High-Level Summary

HB 199 is the result of a multi-year effort to modernize Utah’s Health Data Authority Act, a framework that has not seen a meaningful update since the 1990s. This bill moves the state away from rigid, decades-old rules toward a transparent, strategy-led model that prioritizes administrative efficiency alongside modern standards for data privacy and security.

History and Context

The Health Data Authority (HDA) and the Health Data Committee (HDC) date back to the early 1990s. Following standard legislative practice, the Legislature initially requested frequent reporting on the HDA. Once the program became fully operational, reviews were scheduled less often: in 2004, 2014, and most recently, 2024.

In 2024, Rep. Rosemary Lesser and Sen. Mike Kennedy (both physicians) sponsored HB 41 to provide a basic cleanup of the Act. During that process, complex questions emerged regarding data use, privacy, and security—specifically concerning the All-Payer Claims Database (APCD). Due to the technical nature of these concerns and the limited timeframe of the session, the Legislature extended the HDA sunset for two years and requested a formal audit. That audit began in 2024 and was completed in August 2025, providing the data-driven foundation for the improvements found in HB 199.

Audit Findings & Response

The audit identified several key areas where the law was failing to keep pace with modern needs:

• Informed Policy: All-Payer Claims Data can be used to better inform state health policy
• Internal Barriers: Data-sharing barriers within the Department of Health and Human Services (DHHS) prevented employees from fulfilling their responsibilities.
• Behavioral Health Outcomes: More robust behavioral health outcome measures require increased data sharing with external agencies
• Strategic Vision: Without a formal strategic plan, the Healthcare Statistics program fails to reach its full potential.
• Operational Inefficiency: Healthcare Statistics’ inefficiencies contribute to its minimal impact on health policy

In response to these findings, DHHS drafted language in August 2025 and asked me to be the chief sponsor. The primary objective was to address the audit’s recommendations while strengthening transparency, privacy protections, and data security. In January 2025, DHHS provided a description of their intent and goals.

What HB 199 Actually Does

An Impartial Analysis

Legislative analysts provided an impartial analysis of the original bill and describe the impact as follows:

• Amends the Utah Health Data Authority Act by –
  • Modifying the requirements for DHHS’ strategic plan for data usage;
  • Clarifying the circumstances when DHHS can share identifiable health data;
  • Modifying the definition and permissible uses of identifiable health data; and
• Extends the sunset of the Utah Health Data Authority from 2026 to 2036.

Their analysis also states:

HB 199: Health Data Amendments is responsive to a 2025 sunset review of the Utah Health Data Authority. It also addresses some recommendations from the August, 2025, Office of the Legislative Auditor General (OLAG) audit… Specifically, the bill addresses the following audit recommendations:

• Recommendation 2.1 – We recommend the Legislature consider policy options allowing for more data sharing within the Department of Health and Human Services for public health cases.
• Recommendation 3.4 – We recommend the Legislature should consider establishing a defined purpose for the All-Payers Claims Database in state statute.
• Recommendation 3.6 – We recommend the Legislature should decide whether to require that the Healthcare Statistics program prioritize improving operational revenue through data user fees.

Regarding the Naming of the APCD (Recommendation 3.4):

The authority for the state to maintain an All-Payer Claims Database (APCD) has been part of Utah law for nearly 20 years (originally established via HB9 in 2007 and HB133 in 2008). While the program has been operational this entire time under Utah Code Section 26B-8-504, the specific name “All-Payer Claims Database” was not previously written into the statute.

The 2025 Legislative Audit (OLAG) specifically recommended that the Legislature formally define the program’s purpose in state law to increase accountability. Adding the name to the statute does not “cement” a new program; rather, it provides the legal clarity and definitions required by the auditors to ensure the program remains transparent and accountable to the public.

The Final Framework

The final version of the bill (HB199 Sub 1) incorporated additional feedback from legislative auditors, the state’s Data Privacy Officer and Chief Information Security Officer.

Key pillars include:

• Modernizing Management: Moves away from an antiquated “fixed” plan in favor of dynamic Strategic, Data Management, and Analytics plans.
  • Impact: Forces DHHS to be deliberate about what is collected, how it is used, and how it is protected.
• Public Transparency: Requires DHHS to publish these plans online, detailing the intended benefits, the source of the data, and the specific actions taken to prevent “re-identification.”
• Eliminating Red Tape: Allows DHHS to share data more effectively with internal divisions and local health authorities (like county health departments), as recommended by the audit.
• Stricter Privacy Rules: Introduces more rigorous definitions and rules for identifiable health data, aligning strictly with federal patient privacy guidelines.

Important Clarifications

• Origin: This bill was a departmental response to recommendations of a formal legislative audit; it was not a personal initiative. I did not put forward the idea, nor did I volunteer to be the sponsor.
• Data Scope: HB 199 does not mandate the collection of new categories of personal data. It focuses on better managing the data the state is already authorized to collect.
• Zero Conflict of Interest: There is no connection to or benefit for my employer. DHHS does not provide health data to that association, nor does this bill create a mechanism to do so.

What is NAHDO?

• NAHDO Organizational History: The National Association of Health Data Organizations is a 501(c)(3) non-profit membership and educational association established in 1986, dedicated to the public good and the improvement of health data systems.
• Executive Director Hiring Process: I do not own or control NAHDO; I was hired as the Executive Director in 2019 following a rigorous national search conducted by an independent Board of Directors. My salary is set by the board and is completely independent of “consulting fees,” commissions, or the passage of specific legislation in Utah or any other state.
• APCD Council: The APCD Council is a program of NAHDO and functions as a learning collaborative. The only “product” of the APCD Council is a standardized reporting schema (the APCD-CDL™) which is available for members and non-members without charge.
• Administrative Burden: By promoting a uniform data format across different states, the organization helps reduce the administrative and technical burden on health insurance providers.
• Efficient Operations: In line with modern non-profit standards and to keep overhead costs low, NAHDO operates fully virtually. The registered business address is a home office used for administrative purposes only.
• Membership Dues/Sponsorships: NAHDO is primarily funded transparently through member dues and educational event sponsorships; it does not generate revenue from the sale of data or legislative activities.