DAR File No. 38562
This rule was published in the June 15, 2014, issue (Vol. 2014, No. 12) of the Utah State Bulletin.
Health, Center for Health Data, Health Care Statistics
Health Data Authority Standards for Health Data
Notice of Proposed Rule
(Repeal and Reenact)
DAR File No.: 38562
Filed: 06/02/2014 09:41:58 AM
Purpose of the rule or reason for the change:
These changes are intended to create a consistent set of definitions across all rules used by the office and to pull together requirements regarding penalties, data disclosure, extensions, and exemptions. They also set forth the framework for a coordinated and simplified policy for data disclosure that reflects current Health Data Committee guidelines.
Summary of the rule or change:
Items in the repealed rule that no longer appear: 1) some definitions that duplicate statutory definitions have been removed; and 2) the subsection on data security has been removed. Items in the reenacted rule that are not in the old rule: 1) a subsection on extensions and exemptions; and 2) a subsection clarifying contractor liability. Other changes: 1) create a consistent set of definitions to be used across all of Title R428 rules; 2) clarify the requirements and procedures for data disclosure; 3) clarify penalties applicable under Title R428; 4) clarify the procedure for requesting and granting extensions and exemptions; 5) clarify the liability for complying with this rule when a data supplier uses a contractor; and 6) make other technical and conforming amendments.
State statutory or constitutional authorization for this rule:
- Title 26, Chapter 33a
Anticipated cost or savings to:
the state budget:
This amendment clarifies existing rule language as well as makes technical changes for consistency. The Utah Department of Health (UDOH) determines that these changes will not create any cost or savings impact to the state budget or UDOH's budget, since the changes will not increase workload and can be carried out with existing budget.
This filing does not create any direct cost or savings impact to local governments since they are not directly affected by the rule; nor are local governments indirectly impacted because the rule does not create a situation requiring services from local governments.
None--Small businesses are not impacted by this rule change, with all potentially impacted having more than 50 employees. As a result, the rule will have no effect on small business budgets for costs or savings.
persons other than small businesses, businesses, or local governmental entities:
Minor technical changes, including the clarification of rule language to reflect current policy by the Health Data Committee, will not create any cost or savings to businesses, individuals, local governments or persons that are not small businesses.
Compliance costs for affected persons:
There are no compliance costs for persons affected by these changes to Rule R428-2. Although there are several modifications within this amendment, they simply reflect current practice.
Comments by the department head on the fiscal impact the rule may have on businesses:
No effect on business because it makes no changes in current operations
David Patton, PhD, Executive Director
The full text of this rule may be inspected, during regular business hours, at the Division of Administrative Rules, or at:Health
Center for Health Data, Health Care Statistics
CANNON HEALTH BLDG
288 N 1460 W
SALT LAKE CITY, UT 84116-3231
Direct questions regarding this rule to:
- Mike Martin at the above address, by phone at 801-538-9205, by FAX at 801-538-9916, or by Internet E-mail at email@example.com
- Rex Olsen at the above address, by phone at 801-538-9498, by FAX at 801-536-0940, or by Internet E-mail at firstname.lastname@example.org
- Norman Thurston at the above address, by phone at 801-538-7052, by FAX at 801-237-0787, or by Internet E-mail at email@example.com
Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:
This rule may become effective on:
David Patton, Executive Director
R428. Health, Center for Health Data, Health Care Statistics.
R428-2. Health Data Authority Standards for Health Data.
R428-2-1. Legal Authority. This rule is promulgated under authority granted by Title
26, Chapter 33a.
This rule establishes the reporting standards which apply
to data suppliers, and the classification, control, use, and
release of data received by the committee pursuant to Title 26,
The following definitions apply to all of R428.
A. "Office" means the Office of Health Care
Statistics within the Utah Department of Health, which serves as
staff to the Utah Health Data Committee.
B. "Committee" means the Utah Health Data
Committee created by Section 26-1-7.
C. "Data element" means the specific
information collected and recorded for the purpose of health care
and health service delivery. Data elements include information to
identify the individual, health care provider, data supplier,
service provided, charge for service, payer source, medical
diagnosis, and medical treatment.
D. "Data release, disclosure, or disclose"
means the disclosure or the communication of health care data to
any individual or organization outside the committee, its staff,
and contracting agencies.
E. "Data supplier" means a health care
facility, health care provider, self-funded employer, third-party
payer, health maintenance organization, or government department
required to provide health data under rules adopted by the
F. "Health Data Plan" means the plan developed
and adopted by the Health Data Committee under Chapter 33a, Title
26, Section 104.
