Utah Privacy Laws for Primary Immunodeficiency Clinics: A Practical Guide

Primary immunodeficiency clinics handle sensitive information about diagnoses, immune function, treatment, laboratory results, and sometimes genetic testing. Your privacy obligations depend on the clinic’s role and the type of information involved—not simply on the fact that it provides specialty care.

This guide explains the main federal and Utah rules clinics should consider. It is a practical overview, not a substitute for advice about a clinic’s specific operations.

Which privacy laws apply to Utah primary immunodeficiency clinics?

HIPAA applies to a clinic if it is a HIPAA covered entity. A health care provider generally qualifies when it conducts certain standard electronic transactions, such as electronic claims or payment transactions. A clinic that does not qualify as a covered entity may still have obligations through another role, such as a business associate handling information for a covered entity. HHS guidance on covered entities and business associates

For covered clinics, HIPAA’s Privacy, Security, and Breach Notification Rules govern how the clinic handles identifiable health information. Utah law also matters, including state requirements for reporting certain communicable diseases and state provisions addressing some uses of genetic information.

Additional federal protections can apply to particular records. For example, 42 CFR Part 2 applies to qualifying substance use disorder treatment programs and records; it does not automatically apply to every medical record held by an immunology clinic. Identify which laws apply to your organization and which apply to specific records before setting policies or responding to disclosure requests.

How does HIPAA protect patient information?

HIPAA protects identifiable health information held or transmitted by a covered entity or its business associates. This includes diagnoses, immune-system testing, infusion and medication records, billing details, and other information that identifies a patient. HIPAA calls this protected health information (PHI).

The Privacy Rule limits how covered entities may use or disclose PHI and gives individuals rights over their information. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Clinics should limit workforce access according to job responsibilities, train staff on clinic policies, secure records, and use appropriate written agreements with business associates.

The minimum necessary standard generally requires reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the purpose. It does not apply to disclosures to or requests by health care providers for treatment, among other exceptions. HHS guidance on the minimum necessary requirement

A covered clinic must also provide a notice of privacy practices that explains its permitted uses and disclosures, patient rights, and privacy responsibilities. The notice informs patients; it is not a blanket consent form for every use of their information. HHS guidance on notices of privacy practices

When may clinics use or disclose health information?

HIPAA generally permits a covered clinic to use or disclose PHI for treatment, payment, and health care operations without obtaining a separate written authorization. Treatment includes coordinating care and consulting with other providers. Payment and operations include activities such as billing and certain quality-improvement work. HHS guidance on treatment, payment, and health care operations

HIPAA also permits some disclosures in other circumstances, including disclosures required by law and certain disclosures to public health authorities. For uses or disclosures that are not otherwise permitted or required, the clinic generally needs a valid written authorization that identifies the information, recipient, purpose, and expiration. HHS explanation of consent and authorization

Before releasing information, staff should identify the purpose, recipient, applicable legal permission, and any stricter protection that applies to the record. A patient’s general agreement to treatment is not the same as a HIPAA authorization for a disclosure that requires one.

What rights do patients have to access medical records?

Patients generally have the right to inspect and receive copies of medical and billing information in a covered clinic’s designated record set, subject to limited exceptions. They can usually submit a request through the clinic’s medical records or privacy office, following the clinic’s stated process. HHS guidance on access to medical records

A clinic generally must act on an access request within 30 calendar days. If it needs more time, it may take one additional 30-day period after giving the patient a written explanation and expected completion date within the initial period. HHS guidance on access-request deadlines

Patients may also request an amendment to information they believe is inaccurate or incomplete and may request an accounting of certain disclosures. Clinics should explain how to make these requests in their notice of privacy practices and follow the applicable response procedures.

How does Utah law protect genetic information?

Genetic test results held by a covered clinic may be PHI when they identify a patient. HIPAA protections therefore apply to identifiable genetic information in the same way they apply to other PHI. HIPAA does not, however, make a separate written authorization necessary for every use or disclosure; the applicable permission depends on the purpose and any other law that applies.

