Utah Specialty EHR Encounter Records: A Guide to Privacy Laws

What privacy laws apply to specialty EHR encounter records in Utah?

Most Utah clinics that conduct covered electronic health care transactions are subject to the HIPAA Privacy Rule. It protects protected health information (PHI)—identifiable information about a person’s health, care, or payment for care—whether it is stored electronically, on paper, or communicated orally. HIPAA also requires appropriate safeguards for electronic PHI. See HHS’s Summary of the HIPAA Privacy Rule.

Utah laws and licensing rules also govern medical records, access, fees, and retention. The HIPAA Privacy Rule establishes a federal baseline; a state law that provides greater privacy protections or access rights may also apply. The rules can differ by provider and facility type, so a specialty clinic should check the requirements that apply to its license and services. HHS explains the relationship between federal and state rules in its guidance on HIPAA and state laws.

Records from qualifying substance use disorder treatment programs may also be governed by 42 CFR Part 2, which has additional confidentiality requirements. Part 2 applies to qualifying programs and records—not automatically to every clinic record that mentions substance use.

What information belongs in an encounter record?

An encounter record should make it clear what care you received, why you received it, what the clinician found, and what happened next. Depending on the specialty and visit, it commonly includes:

• Your identifying information and the date of service.
• The reason for the visit, relevant history, symptoms, allergies, and examination findings.
• Assessment or diagnosis, test results, and the clinician’s interpretation.
• Orders, medications, procedures, referrals, and follow-up instructions.
• Relevant consent documents and the identity of the person documenting or providing care.

These are common documentation elements, not a universal checklist for every specialty encounter. Facility rules may set specific requirements: for example, Utah’s freestanding ambulatory surgical center rule lists records such as patient history, informed consent, procedure findings, medication orders, and discharge instructions. See the Utah Department of Health and Human Services’ freestanding ambulatory surgical center rules.

When is written authorization required to disclose records?

A clinic generally does not need a patient’s written authorization to use or disclose PHI for treatment, payment, or health care operations. For example, a clinic may share relevant information with another treating provider or submit information needed to bill a health plan. HIPAA also permits certain disclosures required or allowed by law, subject to applicable conditions. See HHS guidance on treatment, payment, and health care operations.

For uses or disclosures that are not otherwise permitted or required, a clinic generally needs a valid written authorization. It must describe the information, identify the disclosing and receiving parties, state the purpose and expiration, and explain the patient’s right to revoke it. Examples may include many marketing disclosures or disclosures to an employer for purposes unrelated to the employer’s lawful role. HHS outlines these requirements in its HIPAA Privacy Rule summary.

Some HIPAA exceptions allow limited disclosures without written authorization, such as certain public health, oversight, or legal-process disclosures. The clinic must check the specific rule and any more protective state or record-specific requirements before releasing information.

How can patients request and receive electronic copies?

You can contact the clinic’s medical-records department or use its patient portal to request electronic health record access. Identify the records or encounter dates you want and the format you prefer. HIPAA generally gives you the right to access health information in the clinic’s designated record set, subject to limited exceptions; it does not require a separate written authorization for you to receive your own records. See HHS’s guidance on information patients can access.

If you request an electronic copy, a HIPAA-covered clinic must provide it in the requested format if it is readily producible. If it is not, the clinic should offer a readable electronic format that you and the clinic agree on. Under HIPAA, the clinic generally must act within 30 calendar days. It may take one additional 30-day extension if it gives you written notice within the first 30 days explaining the delay and the expected completion date. See the HIPAA access rule and HHS guidance on response times.

Utah law also addresses electronic delivery when records are readily producible electronically. It provides for delivery in the provider’s customary electronic medium or a universally readable format, such as PDF, when an electronic copy is requested. See Utah Code Section 78B-5-618.

What extra protections apply to mental health and substance use records?

