective · read October 3, 2026 · source(le.utah.gov)
The department and local health departments may not release or make public that information upon subpoena, search warrant, discovery proceedings, or otherwise, except as provided by this section.
Who it binds, in our words: Disease information held by the state and local health departments; written consent is one listed release route.
Reporting AIDS and HIV infection. Utah Code 26B-7-203(3)
In force · effective · read October 3, 2026 · source(le.utah.gov)
Acquired Immunodeficiency Syndrome and Human Immunodeficiency Virus infection are considered communicable and infectious diseases.
Who it binds, in our words: Applies for Sections 26B-7-201 through 26B-7-223, bringing HIV and AIDS within 26B-7-217.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Two parts of Chapter 13-60: consent rules for consumer genetic testing companies, and limits on health insurer access to private genetic information.
Genetic Information Privacy Act: prohibited disclosures. Utah Code 13-60-105
In force · effective · read October 3, 2026 · source(le.utah.gov)
A direct-to-consumer genetic testing company may not disclose a consumer's genetic data without the consumer's written consent to:
Who it binds, in our words: Direct-to-consumer genetic testing companies; disclosures to insurers or employers.
Genetic testing privacy: restrictions on health insurers. Utah Code 13-60-205
In force · effective · read October 3, 2026 · source(le.utah.gov)
access or otherwise take into consideration private genetic information about an asymptomatic individual;
Who it binds, in our words: Insurers offering health care insurance, in offers, renewals, premiums and underwriting.
Signed, not yet in force · effective · read October 3, 2026 · source(le.utah.gov)
remote access to genetic sequencing data storage, other than open data, by a person
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The only private right found is for genetic information under 13-60 Part 2, one narrow category. The consumer privacy act bars private suits, and genetic testing company rules are enforced by the attorney general.
Damages a court may award: Against an insurer or employer, per violation: actual damages; $100,000 if intentional and willful, or punitive damages if malicious; reasonable attorney fees (13-60-206(2)).
Genetic testing privacy: private right of action. Utah Code 13-60-206
In force · effective · read October 3, 2026 · source(le.utah.gov)
An individual whose legal rights arising under this part have been violated after June 30, 2003, may recover damages and be granted equitable relief in a civil action.
Who it binds, in our words: Rights under Title 13, Chapter 60, Part 2 (genetic testing privacy as to insurers and employers).
Utah Consumer Privacy Act: no private cause of action. Utah Code 13-61-305
In force · effective · read October 3, 2026 · source(le.utah.gov)
A violation of this chapter does not provide a basis for, nor is a violation of this chapter subject to, a private right of action under this chapter or any other law.
Who it binds, in our words: Utah Consumer Privacy Act.
Genetic Information Privacy Act: attorney general enforcement. Utah Code 13-60-106
In force · effective · read October 3, 2026 · source(le.utah.gov)
The attorney general may enforce this part.
Who it binds, in our words: Part 1 of Chapter 13-60 (direct-to-consumer genetic testing companies); $2,500 per violation.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition of personal information lists no medical or health insurance data. Notice is without unreasonable delay. AG and Utah Cyber Center notice at 500 residents. Entities following their own state or federal regulator's breach rules are deemed compliant.
Deadline to tell people: in the most expedient time possible without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Protection of Personal Information Act: definitions. Utah Code 13-44-102(4)
In force · effective · read October 3, 2026 · source(le.utah.gov)
"Personal information" means a person's first name or first initial and last name, combined with any one or more of the following data elements relating to that person
Who it binds, in our words: Listed elements are Social Security number, financial account or card number with access code, and driver license or state ID number. No medical or health insurance data.
Disclosure of system security breach. Utah Code 13-44-202
In force · effective · read October 3, 2026 · source(le.utah.gov)
regulator is considered to be in compliance with this part if the person notifies each affected Utah resident in accordance with the other applicable law in the event of a breach.
Who it binds, in our words: Persons owning or licensing computerized personal information of Utah residents. Attorney General and Utah Cyber Center notice when 500 or more residents affected.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. You must be told when AI is used in your care.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is in force under 13-77-103 and 13-72a-203. S.B. 319 adds insurer AI disclosure and an independent-judgment rule for adverse preauthorization decisions from 2027-01-01. No AI-specific human recourse rule found.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): 13-72a-201(1): "A supplier of a mental health chatbot may not sell to or share with any third party any:" individually identifiable health information or user input of a Utah user
Related limit on AI (recorded, not counted in the answer): 13-72a-202(2): "A supplier of a mental health chatbot may not use a Utah user's input to:" target or customize advertising
Generative AI: required disclosures in regulated occupations. Utah Code 13-77-103(2)
In force · effective · read October 3, 2026 · source(le.utah.gov)
prominently disclose when an individual receiving services is interacting with generative artificial intelligence in the provision of regulated services if the use of generative artificial intelligence constitutes a high-risk artificial intelligence interaction; and
Who it binds, in our words: Individuals in occupations licensed or certified by the Department of Commerce. 13-77-101(5) defines high-risk interactions to include health data and "medical advice or services; or" mental health advice.
In force · effective · read October 3, 2026 · source(le.utah.gov)
medical advice or services; or
Who it binds, in our words: Defines high-risk artificial intelligence interaction for 13-77-103.
Mental health chatbots: disclosure requirements. Utah Code 13-72a-203
In force · effective · read October 3, 2026 · source(le.utah.gov)
A supplier of a mental health chatbot shall cause the mental health chatbot to clearly and conspicuously disclose to a Utah user that the mental health chatbot is an artificial intelligence technology and not a human.
Who it binds, in our words: Suppliers of generative AI chatbots that offer or appear to offer mental health therapy to Utah users.
Preauthorization: AI disclosure to enrollees (S.B. 319, 2026, Ch. 240). Utah Code 31A-22-650(3) (effective 2027-01-01)
Signed, not yet in force · effective · read October 3, 2026 · source(le.utah.gov)
An insurer shall disclose to the department, to each health care provider in the insurer's network, and to each enrollee if the insurer uses artificial intelligence in the insurer's processes for reviewing an authorization request.
Who it binds, in our words: Insurers with preauthorization requirements (insurer as defined in 31A-22-634).
Preauthorization: adverse determinations by an individual using independent judgment (S.B. 319, 2026, Ch. 240). Utah Code 31A-22-650(6)(e) (effective 2027-01-01)
Signed, not yet in force · effective · read October 3, 2026 · source(le.utah.gov)
An insurer shall ensure that an adverse preauthorization determination regarding clinical or medical necessity is made by an individual who:
Who it binds, in our words: Insurers; the individual must exercise independent medical judgment and "does not rely solely on recommendations from any other source."
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.4%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
97.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
91.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
5.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$86,833 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
3.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
15.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
7.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