Utah’s genetic information statutes address particular settings rather than creating a universal written-consent rule for every clinical genetic test. For example, Utah law restricts certain employer uses of private genetic information in employment decisions and places limits on health insurers’ use of genetic information about asymptomatic individuals, subject to statutory exceptions. Utah Code Section 13-60-204 on employer restrictions and Utah Code Section 13-60-205 on health-insurer restrictions

Separate Utah provisions regulate direct-to-consumer genetic testing companies. A clinic should determine whether such provisions apply to a service or vendor rather than assuming that every provider or clinical laboratory is covered by the same rules. Utah Code Title 13, Chapter 60

Which records have additional confidentiality protections?

Some records receive protections beyond HIPAA’s general rules. Substance use disorder records maintained by a qualifying federally assisted program may be subject to 42 CFR Part 2. The rule generally restricts disclosure of information that would identify someone as having received substance use disorder services, subject to specified permissions and exceptions. The updated Part 2 rule has required compliance since February 16, 2026. HHS overview of Part 2 confidentiality protections

Psychotherapy notes kept separately by a mental health professional also receive special HIPAA treatment and generally require a specific authorization for disclosure, with limited exceptions. Ordinary clinical notes about a patient’s care are not automatically psychotherapy notes merely because they concern mental health. 45 CFR 164.508 on uses and disclosures requiring authorization

For a primary immunodeficiency clinic, these protections may matter if the clinic holds records created by a separate treatment program or receives specially protected records from another provider. Staff should preserve the source and status of such records and check the applicable rules before using or redisclosing them.

What communicable disease reporting duties apply to clinics?

Utah law requires health care providers and certain clinics, dispensaries, and laboratories to report specified communicable diseases or suspected cases to the state or local health department as required by rule. The reporting duty depends on the condition and the clinic’s role; a primary immunodeficiency diagnosis by itself does not mean every patient or infection is reportable. Utah Code Section 26-6-6 on communicable disease reporting

Utah’s reporting timeframes depend on the condition. The state’s current guidance identifies some conditions as immediately notifiable by telephone within 24 hours of a suspected diagnosis and gives a three-working-day timeframe for other reportable events. The state updated its Communicable Disease Rule effective June 1, 2026, so clinics should check the current condition list and reporting instructions rather than rely on an old schedule. Utah Department of Health and Human Services disease-reporting guidance and Utah State Bulletin documenting the rule’s June 1, 2026 effective date

HIPAA permits disclosures required by law, so a clinic does not generally need a patient’s written authorization before making a legally required public health report. Report only through the authorized channels and follow applicable confidentiality and security procedures. HHS guidance on public health disclosures

In practice, a clinic should map which privacy rules apply to its organization and records, limit access and disclosures appropriately, explain patient rights in its notice, and maintain a process for timely reporting of conditions on Utah’s current list.

FAQs

Does HIPAA apply to every primary immunodeficiency clinic in Utah?

No. A clinic is generally a HIPAA covered entity if it conducts certain standard electronic transactions, such as electronic claims transactions. A clinic that does not meet the covered-entity definition may still have obligations under other laws or contracts, including as a business associate of a covered entity. HHS guidance on covered entities

Can a clinic disclose patient information without written consent?

Yes, in certain circumstances. HIPAA generally permits disclosures for treatment, payment, and health care operations without a separate written authorization, and it permits or requires certain other disclosures under specific rules. A written authorization is generally needed for disclosures not otherwise permitted or required. Special rules, including Part 2, may impose additional limits.

How can patients request access to their medical records?

Patients can contact the clinic’s medical records or privacy office and follow its request process. They should specify the records they want and their preferred delivery format. A covered clinic generally must act within 30 calendar days, with one possible additional 30-day period if it provides the required written notice of delay.

When must a clinic report a communicable disease?

When the disease or event is on Utah’s current reportable list and the clinic or provider is subject to the applicable reporting rule. Some conditions must be reported by telephone within 24 hours of suspected diagnosis; other reportable events generally have a three-working-day timeframe. Check Utah’s current reporting guidance for the condition-specific deadline and method.