Mental health information is generally protected health information under HIPAA. Psychotherapy notes receive additional protection when a mental health professional keeps them separately from the rest of the medical record. Most uses or disclosures of those notes require the patient’s authorization, with limited exceptions; a patient’s HIPAA access right generally does not include psychotherapy notes. Routine clinical notes, diagnoses, medication records, and treatment plans are not automatically psychotherapy notes just because they concern mental health. See HHS’s information about medical records and psychotherapy notes.

Part 2 provides extra protections for records maintained by qualifying federally assisted substance use disorder programs. In general, a Part 2 program needs written patient consent to disclose identifying records unless a specific exception applies. Current rules allow a patient to give one consent for future treatment, payment, and health care operations disclosures, while maintaining special restrictions on use of records in proceedings against the patient. The updated rule’s compliance date was February 16, 2026. For details, see HHS’s Part 2 overview and the current Part 2 regulation.

How long must Utah clinics retain encounter records?

There is no single retention period that applies to every Utah specialty clinic. HIPAA itself does not set a general retention period for patients’ medical records; state law and rules for the particular facility or service commonly determine how long records must be kept. HIPAA safeguards still apply for as long as the clinic maintains PHI. See HHS’s explanation of HIPAA and medical-record retention.

As one example, Utah’s freestanding ambulatory surgical center rules require records to be retained for at least seven years after the last date of patient care. For a minor, the rule extends retention until the patient reaches age 18, plus three additional years, and in no case allows a period shorter than seven years. That rule is specific to those centers; a clinic should verify the retention rule for its own facility and specialty. See the Utah freestanding ambulatory surgical center rules.

What fees may clinics charge for electronic records?

For a patient’s HIPAA access request, a covered clinic may charge only a reasonable, cost-based fee for permitted copying costs, such as labor and supplies, and postage if you ask to have the copy mailed. It generally cannot add search-and-retrieval or administrative fees to that HIPAA access fee, and per-page charges are not considered reasonable for PHI maintained electronically. HHS explains the limits in its guidance on access fees. A clinic also cannot withhold access because you owe it money for care, as HHS explains in its patient-access guidance.

Utah law separately provides a fee schedule and an indexed maximum for electronic copies in circumstances where that schedule applies. The Utah Courts’ published cap for calendar year 2026 is $182.63 per electronic request. That figure is a statutory ceiling, not automatic permission to charge that amount for a HIPAA access request; the federal cost-based limit still applies where HIPAA governs. See the Utah Courts’ 2026 medical-record fee table and Utah Code Section 78B-5-618.

In practice, clinics should match each request to the correct access, disclosure, fee, and retention rules. Patients can request their own electronic records, while clinics must protect sensitive information and apply any additional rules that cover a particular record.

FAQs.

Can a Utah patient request an electronic copy of a specialty EHR encounter record?

Yes. You can request an electronic copy of records in the clinic’s designated record set. If the clinic can readily produce the information in your requested format, HIPAA generally requires that format; otherwise, the clinic should provide a readable electronic format agreed upon with you. The usual response deadline is 30 calendar days, with one possible extension after written notice.

When can a clinic disclose encounter records without written authorization?

A clinic may generally disclose information for treatment, payment, or health care operations, and may make certain disclosures required or permitted by law. Other situations may require written authorization, and records subject to extra protections—such as psychotherapy notes or qualifying Part 2 records—may have stricter rules.

Do mental health and substance use records have additional privacy protections?

Some do. HIPAA gives separately maintained psychotherapy notes extra protection. Records from qualifying substance use disorder programs may also be subject to 42 CFR Part 2, which adds consent and disclosure restrictions. Not every mental health note or record mentioning substance use automatically qualifies for those additional protections.

How long must Utah clinics retain medical records?

The period depends on the clinic’s facility type and applicable state or federal rules; HIPAA does not establish one general retention period for medical records. For example, Utah’s freestanding ambulatory surgical center rules require at least seven years after the last date of care, with a longer rule for minors. Clinics should confirm the requirements that apply to their license and services.