Public Act 0508 103RD GENERAL ASSEMBLY

SB2294 Enrolled LRB103 26927 KTG 53291 b

Public Act 103-0508

AN ACT concerning State government.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. The Freedom of Information Act is amended by changing Section 7.5 as follows:

(5 ILCS 140/7.5)

Sec. 7.5. Statutory exemptions. To the extent provided for by the statutes referenced below, the following shall be exempt from inspection and copying:

(a) All information determined to be confidential under Section 4002 of the Technology Advancement and Development Act.

(b) Library circulation and order records identifying library users with specific materials under the Library Records Confidentiality Act.

(c) Applications, related documents, and medical records received by the Experimental Organ Transplantation Procedures Board and any and all documents or other records prepared by the Experimental Organ Transplantation Procedures Board or its staff relating to applications it has received.

(d) Information and records held by the Department of Public Health and its authorized representatives relating to known or suspected cases of sexually transmissible disease or any information the disclosure of which is restricted under the Illinois Sexually Transmissible Disease Control Act.

(e) Information the disclosure of which is exempted under Section 30 of the Radon Industry Licensing Act.

(f) Firm performance evaluations under Section 55 of the Architectural, Engineering, and Land Surveying Qualifications Based Selection Act.

(g) Information the disclosure of which is restricted and exempted under Section 50 of the Illinois Prepaid Tuition Act.

(h) Information the disclosure of which is exempted under the State Officials and Employees Ethics Act, and records of any lawfully created State or local inspector general's office that would be exempt if created or obtained by an Executive Inspector General's office under that Act.

(i) Information contained in a local emergency energy plan submitted to a municipality in accordance with a local emergency energy plan ordinance that is adopted under Section 11-21.5-5 of the Illinois Municipal Code.

(j) Information and data concerning the distribution of surcharge moneys collected and remitted by carriers under the Emergency Telephone System Act.

(k) Law enforcement officer identification information or driver identification information compiled by a law enforcement agency or the Department of Transportation under Section 11-212 of the Illinois Vehicle Code.

(l) Records and information provided to a residential health care facility resident sexual assault and death review team or the Executive Council under the Abuse Prevention Review Team Act.

(m) Information provided to the predatory lending database created pursuant to Article 3 of the Residential Real Property Disclosure Act, except to the extent authorized under that Article.

(n) Defense budgets and petitions for certification of compensation and expenses for court appointed trial counsel as provided under Sections 10 and 15 of the Capital Crimes Litigation Act. This subsection (n) shall apply until the conclusion of the trial of the case, even if the prosecution chooses not to pursue the death penalty prior to trial or sentencing.

(o) Information that is prohibited from being disclosed under Section 4 of the Illinois Health and Hazardous Substances Registry Act.

(p) Security portions of system safety program plans, investigation reports, surveys, schedules, lists, data, or information compiled, collected, or prepared by or for the Department of Transportation under Sections 2705-300 and 2705-616 of the Department of Transportation Law of the Civil Administrative Code of Illinois, the Regional Transportation Authority under Section 2.11 of the Regional Transportation Authority Act, or the St. Clair County Transit District under the Bi-State Transit Safety Act.

(q) Information prohibited from being disclosed by the Personnel Record Review Act.

(r) Information prohibited from being disclosed by the Illinois School Student Records Act.

(s) Information the disclosure of which is restricted under Section 5-108 of the Public Utilities Act.

(t) (Blank). All identified or deidentified health information in the form of health data or medical records contained in, stored in, submitted to, transferred by, or released from the Illinois Health Information Exchange, and identified or deidentified health information in the form of health data and medical records of the Illinois Health Information Exchange in the possession of the Illinois Health Information Exchange Office due to its administration of the Illinois Health Information Exchange. The terms "identified" and "deidentified" shall be given the same meaning as in the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, or any subsequent amendments thereto, and any regulations promulgated thereunder.

(u) Records and information provided to an independent team of experts under the Developmental Disability and Mental Health Safety Act (also known as Brian's Law).

(v) Names and information of people who have applied for or received Firearm Owner's Identification Cards under the Firearm Owners Identification Card Act or applied for or received a concealed carry license under the Firearm Concealed Carry Act, unless otherwise authorized by the Firearm Concealed Carry Act; and databases under the Firearm Concealed Carry Act, records of the Concealed Carry Licensing Review Board under the Firearm Concealed Carry Act, and law enforcement agency objections under the Firearm Concealed Carry Act.

