EveryAILaw.com

Requirements at a glance

This regulation imposes 8 specific requirements for Data Governance across 1 provision:

• No sale/sharing — A mental health chatbot supplier may not sell to or share with any third party any individually identifiable health information of a Utah user or user input of a Utah user (§13-72a-201(1))
• Protected objects — Individually identifiable health information means any information, oral or recorded in any form or medium, relating to the physical or mental health or condition of an individual (§13-72a-101(9)). User input means content provided to a mental health chatbot by a Utah user (§13-72a-101(16)), regardless of whether it is health information; a Utah user is located in Utah at access or use (§13-72a-101(15))
• Exception object limit — The exceptions in §13-72a-201(2) apply only to individually identifiable health information, not to user input as a separate protected object; there is no general user-consent exception for all inputs
• Health care provider request — Individually identifiable health information requested by a health care provider with the consent of the Utah user is excepted (§13-72a-201(2)(a))
• Health plan user request — Individually identifiable health information provided to a health plan of the Utah user upon request of the Utah user is excepted (§13-72a-201(2)(b))
• Contracted functionality sharing — A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality (§13-72a-201(2)(c),(3)(a))
• Both-party HIPAA-equivalent controls — Both the supplier and the other entity must comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as defined in 45 C.F.R. 160.103 (§13-72a-201(3)(b))
• Permission limits — The functionality route is a conditional sharing permission, not a general permission to sell, and not a blanket vendor or analytics exception. Retained §13-72a-201 does not establish categorical permission for all aggregate or de-identified analytics; object classification and any claimed transformation require separate authority and review