Utah Takes Steps to Protect Patient Privacy

It’s ten o’clock. Do you know where your data is?

In an era of rapid technological development, data is powerful and notoriously difficult to keep private. However, Utahns were rightfully alarmed to learn the Department of Health (DOH) was requiring new mothers to divulge pages of private information to obtain their newborn child’s birth certificate.

The DOH questions caused concern due to their invasive nature and irrelevance to establishing the child’s identity. DOH not only failed to obtain informed consent from maternity patients, but after collecting completed surveys, the department charged researchers to access survey data.

This agency failure highlights the problems associated with broad agency power lacking statutory privacy protection requirements. The problem is not that researchers are attempting to collect data. The issue is the manner in which the data was collected, specifically the state’s abuse of power to obtain and profit from the forced collection of Utahns’ private information.

Given the growing value associated with private data, agencies should not routinely collect information irrelevant to fulfilling the core functions of the agency. In this instance, a significant portion of the questions in the DOH-issued survey was not relevant to the state issuing a birth certificate, making the collection of such information irrelevant aside from the profit the state obtained by selling researchers access to the data. 

The failures of DOH have not gone unnoticed by the Utah legislature. Representative Candice Pierucci sponsored House Bill 341 to clarify what information is required to obtain an infant’s birth certificate.

This bill clarifies information needed to process a birth certificate request with additional, research-relevant questions. To ensure national uniformity, the law requires DOH to follow recommendations from federal agencies. However, to obtain additional information, DOH must make several disclosures. 

First, it must be clear the additional information is voluntary and not tied to the issuance of a birth certificate. Second, the use of the data must be disclosed. This includes not only the purpose of collecting the data but also the timeframe of its use. Third, DOH must describe how the department will prevent data from being used for a different purpose. 

What about citizens who already filled out the survey? Beginning July 1, Utahns who wish to have their information removed from DOH’s database will be able to send a request to the department. After receiving this request, DOH will be legally required to de-identify the individual from the information provided to the state. 

Rep. Pierucci’s focus on privacy and consent is a step in the right direction towards preventing agency abuse of Utahns’ personal data and reestablishing trust between citizens and government.