Beginning May 6, 2026, Utah parents would generally be able to access their children’s medical records, while facilities and vendors would face specific duties and penalties.
Parents would generally be able to access their child’s medical records, including electronic records, with exceptions for court orders, loss of parental rights, marriage or emancipation, and sexual-assault counseling.
Facilities and medical-record vendors could face $1,000 daily fines for failing to support the required access, while the attorney general could sue and investigate violations.
When an electronic record cannot be displayed, facilities would have to tell eligible parents how to request it and provide it free within five business days.
A parent may obtain and access the medical records that concern the parent’s child, and a health care facility may not restrict electronic access except for listed reasons. The rule covers children under 18 and their parents, but not records after parental rights end, after emancipation or marriage, when a court order requires restriction, or when records concern sexual-assault counseling. Health care facilities may restrict only the part of an electronic record covered by an exception. The rule does not apply to the Utah State Hospital. The provision takes effect May 6, 2026.
The attorney general may sue facilities and electronic medical-record vendors, investigate with subpoenas, and seek attorney fees; daily civil fines may apply for noncompliance. Facilities may face $1,000 for each day they improperly restrict electronic access, and vendors may face $1,000 for each day their systems cannot be adjusted to comply. A health care system with multiple violating facilities is fined as one facility. A court must award attorney fees to the attorney general when the attorney general wins the enforcement action. The Utah State Hospital is excluded from these enforcement provisions. The daily fines apply for violations occurring after December 31, 2027.
A health care facility must notify a parent when the electronic system cannot show an accessible record and must provide the requested records without charge within five business days. This applies when the system cannot provide access even though HIPAA and the bill’s exceptions do not otherwise block the parent’s access. The required notice must tell the parent how to request records and state the five-business-day deadline and possible $1,000 fine. A facility that misses the deadline may face a $1,000 fine per record. The notice, record-delivery, and per-record fine provisions take effect May 6, 2026.
No hearings or votes scheduled.