HB 259: Parental Access to Children's Medical Records Amendments - Utah

Substitute #5 → Substitute #6 · 4 edits

MODERATE

This bill update refines the rules for parents accessing their children's medical records by clarifying that facilities can restrict access only to specific portions of records (like sexual assault counseling) rather than the entire file, and it lowers the penalty for non-compliance from $10,000 to $1,000 per day while pushing the effective date to December 31, 2027.

Scope change

The scope of access restrictions was narrowed to allow facilities to block only specific sensitive records rather than denying all access, and the enforcement timeline was extended.

REQUIREMENT

Health care facilities are now permitted to restrict access only to the specific portion of a medical record that is exempt (e.g., sexual assault counseling), rather than restricting access to the entire electronic medical record.

ENFORCEMENT

The civil fine for non-compliance was reduced from $10,000 to $1,000 per day for both health care facilities and software vendors.

TIMELINE

The effective date for the new enforcement penalties was changed from May 1, 2027, to December 31, 2027.

ELIGIBILITY

The criteria for when a parent is precluded from accessing records was expanded to include situations where access is blocked under the new section or HIPAA rules, not just HIPAA alone.

Substitute #4 → Substitute #5 · 5 edits

MODERATE

The bill was amended to add a new funding source (fines from the medical records section) to a disability services account, change the affected Utah Code section number, and significantly expand parental access rights by adding exemptions for emancipated or married minors and sexual assault counseling. Additionally, the effective date for fines was delayed from 2026 to 2027, and the requirements for providing records were made more specific regarding notice and response times.

Scope change

The bill now affects a different Utah Code section (26B-1-335 was added as an amendment target) and expands the definition of when a health care facility can legally restrict a parent's access to a minor's medical records.

FISCAL

Added a new provision creating a restricted account for the Division of Services for People with Disabilities that includes fines collected under the medical records access law.

SCOPE

Changed the Utah Code section affected from 26B-2-244 to include 26B-1-335.

ELIGIBILITY

Expanded the list of exceptions allowing health care facilities to restrict parent access to include cases where the minor is emancipated, legally married, or where the record relates to sexual assault counseling.

TIMELINE

Delayed the start date for civil fines against non-compliant health care facilities and vendors from September 1, 2026, to May 1, 2027.

REQUIREMENT

Updated the requirement for providing paper records to include a specific notice obligation and a five-business-day deadline for providing the records.

Substitute #3 → Substitute #4 · 3 edits

MINOR

The bill adds a new definition for 'health care system' to clarify that fines apply to the parent company if it owns multiple facilities, and changes the fee waiver rule for paper records to apply only when the parent is not otherwise precluded by HIPAA.

Scope change

The bill now explicitly covers 'health care systems' (entities owning multiple facilities) for enforcement purposes, whereas the previous version only mentioned individual facilities.

DEFINITION

Added a new definition for 'health care system' to mean an entity that owns two or more health care facilities.

ENFORCEMENT

Modified the fine enforcement rule so that if multiple facilities owned by the same system are non-compliant, the fine is assessed against the entire health care system as a single entity.

REQUIREMENT

Changed the condition for providing free paper records to require that the parent is 'not otherwise precluded from access' under HIPAA, replacing the previous 'otherwise authorized' language.

Substitute #2 → Substitute #3 · 7 edits

MODERATE

The bill was updated to change the terminology from 'minor' to 'child' and 'parent/legal guardian' to 'parent', while significantly narrowing the exceptions that allow a healthcare facility to restrict access to medical records. The new version removes the ability to restrict access based on a parent's consent or the child's consent to treatment, and adds a specific exemption for sexual assault records. Additionally, the fine for non-compliance was shifted from the software vendor to the healthcare facility itself.

Scope change

The bill's scope was narrowed by removing exceptions that allowed parents to voluntarily waive their access rights or for children to consent to treatment that restricted parental access. It also added a new exemption for records related to sexual assault.

DEFINITION

Changed the term 'minor' to 'child' and 'parent or legal guardian' to 'parent' throughout the text.

ELIGIBILITY

Removed the exception allowing a parent to consent to restricted access to their child's medical records.

Removed the exception allowing a child to consent to treatment that would restrict parental access to records.

Added a specific exception allowing healthcare facilities to restrict access to records related to sexual assault.

REQUIREMENT

Added a new requirement that the bill does not apply to the Utah State Hospital.

ENFORCEMENT

Changed the $10,000 daily fine from applying to the EMRS vendor to applying to the healthcare facility for non-compliance.

Updated enforcement provisions to allow the attorney general to sue both healthcare facilities and EMRS vendors.

Substitute #1 → Substitute #2 · 5 edits

MODERATE

This bill amends Utah law to ensure parents and legal guardians have full access to their minor children's electronic health records, with specific exceptions for situations involving the child's consent, court orders, or specific federal privacy protections. It places the responsibility on both healthcare facilities and the vendors of their electronic record systems to comply with these access rules, backed by civil fines for non-compliance.

Scope change

The bill's scope remains focused on parental access to minors' medical records, but it explicitly extends the compliance requirement to the vendors of electronic medical record systems, not just the healthcare facilities themselves.

REQUIREMENT

Added a specific requirement for electronic medical record system vendors to ensure their software allows parents and guardians access to records, shifting liability to the software providers.

Changed the provision for paper records: the original bill required facilities to provide paper records if a parent was unable to access electronic records; the new bill adds specific conditions, requiring that the system be unable to provide access and that the parent be otherwise authorized under HIPAA.

Updated the citation for child consent exceptions to include the specific code section (45 C.F.R. Sec. 164.502(g)(3)(i)).

Updated the citation for facility-imposed restrictions to include the specific code section (45 C.F.R. Sec. 164.502(g)(5)).

