Bill > HB0259

This bill establishes new rules for parental access to a child's electronic medical records, defining "child" as anyone under 18 and outlining what constitutes an "electronic medical record system" and an "EMRS vendor," which is a company that provides such systems. A "health care system" is defined as an entity owning multiple healthcare facilities, and "HIPAA" refers to the federal Health Insurance Portability and Accountability Act of 1996, which governs patient privacy. The bill states that a healthcare facility cannot deny a parent access to their child's electronic medical record unless the parent's rights have been terminated, a court order dictates otherwise, or the record pertains to a sexual assault. EMRS vendors must ensure their systems can be modified by healthcare facilities to comply with these access rules. Violations by healthcare facilities or EMRS vendors after September 1, 2026, can result in a $10,000 daily civil fine, which can be pursued by the attorney general, who may also issue subpoenas and will be awarded attorney fees if successful in an enforcement action. If multiple facilities within a health care system are non-compliant, the fine applies to the system as a single entity. Additionally, if a parent cannot access a portion of an electronic record due to system limitations and is not otherwise prohibited by HIPAA, the healthcare facility must provide paper records free of charge. These provisions do not apply to the Utah State Hospital and will take effect on May 6, 2026.

Business and Industry

https://le.utah.gov/~2026/bills/static/HB0259.html