State Security Standards for Personal Health Information

The Division of Medicaid and Health Financing (DMHF) has submitted an amendment to Rule R380-250 in the Utah Administrative Code. This change is necessary to comply with S.B. 20 that was passed during the 2013 General Legislative Session. The bill requires health care providers to provide notice to the patient or the patient's personal representative that the health care provider either has, or may submit, personally identifiable information (PII) about the patient to the Medicaid eligibility database and to the Children's Health Insurance Program (CHIP) eligibility database.

A Medicaid provider or a CHIP provider, therefore, shall not access the Medicaid database or the CHIP eligibility database, unless the provider’s notice of privacy practices contains a statement that the provider either has, or may submit PII about the patient to the Medicaid eligibility database or to the CHIP eligibility database.

DMHF estimates total annual costs to be minimal to comply with this new requirement. There is no data, however, to estimate those costs at this time.

The proposed effective date of this amendment is August 7, 2013.

A copy of this change may be obtained from Craig Devashrayee (801-538-6641), or by writing the Technical Writing Unit, Utah Department of Health, P.O. Box 143102, Salt Lake City, UT 84114-3102. Comments are welcome at the same address. Copies of this change are also available at local county health department offices and are available online at http://www.rules.utah.gov .