Health information in Utah is governed by federal HIPAA rules together with a layer of state statutes that go further in several areas. Utah HIPAA laws, as the combined framework is commonly called, give you rights to see your records, limit what employers and insurers can do with genetic data, set deadlines for breach notices, and define what providers can charge when you or your attorney request copies. Where federal and state rules overlap, the one that gives you more privacy protection is the one your provider must follow.
Who the Rules Apply To
HIPAA reaches three categories of “covered entities”: healthcare providers who transmit information electronically, health plans (including Medicare and Medicaid), and healthcare clearinghouses that process claims data.1U.S. Department of Health and Human Services. Covered Entities and Business Associates It also reaches “business associates” — outside vendors like billing companies, cloud storage providers, and IT contractors that handle patient data on a provider’s behalf. A provider working entirely on paper and never filing electronic claims is technically outside HIPAA, but that is now rare.
How Federal and State Rules Fit Together
HIPAA does not override state laws that give patients more privacy than the federal baseline. If a Utah statute prohibits a disclosure HIPAA would allow, the Utah statute controls, and providers must apply whichever rule is more protective of you.2U.S. Department of Health and Human Services. Preemption of State Law This matters most in Utah’s handling of medical record access, genetic data, and substance use records, where the state (or another federal rule) adds requirements on top of HIPAA.
Getting Copies of Your Medical Records
Both HIPAA and Utah Code 78B-5-618 give you the right to inspect and obtain copies of your records. The timelines and fees differ depending on who is making the request.
When You Request Your Own Records
Your provider must act on your request within 30 days. If more time is needed, the provider may take one 30-day extension, but only after sending you a written explanation and the expected completion date.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Utah’s statute defers to these HIPAA deadlines for patient requests.4Utah Legislature. Utah Code 78B-5-618 – Patient Access to Medical Records
The provider can charge only a reasonable, cost-based fee covering supplies, labor, and postage if you ask for mailed copies. Search fees, retrieval charges, and administrative markups are not allowed for patient requests.4Utah Legislature. Utah Code 78B-5-618 – Patient Access to Medical Records Access can be denied for psychotherapy notes and information compiled for legal proceedings.3eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
When Your Attorney or Another Third Party Requests Them
Utah’s own fee schedule takes over for third-party requests. The statute sets base rates that the state treasurer adjusts for inflation each January:
- Locating fee: $30 per request
- Paper copies: up to 53 cents per page for the first 40 pages, then 32 cents per page
- Certification: $20 if certified duplicates are needed
- Expedited processing: an added $20 if records are postmarked or made available within 15 days
After the most recent inflation adjustment, the locating fee runs about $36.53, with per-page rates of roughly $0.65 for the first 40 pages and $0.39 afterward. Electronic copies are charged at 50 percent of the paper per-page rate, and the total fee is capped at approximately $183 per request regardless of volume.5Utah State Courts. Patient / Third Party Access to Medical Records
Providers have 30 days to fulfill a third-party request. Miss that deadline and Utah law automatically cuts the fee in half; records delivered after 60 days must be provided free.4Utah Legislature. Utah Code 78B-5-618 – Patient Access to Medical Records The built-in penalty gives providers a strong incentive to respond promptly.
Records of a Deceased Family Member
If a patient has died, Utah law allows a surviving spouse or adult child to act as a personal representative for purposes of requesting the records, both under state law and under HIPAA.6Utah Legislature. Utah Code 78B-5-619 – Access to Medical Records of Deceased Patient
How Long Providers Keep Your Records
Licensed hospitals in Utah must keep medical records for at least seven years. For minors, records must be kept until the patient turns 22 (age 18 plus four), but never less than seven years from the last date of treatment.7Utah Office of Administrative Rules. Utah Administrative Code R432-100 – General Hospital Standards A child treated at 16, for example, would have records held until age 23 under the seven-year rule. Private clinics generally follow the same framework. Once the retention period ends, providers may destroy records through secure methods, and they have no obligation to reconstruct them. If you may need older records, request copies well before the clock runs out.
