(1) As used in this section, "bureau" means the Bureau of Criminal Identification created in Section 53-10-201.

(2) Beginning July 1, 2018, the department may require a fingerprint-based local, regional, and national criminal history background check and ongoing monitoring of: (a) all staff, contracted employees, and volunteers who: (i) have access to protected health information or personal identifying information; (ii) have direct contact with patients, children, or vulnerable adults as defined in Section 62A-2-120; (iii) work in areas of privacy and data security; (iv) handle financial information, including receipt of funds, reviewing invoices, making payments, and other types of financial information; and (v) perform audit functions, whether internal or external, on behalf of the department; and (b) job applicants who have been offered a position with the department and the job requirements include those described in Subsection (2)(a).

(a) all staff, contracted employees, and volunteers who: (i) have access to protected health information or personal identifying information; (ii) have direct contact with patients, children, or vulnerable adults as defined in Section 62A-2-120; (iii) work in areas of privacy and data security; (iv) handle financial information, including receipt of funds, reviewing invoices, making payments, and other types of financial information; and (v) perform audit functions, whether internal or external, on behalf of the department; and

(i) have access to protected health information or personal identifying information;

(ii) have direct contact with patients, children, or vulnerable adults as defined in Section 62A-2-120;

(iii) work in areas of privacy and data security;

(iv) handle financial information, including receipt of funds, reviewing invoices, making payments, and other types of financial information; and

(v) perform audit functions, whether internal or external, on behalf of the department; and

(b) job applicants who have been offered a position with the department and the job requirements include those described in Subsection (2)(a).

(3) Each individual in a position listed in Subsection (2) shall provide a completed fingerprint card to the department upon request.

(4) The department shall require that an individual required to submit to a background check under Subsection (3) provide a signed waiver on a form provided by the department that meets the requirements of Subsection 53-10-108(4).

(5) For a noncriminal justice background search and registration in accordance with Subsection 53-10-108(13), the department shall submit to the bureau: (a) the applicant's personal identifying information and fingerprints for a criminal history search of applicable local, regional, and national databases; and (b) a request for all information received as a result of the local, regional, and nationwide background check.

(a) the applicant's personal identifying information and fingerprints for a criminal history search of applicable local, regional, and national databases; and

(b) a request for all information received as a result of the local, regional, and nationwide background check.

(6) The department is responsible for the payment of all fees required by Subsection 53-10-108(15) and any fees required to be submitted to the Federal Bureau of Investigation by the bureau.

(7) The department may make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, that: (a) determine how the department will assess the employment status of an individual upon receipt of background information; (b) determine the type of crimes and the severity that would disqualify an individual from holding a position; and (c) identify the appropriate privacy risk mitigation strategy to be used in accordance with Subsection 53-10-108(13)(b).

(a) determine how the department will assess the employment status of an individual upon receipt of background information;

(b) determine the type of crimes and the severity that would disqualify an individual from holding a position; and

(c) identify the appropriate privacy risk mitigation strategy to be used in accordance with Subsection 53-10-108(13)(b).