G. "Health care provider" means any person,
partnership, association, corporation, or other facility or
institution that renders or causes to be rendered health care or
professional services as a physician, registered nurse, licensed
practical nurse, nurse-midwife, dentist, dental hygienist,
optometrist, clinical laboratory technologist, pharmacist,
physical therapist, podiatrist, psychologist, chiropractic
physician, naturopathic physician, osteopathic physician,
osteopathic physician and surgeon, audiologist, speech
pathologist, certified social worker, social service worker,
social service aide, marriage and family counselor, or
practitioner of obstetrics, and others rendering similar care and
services relating to or arising out of the health needs of
persons or groups of persons, and officers, employees, or agents
of any of the above acting in the course and scope of their
I. "Health data" means information relating to
the health status of individuals, health services delivered, the
availability of health manpower and facilities, and the use and
costs of resources and services to the consumer.
H. "Identifiable health data" means any item,
collection, or grouping of health data that makes the individual
supplying or described in the health data identifiable.
J. "Individual" means a natural
K. "Order" means a committee action that
determines the legal rights, duties, privileges, immunities, or
other interests of one or more specific persons, but not a class
L. "Report" means a compilation, study or data
release developed from resource documents to display information
in a simplified manner and designed to meet the needs of specific
audiences or nontechnical users.
M. "Resource document" means contemplated
tabulation formats defined in the Health Data Plan to display
information, documents, or records containing measures relating
to health care. These documents are classified as standard,
special, and electronic.
R428-2-4. Technical Assistance.
The Office may provide technical consultation to a data
supplier upon request and resource availability. The consultation
shall be to enable a data supplier to submit health data
according to R428.
R428-2-5. Data Classification and Access Requirements.
A. The Utah Health Data Authority Act, Section 108,
specifically classifies all data, information, reports,
statements, memoranda, or other data received by the committee as
"strictly confidential." This strict classification
means the committee's data are not public, and as such are
exempt from the Classification and Release Requirements specified
in the Government Records Access And Management Act, Chapter 2,
Title 63, Utah Code Annotated. The committee shall establish
guidelines for the protection, use and release of the
B. Persons having access to data under control of the
committee shall not:
1. take any action that might provide information to any
unauthorized individual or agency;
2. scan, copy, remove, or review any information to which
specific authorization has not been granted;
3. discuss information with unauthorized persons which
could lead to identification of individuals;
4. give access to any information by sharing passwords or
file access codes.
C. Any person having access to data under control of the
1. maintain the data in a safe manner which restricts
2. limit use of the data to the purposes for which access
3. report immediately any unauthorized access.
D. A failure to report known violations by others of
responsibilities specified in 3 and 4 above is subject to the
same punishment as a personal violation.
E. The Office shall deny a person access to the
facilities, services and data as a consequence of any violation
of the responsibilities specified in R428-2-5(C) and R428-2-5(D)
F. The committee may, pursuant to Chapter 33a, Title 26,
Section 110, subject the person to legal prosecution for any
unauthorized use, disclosure, or publication of its
The Office shall implement procedures protecting data
confidentiality. These procedures shall secure the
committee's health data against unauthorized access.
R428-2-7. Editing and Validation.
A. The data supplier shall review each health data record
prior to submission. The review shall consist of checks for
accuracy, consistency, completeness, and conformity.
B. The Office may subject health data to edit checks. The
Office may require the data supplier to correct health data
failing an edit check. The data supplier may perform data
validation before public disclosure.
1. The Office may, by first class U.S. mail or email,
return to the submitting data supplier all health data failing an
edit check. The submitting data supplier shall correct all
returned health data and resubmit all corrected health data to
the Office within 35 calendar days of the date the Office mails
2. Data validation gives the data supplier the right to
review, comment, and provide support for corrections of any
information relating to its activities prior to public release.
The data supplier shall return the validation document to the
Office with comments and support for corrections within 35
calendar days of the date the Office mails the validation
document. If the data supplier fails to return the information
within the 35 day period, the committee may conclude that the
information is correct and suitable for release.
3. The committee may note in its resource documents,
reports, and publications that accurate appraisal of a certain
category or entity cannot be presented because of a failure to
comply with the committee's request for data, edit
corrections, or data validation.
R428-2-8. Error Rates.
The committee may establish and order reporting quality
standards based on non-reporting or edit failure rates.
R428-2-9. Data Disclosure.
