AI-generated summary, not yet reviewed by Better Utah staff. Please consult the bill text.

The Utah Health Data Authority, which manages how the Department of Health and Human Services collects and shares health information, would see several updates to its rules under this bill. It replaces the department's single health data plan with three separate plans — a strategic plan, a data management plan, and a data analytics plan — and adds new security requirements, including encryption of identifiable health data and adoption of federal privacy safeguards, along with a formal definition of "direct identifiers" (such as names, addresses, and social security numbers) that must generally be stripped out before data is shared. The bill expands who the department can share health data with, allowing disclosure within the department and to local health departments, local mental health authorities, and local substance abuse authorities, so long as direct identifiers are removed, while also adding a new prohibition on attempting to re-identify individuals from anonymized data. It restructures the All Payer Claims Database provisions, formally naming the database and adjusting rules on cost and reimbursement data collection, and removes several existing reporting requirements, including an annual privacy report to the Legislature and a one-time review of outdated data-collection mandates. Finally, the bill extends the scheduled repeal of the Health Data Authority from 2026 to 2036 and sets a new 2036 repeal date for the Health Data Committee that oversees it.