Utah Code § 13-72a-201: Protection of personal information.

(1) A supplier of a mental health chatbot may not sell to or share with any third party any:

(a) individually identifiable health information of a Utah user; or

(b) user input of a Utah user.

(2) Subsection (1) does not apply to individually identifiable health information:

(a) requested by a health care provider with the consent of the Utah user;

(b) provided to a health plan of a Utah user upon request of the Utah user; or

(c) shared in compliance with Subsection (3).

(3)

(a) A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality.

(b) When sharing information under Subsection (3)(a), the supplier and the other entity shall comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as such terms are defined in 45 C.F.R. 160.103.