A. The committee may release information, compilations,
reports, statements, memoranda, or other data received or derived
from its health data as specified in Chapter 33a, Title 26,
Sections 107, 108, and 109. The Office may disclose the submitted
data as resource documents or reports in either standard,
special, or electronic format. The Office may prepare data for
disclosure annually as standard or special resource documents
specified in the health data plan. If the disclosure identifies a
health care provider, the Office must adhere to the procedures
specified in R428-2-9(B).
B. Prior to any release of a compilation, report, or
resource document in which a health care provider is identified,
the Office shall notify the data supplier and the health care
provider by first class mail or email using the last known
address. The data supplier and health care provider have the
1. review the information to be disclosed and verify the
accuracy of the information contained therein;
2. submit to the Office evidence of errors in the
3. develop written comments or alternate interpretations
to the information reported for inclusion with the
4. return the disclosure notice, evidence of errors, and
comments within 35 calendar days of the date the Office mails the
notice. The committee may interpret the failure to return the
notice of disclosure within the designated time period as
agreement that the reports are acceptable for release in any
format outlined in the Health Data Plan.
5. the Office shall correct data it finds to be in error
and provide data suppliers and health care providers notification
of the corrections subject to the rights specified in
C. The committee may allow exemptions to the notification
procedures specified in R428-2-9(B):
1. The Office may release to the data supplier its data
elements used to create compilations, reports, or resource
documents without notification when a data supplier requests the
data it supplied.
2. The Office may make additional disclosures to other
requesters of compilations, reports, or resource documents
previously reviewed under the procedures specified in
D. The Office may, by its initiative, prepare and
disclose special compilations, reports, studies or analyses
relating to health care cost, quality, access, health promotion
programs, or public health. These actions may be to meet
legislative intent or upon request from individuals, government
agencies, or private organizations.
E. The committee may make data available for disclosure
in computer readable formats.
1. The public data set provides general health care data.
The Director of the Office may approve written requests for the
public data set without approval of the committee. Written
requests must include the following:
a. the name, address, and telephone number of the
b. a statement of the purpose for which the data will be
c. the starting and ending dates for which data are
2. The design of the research oriented data set is for
bona fide research of health care cost, quality, access, health
promotion programs, or public health issues. A research oriented
data set is available by request to the committee. Requests for a
research oriented data set must be accompanied by a completed
request form as established by the committee. Request forms are
included in Technical Manuals that are available from the Office.
The committee requires documentation of the
a. need for the research oriented data set to conduct
bona fide research;
b. intent to use the data to study, promote, or improve
accessibility, quality, or cost-effective health care;
c. integrity and ability to safeguard the data from any
breach of confidentiality;
d. competency to effectively use the data in the manner
e. affiliation with an institutional review board;
f. guarantee that no further disclosure will occur
without prior approval of the Office.
Pursuant to Section 26-23-6, any person that violates any
provision of this rule may be assessed an administrative civil
money penalty not to exceed $3,000 upon an administrative finding
of a first violation and up to $5,000 for a subsequent similar
violation within two years. A person may also be subject to
penalties imposed by a civil or criminal court, which may not
exceed $5,000 or a class B misdemeanor for the first violation and
a class A misdemeanor for any subsequent similar violation within
KEY: health, health policy, health planning
Date of Enactment or Last Substantive Amendment: [
April 26, 2012]
Notice of Continuation: November 30, 2011
Authorizing, and Implemented or Interpreted Law: 26-33a-104
More information about a Notice of Proposed Rule is available online.
The Portable Document Format (PDF) version of the Bulletin is the official version. The PDF version of this issue is available at https://rules.utah.gov/publicat/bull-pdf/2014/b20140615.pdf. The HTML edition of the Bulletin is a convenience copy. Any discrepancy between the PDF version and HTML version is resolved in favor of the PDF version.
Text to be deleted is struck through and surrounded by brackets ([
example]). Text to be added is underlined (). Older browsers may not depict some or any of these attributes on the screen or when the document is printed.
For questions regarding the content or application of this rule, please contact Mike Martin at the above address, by phone at 801-538-9205, by FAX at 801-538-9916, or by Internet E-mail at firstname.lastname@example.org; Rex Olsen at the above address, by phone at 801-538-9498, by FAX at 801-536-0940, or by Internet E-mail at email@example.com; Norman Thurston at the above address, by phone at 801-538-7052, by FAX at 801-237-0787, or by Internet E-mail at firstname.lastname@example.org. For questions about the rulemaking process, please contact the Division of Administrative Rules.