DEFINITION

Updated the citation for 'Personal representative' to include the specific code section (45 C.F.R. Sec. 164.502(g)(1)) to clarify the legal definition.

Amended 2/27/2026 15:02:379 → Substitute #1 · 6 edits

MODERATE

The bill was revised to expand parental access rights by explicitly including legal guardians and adding a consent exception where parents can choose to restrict their own access. The new version also clarifies that facilities cannot condition services on this consent and requires vendors to comply with federal privacy standards. Additionally, the fine for non-compliance was reduced from $10,000 to $1,000 per day, and the effective date was moved up to May 6, 2026.

Scope change

The bill's scope was expanded to explicitly include legal guardians alongside parents and to address scenarios where a parent voluntarily restricts their own access to the medical record.

DEFINITION

Added a definition for 'minor' and 'personal representative' to clarify who is covered under the law.

ELIGIBILITY

Expanded the right to access to include both parents and legal guardians.

REQUIREMENT

Added a new exception allowing a parent or guardian to consent to restricted access, and prohibited facilities from conditioning services on this consent.

Added a requirement that facilities must notify the attorney general if their software vendor cannot program the system to comply with the new access rules.

ENFORCEMENT

Reduced the civil fine for non-compliance from $10,000 to $1,000 per day.

TIMELINE

Changed the effective date from May 6, 2026 to May 6, 2026 (unchanged in text but context implies a revision of the timeline or enforcement start date to September 1, 2026 for vendor compliance).

Amended Excerpts 2/27/2026 15:02:379 → Amended 2/27/2026 15:02:379 · 7 edits

MODERATE

The bill text was completely replaced with a new version that establishes parental access rights to minors' electronic medical records. The new version defines key terms, mandates that healthcare facilities and vendors allow parents to access records (with specific exceptions), requires records to be provided free of charge within five business days, and sets a $1,000 daily civil fine for non-compliance starting December 31, 2027.

Scope change

The bill now explicitly applies to parents of minors under 18, healthcare facilities, and electronic medical record system vendors, whereas the previous text appeared to be unrelated financial provisions.

DEFINITION

New definitions were added for 'child', 'electronic medical record system', 'EMRS vendor', 'health care system', 'HIPAA', and 'parent'.

REQUIREMENT

Healthcare facilities are now required to allow parents access to a child's electronic medical record unless specific exceptions apply, such as terminated parental rights or court orders.

Vendors of electronic medical record systems must ensure their systems can be modified to comply with parental access requirements.

Healthcare facilities must provide medical records to parents without charge and within five business days of a request.

ENFORCEMENT

New enforcement mechanisms include a $1,000 daily civil fine for non-compliance, authority for the attorney general to bring civil actions, and the ability to award attorney fees to the state.

TIMELINE

A compliance deadline of December 31, 2027, was established for the new requirements to take effect.

SCOPE

The previous text, which concerned a 'Division of Services for People with Disabilities Restricted Account' and unrelated budgetary provisions, was removed.

Enrolled → Amended Excerpts 2/27/2026 15:02:379 · 3 edits

MINOR

The bill was amended to increase civil fines from $1,000 to $10,000 per day for non-compliance and to change the effective date from December 31, 2027, to May 1, 2027. The amendment also corrected a cross-reference error in the text, ensuring vendors must ensure systems comply with the parent access rules rather than the modification rules.

Scope change

The scope of enforcement has increased due to significantly higher penalties, and the timeline for compliance has been accelerated by several months.

ENFORCEMENT

Civil fines for non-compliance were increased from $1,000 to $10,000 per day for both health care facilities and EMRS vendors.

TIMELINE

The effective date for the new penalties was moved forward from December 31, 2027, to May 1, 2027.

TECHNICAL

A cross-reference error was corrected to ensure vendors must ensure systems comply with Subsection (2) regarding parent access rights, rather than the unrelated Subsection (3) regarding modifications.

Introduced → Enrolled · 9 edits · Mar 26, 2026

MAJOR

The bill was finalized and expanded to include a Senate sponsor, updated the bill's title and description to reflect new provisions, and added a new section creating a specific state fund. It also strengthened the new medical record access law by adding specific definitions, clarifying when access can be denied, and establishing civil fines and attorney general enforcement powers.

Scope change

The bill's scope was expanded to include a new funding mechanism (Division of Services for People with Disabilities Restricted Account) and clarified that the new medical record access law applies to health care systems owning multiple facilities.

TECHNICAL

Added a Senate Sponsor (Brady Brammer) and updated the bill title and highlighted provisions to include new requirements regarding vendors, enforcement, and free records.

FISCAL

Created a new 'Division of Services for People with Disabilities Restricted Account' that will hold carry-forward funds and fines collected from violations of the new medical record access law.

DEFINITION

Added specific definitions for 'Child', 'Electronic medical record system', 'EMRS vendor', 'Health care system', 'HIPAA', and 'Parent' to clarify the law's application.

REQUIREMENT

Expanded the list of circumstances under which a parent's access to medical records can be restricted (e.g., termination of parental rights, emancipation, court orders, sexual assault counseling).

Imposed a $1,000 per day civil fine on health care facilities and vendors for non-compliance starting December 31, 2027.

Required health care facilities to provide medical records to parents free of charge under certain circumstances and to notify parents if the system cannot provide access.

Required EMRS vendors to ensure their systems can be modified by health care facilities to comply with the new access laws.

ENFORCEMENT

Authorized the Attorney General to bring civil actions against non-compliant facilities or vendors, issue subpoenas, and award attorney fees for successful enforcement.

SCOPE

Clarified that if multiple facilities are owned by one health care system, fines are assessed against the entire system as a single entity.

Parental Access to Children's Medical Records Amendments

What changed between versions

How they voted

Actions timeline

Sponsors