HIPAA Compliance Guide for Salt Lake City, Utah

Salt Lake City is a major healthcare hub in the Mountain West, serving a metro population exceeding 1.4 million. The healthcare sector is a significant economic contributor with over 75,000 healthcare professionals. Salt Lake City's healthcare infrastructure includes major academic medical centers, integrated delivery networks, and specialized care providers serving the Intermountain region.

Major Healthcare Systems

• Intermountain Health (major regional integrated delivery system)
• University of Utah Health (academic medical center and research)
• IHC Health Services (part of Intermountain Health)
• Primary Children's Hospital (pediatric specialty)
• National Ability Center (specialty rehabilitation and behavioral health)
• Numerous independent practices and specialty centers

Overview

The Utah Consumer Privacy Act (Utah Code § 13-61-101 et seq.), effective December 1, 2024, provides comprehensive privacy rights for consumers. While healthcare PHI is subject to HIPAA, the UCPA applies to non-health personal data collected by healthcare organizations.

Key Requirements for Healthcare Providers

• Right to access personal information held by businesses
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt-out of targeted advertising
• Right to opt-out of automated decision-making
• Right to obtain data portability
• Transparency about data collection and use practices

Application to Healthcare

The UCPA applies to healthcare organizations' collection of non-PHI personal data, including browsing behavior, device identifiers, financial information, and demographic data. HIPAA PHI remains exempt, but healthcare organizations must comply with UCPA for all other personal information.

Health Information Exchange Requirements

Utah has established regulations for health information exchange and data governance through the Utah Department of Health and Human Services. Healthcare providers must:

• Comply with Utah health information exchange standards
• Participate in authorized HIE networks
• Maintain audit trails for all health information access
• Implement encryption for health data in transit
• Follow Utah-specific data governance requirements

Medical Records Requirements

• Patient access to medical records within 30 days
• Right to request amendments
• Records retention per standard of care and statutory requirements
• Reasonable copying fees allowed

Requirements

Utah's data breach notification law (Utah Code § 13-44-201) requires notification of security breaches:

• Notification to affected individuals "without unreasonable delay"
• Written notice describing breach and protective measures
• Notice to consumer reporting agencies when appropriate
• Media notification if breach affects more than 500 Utah residents

Security Requirements

Entities must implement reasonable security measures to protect personal information, including encryption and access controls.

Utah's Attorney General has pursued healthcare privacy violations:

• Healthcare Data Breaches: Multiple investigations into healthcare providers' inadequate security infrastructure
• Ransomware Attacks: Several enforcement cases following healthcare system compromises
• Medical Identity Theft: Cases involving unauthorized access to patient records
• Health Information Exchange Violations: Cases involving improper disclosure through HIE networks

1. UCPA Compliance Program

Assess your organization's collection of non-PHI personal data. Develop policies addressing consumer rights under UCPA including access, deletion, correction, and opt-out rights. Update your privacy policy to address UCPA obligations.

2. Health Information Exchange Participation

If participating in Utah HIE networks, ensure compliance with Utah health information exchange standards. Maintain audit trails for all HIE access. Implement encryption for data in transit. Train staff on proper HIE usage and patient authorization requirements.

3. Medical Records Access Procedures

Establish procedures to respond to patient records requests within 30 days. Implement systems to track requests and responses. Develop fee schedules for copying and certifications. Document all requests and responses.

4. Data Security Program

Implement comprehensive data security including encryption, access controls, and audit logging. Document all security measures. Ensure compliance with both HIPAA and Utah data breach notification law requirements.

5. Breach Response Planning

Utah requires notification "without unreasonable delay." Develop a breach response plan including investigation, notification, and credit monitoring. Maintain relationships with legal counsel for breach coordination.