 |
Utah Administrative Code (Current through November 1, 2019) |
 |
R384. Health, Disease Control and Prevention, Health Promotion |
|
|
R384-203. Prescription Drug Database Access |
| R384-203-1. Authority and Purpose |
|
Latest version.
|
|
This rule establishes procedures and application processes pursuant to Title 58-37f-301(2)(f) for Utah Department of Health Executive Director to allow access to the Prescription Drug database by a designated and assigned person to conduct scientific studies regarding the use or abuse of controlled substances, who is not an employee of the Department of Health. |
| R384-203-2. Definitions |
|
Latest version.
|
|
The following definitions apply to this rule: (1) "Department" means the Utah Department of Health. (2) "Director" means the Utah Department of Health Executive Director. (3) "Prescription Drug Database" means the Utah Controlled Substance Database. (4) "Research facility" means a research facility associated with a university or college in the state accredited by one or more regional or national accrediting agencies recognized by the United States Department of Education. (5) "Institutional Review Board" means a board that is approved for human subject research by the United States Department of Health and Human Services. (6) "Designee" means a person designated and assigned by the Director to have access to data from the Prescription Drug database in order to conduct scientific studies regarding the use or abuse of controlled substances, who is not an employee of the Department. (7) "Business associate" means a business associate as defined under the HIPAA privacy, security, and breach notification rules in 45 CFR 164.502(a), 164.504(e), and 164.532(d) and (e). (8) "De-identified" means information as defined in 45 CFR 164.502(d) and 164.514(a), (b), and (c). |
| R384-203-3. Criteria for Application to Access Prescription Drug Database |
|
Latest version.
|
|
(1) The study must fit within the responsibilities of the Department for health and welfare. (2) De-identified prescriber, patient and pharmacy data will meet the research needs. (3) The research facility designee must provide: (a) written assurances that the studies are not conducted for and will not be used for profit or commercial gain; (b) written assurances that the designee shall protect the information as a business associate of the Department of Health; and (c) documentation of an Institutional Review Board approval. |
| R384-203-4. Research Application Process |
|
Latest version.
|
|
(1) The research facility designee will prepare and submit for Department approval an application as designated by the Department detailing explicit information regarding the scientific studies to be conducted including the: (a) purpose of the study; (b) research protocol for the project; (c) description of the data needed from the database to conduct that research; (d) plan that demonstrates all database information will be maintained securely, with access being strictly restricted to the designee and research study staff; and (e) provisions for electronic data to be stored on a secure database computer system with access being strictly restricted to the designee and research study staff. (2) Application will be reviewed by the Department's Institutional Review Board and recommendation made to the director for or against approval. (3) Director will determine approval status of the application. |
| R384-203-5. Data Provision and Fees |
|
Latest version.
|
|
(1) Department will send signed copy of application and Institutional Review Board approval to the Division of Occupational and Professional Licensing (DOPL). (2) DOPL will de-identify and provide the data set requested in the application, unless a written agreement is signed by DOPL requesting the Department to provide the data set. (2) Research facility and designee shall pay all relevant expenses for data transfer, manipulation, and analysis. |
| R384-203-6. Audit Provisions |
|
Latest version.
|
|
Research facility and designee shall submit, upon request, to a Department audit of the recipients' compliance with the terms of the data sharing agreement. |