(v-5) Records of the Firearm Owner's Identification Card Review Board that are exempted from disclosure under Section 10 of the Firearm Owners Identification Card Act.

(w) Personally identifiable information which is exempted from disclosure under subsection (g) of Section 19.1 of the Toll Highway Act.

(x) Information which is exempted from disclosure under Section 5-1014.3 of the Counties Code or Section 8-11-21 of the Illinois Municipal Code.

(y) Confidential information under the Adult Protective Services Act and its predecessor enabling statute, the Elder Abuse and Neglect Act, including information about the identity and administrative finding against any caregiver of a verified and substantiated decision of abuse, neglect, or financial exploitation of an eligible adult maintained in the Registry established under Section 7.5 of the Adult Protective Services Act.

(z) Records and information provided to a fatality review team or the Illinois Fatality Review Team Advisory Council under Section 15 of the Adult Protective Services Act.

(aa) Information which is exempted from disclosure under Section 2.37 of the Wildlife Code.

(bb) Information which is or was prohibited from disclosure by the Juvenile Court Act of 1987.

(cc) Recordings made under the Law Enforcement Officer-Worn Body Camera Act, except to the extent authorized under that Act.

(dd) Information that is prohibited from being disclosed under Section 45 of the Condominium and Common Interest Community Ombudsperson Act.

(ee) Information that is exempted from disclosure under Section 30.1 of the Pharmacy Practice Act.

(ff) Information that is exempted from disclosure under the Revised Uniform Unclaimed Property Act.

(gg) Information that is prohibited from being disclosed under Section 7-603.5 of the Illinois Vehicle Code.

(hh) Records that are exempt from disclosure under Section 1A-16.7 of the Election Code.

(ii) Information which is exempted from disclosure under Section 2505-800 of the Department of Revenue Law of the Civil Administrative Code of Illinois.

(jj) Information and reports that are required to be submitted to the Department of Labor by registering day and temporary labor service agencies but are exempt from disclosure under subsection (a-1) of Section 45 of the Day and Temporary Labor Services Act.

(kk) Information prohibited from disclosure under the Seizure and Forfeiture Reporting Act.

(ll) Information the disclosure of which is restricted and exempted under Section 5-30.8 of the Illinois Public Aid Code.

(mm) Records that are exempt from disclosure under Section 4.2 of the Crime Victims Compensation Act.

(nn) Information that is exempt from disclosure under Section 70 of the Higher Education Student Assistance Act.

(oo) Communications, notes, records, and reports arising out of a peer support counseling session prohibited from disclosure under the First Responders Suicide Prevention Act.

(pp) Names and all identifying information relating to an employee of an emergency services provider or law enforcement agency under the First Responders Suicide Prevention Act.

(qq) Information and records held by the Department of Public Health and its authorized representatives collected under the Reproductive Health Act.

(rr) Information that is exempt from disclosure under the Cannabis Regulation and Tax Act.

(ss) Data reported by an employer to the Department of Human Rights pursuant to Section 2-108 of the Illinois Human Rights Act.

(tt) Recordings made under the Children's Advocacy Center Act, except to the extent authorized under that Act.

(uu) Information that is exempt from disclosure under Section 50 of the Sexual Assault Evidence Submission Act.

(vv) Information that is exempt from disclosure under subsections (f) and (j) of Section 5-36 of the Illinois Public Aid Code.

(ww) Information that is exempt from disclosure under Section 16.8 of the State Treasurer Act.

(xx) Information that is exempt from disclosure or information that shall not be made public under the Illinois Insurance Code.

(yy) Information prohibited from being disclosed under the Illinois Educational Labor Relations Act.

(zz) Information prohibited from being disclosed under the Illinois Public Labor Relations Act.

(aaa) Information prohibited from being disclosed under Section 1-167 of the Illinois Pension Code.

(bbb) Information that is prohibited from disclosure by the Illinois Police Training Act and the Illinois State Police Act.

(ccc) Records exempt from disclosure under Section 2605-304 of the Illinois State Police Law of the Civil Administrative Code of Illinois.

(ddd) Information prohibited from being disclosed under Section 35 of the Address Confidentiality for Victims of Domestic Violence, Sexual Assault, Human Trafficking, or Stalking Act.

