Unless a licensee is providing a privacy notice directly to a covered individual described in Subsection R590-206-3(4), a licensee shall provide initial, annual, and revised notices to the plan sponsor, group, or blanket insurance policyholder or group annuity contract holder, or workers' compensation policyholder, in the manner described in Sections R590-206-5 through R590-206-9 of this rule, describing the licensee's privacy practice with respect to nonpublic personal information about an individual covered under the policy, contract, or plan.
Utah Admin. Code R590-206-10