Genetic Information Protections in Utah
Utah treats genetic data as its own, more sensitive category. Employers must comply with the Genetic Testing and Procedure Privacy Act in Title 13, Chapter 60, Part 2 for all matters involving genetic testing and private genetic information.8Utah Legislature. Utah Code 34A-11-102 In practice that means employers cannot require applicants or employees to submit to genetic testing and cannot use genetic information in hiring, firing, or benefits decisions. Health insurers face similar restrictions. Intentional violations can carry civil fines of up to $25,000 per violation, plus the attorney general’s investigation and litigation costs.
There is an important gap. Utah’s genetic privacy rules do not extend to life insurance, disability income insurance, or long-term care insurance. The federal Genetic Information Nondiscrimination Act leaves those same categories uncovered, so there is no federal backstop. If you are applying for life, disability, or long-term care coverage, assume your genetic information can be considered in underwriting.
Substance Use Disorder Records
Federal law adds a stricter layer for substance use disorder treatment records under 42 CFR Part 2. These protections apply to any federally funded program that provides substance use disorder diagnosis, treatment, or referral. A provider generally cannot disclose that you are or were in such a program without specific written consent, even to other healthcare providers. If Utah law adds further restrictions, the stricter rule applies; if Utah law would permit a disclosure that Part 2 prohibits, the federal restriction wins.9eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Notice When Your Records Are Breached
When a breach of unsecured protected health information occurs, HIPAA requires the covered entity to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice must describe what happened, what types of information were exposed, steps you should take to protect yourself, and what the provider is doing in response.10eCFR. 45 CFR 164.404 – Notification to Individuals Breaches affecting 500 or more people must also be reported to the Secretary of HHS within that same window. Smaller breaches can be reported annually, within 60 days after year-end.
Utah’s Protection of Personal Information Act adds a state layer. Any organization that holds personal information of Utah residents must investigate a suspected breach and, if misuse has occurred or is likely, notify every affected resident as quickly as possible. When 500 or more Utah residents are affected, the organization must also notify the Utah Attorney General’s Office and the Utah Cyber Center. Utah government entities face a shorter deadline: notification to the AG and Cyber Center within five days of discovery.11Utah Cyber Center. Need to Report a Breach?
Filing a Privacy Complaint
If you believe a covered entity or business associate violated your privacy rights under HIPAA, you can file a complaint with the federal Office for Civil Rights through its online portal.12U.S. Department of Health and Human Services – Office for Civil Rights. Office for Civil Rights Complaint Portal You will need to name the entity involved and describe what happened. Complaints must be filed within 180 days of when you knew or should have known about the violation, though the Secretary of HHS may waive that deadline for good cause.13eCFR. 45 CFR 160.306 – Complaints to the Secretary Complaints can also be filed by mail.14U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint A Part 2 complaint for substance use disorder records goes through the same OCR portal.
OCR may require the entity to take corrective action, enter into a resolution agreement, or face civil monetary penalties. Investigations often take several months. For issues that fall under state rather than federal jurisdiction, the Utah Department of Health and Human Services handles regulatory complaints; you can reach customer service at 801-538-4580 to confirm the right filing path.
What a Violation Can Cost the Provider
HIPAA civil penalties follow a four-tier structure based on culpability, from “did not know” at the low end up to willful neglect that was not corrected at the high end. Base penalties range from $100 to $50,000 per violation with a $1.5 million annual cap for identical violations, and the minimum rises at each tier. These amounts are adjusted upward for inflation each year, so actual penalties run higher than the base figures in the statute.15eCFR. 45 CFR 160.404 – Amount of a Civil Money Penalty
Criminal penalties apply when someone knowingly obtains or discloses protected health information in violation of HIPAA. Fines reach $50,000 and a year in prison for knowing violations, $100,000 and five years for offenses under false pretenses, and $250,000 and ten years for conduct aimed at personal gain or malicious harm. Most enforcement actions also impose a corrective action plan requiring the provider to overhaul its privacy and security practices, often under monitoring for years.