(eee) Information prohibited from being disclosed under subsection (b) of Section 75 of the Domestic Violence Fatality Review Act.

(fff) Images from cameras under the Expressway Camera Act. This subsection (fff) is inoperative on and after July 1, 2023.

(ggg) Information prohibited from disclosure under paragraph (3) of subsection (a) of Section 14 of the Nurse Agency Licensing Act.

(hhh) Information submitted to the Department of State Police in an affidavit or application for an assault weapon endorsement, assault weapon attachment endorsement, .50 caliber rifle endorsement, or .50 caliber cartridge endorsement under the Firearm Owners Identification Card Act.

(Source: P.A. 101-13, eff. 6-12-19; 101-27, eff. 6-25-19; 101-81, eff. 7-12-19; 101-221, eff. 1-1-20; 101-236, eff. 1-1-20; 101-375, eff. 8-16-19; 101-377, eff. 8-16-19; 101-452, eff. 1-1-20; 101-466, eff. 1-1-20; 101-600, eff. 12-6-19; 101-620, eff 12-20-19; 101-649, eff. 7-7-20; 101-652, eff. 1-1-22; 101-656, eff. 3-23-21; 102-36, eff. 6-25-21; 102-237, eff. 1-1-22; 102-292, eff. 1-1-22; 102-520, eff. 8-20-21; 102-559, eff. 8-20-21; 102-813, eff. 5-13-22; 102-946, eff. 7-1-22; 102-1042, eff. 6-3-22; 102-1116, eff. 1-10-23.)

Section 5. The Department of Healthcare and Family Services Law is amended by adding Section 2205-40 as follows:

(20 ILCS 2205/2205-40 new)

Sec. 2205-40. Dissolution of the Health Information Exchange Office and Fund.

(a) Staff employed by the Illinois Health Information Exchange Office (Office) on the effective date of this amendatory Act of the 103rd General Assembly shall remain employed and continue their service within the Department of Healthcare and Family Services after the repeal of the Illinois Health Information Exchange and Technology Act and the cessation or dissolution of the Office. The status and rights of such employees shall not be affected by the repeal of the Illinois Health Information Exchange and Technology Act or the cessation of the Office except that, notwithstanding any other State law to the contrary, those employees shall maintain their seniority and their positions shall convert to titles of comparable organizational level under the Personnel Code and become subject to the Personnel Code. Other than the changes described in this paragraph, the rights of employees, the State of Illinois, and State agencies under the Personnel Code or under any pension, retirement, or annuity plan shall not be affected by this amendatory Act of the 103rd General Assembly.

(b) Notwithstanding any other provision of law to the contrary, and in addition to any other transfers that may be provided by law, on the effective date of this amendatory Act of the 103rd General Assembly, or as soon thereafter as practical, the State Comptroller shall direct and the State Treasurer shall transfer the remaining balance from the Health Information Exchange Fund to the General Revenue Fund. Upon completion of the transfer, the Health Information Exchange Fund is dissolved, and any future deposits due to that Fund and any outstanding obligations or liabilities of that Fund shall pass to the General Revenue Fund.

Section 10. The Illinois Health Information Exchange and Technology Act is amended by changing Section 997 as follows:

(20 ILCS 3860/997)

(Section scheduled to be repealed on January 1, 2027)

Sec. 997. Repealer. This Act is repealed on July 1, 2023 January 1, 2027.

(Source: P.A. 102-43, eff. 7-6-21.)

Section 15. The Illinois Public Aid Code is amended by changing Section 12-4.48 as follows:

(305 ILCS 5/12-4.48)

Sec. 12-4.48. Long-Term Services and Supports Disparities Workgroup Task Force.

(a) The Department of Healthcare and Family Services shall establish a Long-Term Services and Supports Disparities Workgroup of the Medicaid Advisory Committee in accordance with the requirements of 42 CFR 431.12 Task Force.

(b) Members of the Workgroup Task Force shall be appointed by the Director of the Department of Healthcare and Family Services and may shall include representatives of the following agencies, organizations, or groups:

(1) (Blank). The Governor's office.

(2) (Blank). The Department of Healthcare and Family Services.

(3) (Blank). The Department of Human Services.

(4) (Blank). The Department on Aging.

(5) (Blank). The Department of Human Rights.

(6) (Blank). Area Agencies on Aging.

(7) (Blank). The Department of Public Health.

