Utah Administrative Code

The Utah Administrative Code is the body of all effective administrative rules as compiled and organized by the Division of Administrative Rules (see Subsection 63G-3-102(5); see also Sections 63G-3-701 and 702).

NOTE: For a list of rules that have been made effective since January 1, 2020, please see the codification segue page.

NOTE TO RULEFILING AGENCIES: Use the RTF version for submitting rule changes.

R384. Health, Disease Control and Prevention; Health Promotion.

Rule R384-203. Prescription Drug Database Access.

As in effect on January 1, 2020

Table of Contents

R384-203-1. Authority and Purpose.

This rule establishes procedures and application processes pursuant to Title 58-37f-301(2)(f) for Utah Department of Health Executive Director to allow access to the Prescription Drug database by a designated and assigned person to conduct scientific studies regarding the use or abuse of controlled substances, who is not an employee of the Department of Health.

R384-203-2. Definitions.

The following definitions apply to this rule:

(1) "Department" means the Utah Department of Health.

(2) "Director" means the Utah Department of Health Executive Director.

(3) "Prescription Drug Database" means the Utah Controlled Substance Database.

(4) "Research facility" means a research facility associated with a university or college in the state accredited by one or more regional or national accrediting agencies recognized by the United States Department of Education.

(5) "Institutional Review Board" means a board that is approved for human subject research by the United States Department of Health and Human Services.

(6) "Designee" means a person designated and assigned by the Director to have access to data from the Prescription Drug database in order to conduct scientific studies regarding the use or abuse of controlled substances, who is not an employee of the Department.

(7) "Business associate" means a business associate as defined under the HIPAA privacy, security, and breach notification rules in 45 CFR 164.502(a), 164.504(e), and 164.532(d) and (e).

(8) "De-identified" means information as defined in 45 CFR 164.502(d) and 164.514(a), (b), and (c).

R384-203-3. Criteria for Application to Access Prescription Drug Database.

(1) The study must fit within the responsibilities of the Department for health and welfare.

(2) De-identified prescriber, patient and pharmacy data will meet the research needs.

(3) The research facility designee must provide:

(a) written assurances that the studies are not conducted for and will not be used for profit or commercial gain;

(b) written assurances that the designee shall protect the information as a business associate of the Department of Health; and

(c) documentation of an Institutional Review Board approval.

R384-203-4. Research Application Process.

(1) The research facility designee will prepare and submit for Department approval an application as designated by the Department detailing explicit information regarding the scientific studies to be conducted including the:

(a) purpose of the study;

(b) research protocol for the project;

(c) description of the data needed from the database to conduct that research;

(d) plan that demonstrates all database information will be maintained securely, with access being strictly restricted to the designee and research study staff; and

(e) provisions for electronic data to be stored on a secure database computer system with access being strictly restricted to the designee and research study staff.

(2) Application will be reviewed by the Department's Institutional Review Board and recommendation made to the director for or against approval.

(3) Director will determine approval status of the application.

R384-203-5. Data Provision and Fees.

(1) Department will send signed copy of application and Institutional Review Board approval to the Division of Occupational and Professional Licensing (DOPL).

(2) DOPL will de-identify and provide the data set requested in the application, unless a written agreement is signed by DOPL requesting the Department to provide the data set.

(2) Research facility and designee shall pay all relevant expenses for data transfer, manipulation, and analysis.

R384-203-6. Audit Provisions.

Research facility and designee shall submit, upon request, to a Department audit of the recipients' compliance with the terms of the data sharing agreement.


prescription drug database, controlled substances, substance abuse database

Date of Enactment or Last Substantive Amendment

July 23, 2019

Notice of Continuation

February 25, 2019

Authorizing, Implemented, or Interpreted Law


Additional Information


For questions regarding the content or application of rules under Title R384, please contact the promulgating agency (Health, Disease Control and Prevention; Health Promotion). A list of agencies with links to their homepages is available at http://www.utah.gov/government/agencylist.html or from http://www.rules.utah.gov/contact/agencycontacts.htm.