Utah Code § 4-41a-1103

(1) Each medical cannabis pharmacy shall maintain the pharmacy's medical cannabis treatment recommendation files and other records in accordance with this chapter, department rules, and the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936, as amended. (2) (a) The department may inspect the records, facility, and inventory of a medical cannabis pharmacy at any time during business hours in order to determine if the medical cannabis pharmacy complies with this chapter. (b) The Department of Health and Human Services may inspect patient records held by a medical cannabis pharmacy: (i) for compliance with the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936, as amended; or (ii) to ensure that a medical cannabis pharmacy is providing a cannabis product to a patient in accordance with the recommendations of the patient's recommending medical provider. (3) (a) An inspection conducted by the department under this section may include: (i) inspecting a site, facility, vehicle, book, record, paper, document, data, or other physical or electronic information, or any combination of the above; (ii) questioning of any relevant individual; (iii) inspecting equipment, an instrument, a tool, or machinery, including a container or label; (iv) random sampling of medical cannabis in accordance with rules described in Section 4-41a-701; or (v) seizure of medical cannabis, medical cannabis devices, or educational material as evidence in a department investigation or inspection or in instances of compliance failure. (b) An inspection conducted by the Department of Health and Human Services under Subsection (2)(b) may include: (i) inspecting a site, facility, vehicle, book, record, paper, document, data, or other physical or electronic information, or any combination of the above; or (ii) questioning of any relevant individual. (4) In making an inspection under this section: (a) the department may freely access any area and review and make copies of a book, record, paper, document, data, or other physical or electronic information, including financial data, sales data, shipping data, pricing data, and employee data; and (b) the Department of Health and Human Services may freely access any area and review and make copies of a book, record, paper, document, data, or other physical or electronic information related to patient records. (5) Failure to provide the department, the Department of Health and Human Services, or the authorized agents of the department or the Department of Health and Human Services immediate access to records and facilities during business hours in accordance with this section may result in: (a) the imposition of a civil monetary penalty that the department sets in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act; (b) license or registration suspension or revocation; or (c) an immediate cessation of operations under a cease and desist order that the department issues. (6) Notwithstanding any other provision of law, the department may temporarily store in any department facility the items the department seizes under Subsection (3)(a)(v) until the department: (a) determines that sufficient compliance justifies the return of the seized items; or (b) disposes of the items in the same manner as a cannabis production establishment in accordance with Section 4-41a-405.