(8) Managed Care Plans.

(9) The for-profit urban nursing home or assisted living industry.

(10) The for-profit rural nursing home or assisted living industry.

(11) The not-for-profit nursing home or assisted living industry.

(12) The home care association or home care industry.

(13) The adult day care association or adult day care industry.

(14) An association representing workers who provide long-term services and supports.

(15) A representative of providers that serve the predominantly ethnic minority populations.

(16) Case Management Organizations.

(17) Three consumer representatives which may include a consumer of long-term services and supports or an individual who advocates for such consumers. For purposes of this provision, "consumer representative" means a person who is not an elected official and who has no financial interest in a health or long-term care delivery system.

(b-5) In addition, one representative from each of the following may serve ex officio: the Governor's Office; the Department of Healthcare and Family Services; the Department of Human Services; the Department on Aging; the Department of Public Health; and the Department of Human Rights.

(c) The Workgroup The Task Force shall not meet unless all consumer representative positions are filled. The Task Force shall reflect diversity in race, ethnicity, and gender.

(d) The Chair of the Workgroup Task Force shall be appointed by the Director of the Department of Healthcare and Family Services.

(e) The Director of the Department of Healthcare and Family Services shall assign appropriate staff and resources to support the efforts of the Workgroup. The Workgroup Task Force. The Task Force shall meet as often as necessary but not less than 4 times per calendar year.

(f) The Workgroup Task Force shall promote and facilitate communication, coordination, and collaboration among relevant State agencies and communities of color, limited English-speaking communities, and the private and public entities providing services to those communities.

(g) The Workgroup Task Force shall do all of the following:

(1) Document the number and types of Long-Term Services and Supports (LTSS) providers in the State and the number of clients served in each setting.

(2) Document the number and racial profiles of residents using LTSS, including, but not limited to, residential nursing facilities, assisted living facilities, adult day care, home health services, and other home and community based long-term care services.

(3) Document the number and profiles of family or informal caregivers who provide care for minority elders.

(4) Compare data over multiple years to identify trends in the delivery of LTSS for each racial or ethnic category including: Alaskan Native or American Indian, Asian or Pacific Islander, black or African American, Hispanic, or white.

(5) Identify any racial disparities in the provision of care in various LTSS settings and determine factors that might influence the disparities found.

(6) Identify any disparities uniquely experienced in metropolitan or rural areas and make recommendations to address these areas.

(7) Assess whether the LTSS industry, including managed care plans and independent providers, is equipped to offer culturally sensitive, competent, and linguistically appropriate care to meet the needs of a diverse aging population and their informal and formal caregivers.

(8) Consider whether to recommend that the State require all home and community based services as a condition of licensure to report data similar to that gathered under the Minimum Data Set and required when a new resident is admitted to a nursing home.

(9) Identify and prioritize recommendations for actions to be taken by the State to address disparity issues identified in the course of these studies.

(10) Monitor the progress of the State in eliminating racial disparities in the delivery of LTSS.

(h) The Workgroup may Task Force shall conduct public hearings, inquiries, studies, and other forms of information gathering to identify how the actions of State government contribute to or reduce racial disparities in long-term care settings.

(i) The Workgroup Task Force shall report its findings and recommendations to the Governor and the General Assembly with annual no later than one year after the effective date of this amendatory Act of the 98th General Assembly. Annual reports shall be issued every year thereafter and shall include documentation of progress made to eliminate disparities in long-term care service settings.

(Source: P.A. 98-825, eff. 8-1-14; 99-78, eff. 7-20-15.)

Section 20. The Medical Patient Rights Act is amended by changing Section 3 as follows:

(410 ILCS 50/3) (from Ch. 111 1/2, par. 5403)

Sec. 3. The following rights are hereby established:

(a) The right of each patient to care consistent with sound nursing and medical practices, to be informed of the name of the physician responsible for coordinating his or her care, to receive information concerning his or her condition and proposed treatment, to refuse any treatment to the extent permitted by law, and to privacy and confidentiality of records except as otherwise provided by law.

(b) The right of each patient, regardless of source of payment, to examine and receive a reasonable explanation of his total bill for services rendered by his physician or health care provider, including the itemized charges for specific services received. Each physician or health care provider shall be responsible only for a reasonable explanation of those specific services provided by such physician or health care provider.

(c) In the event an insurance company or health services corporation cancels or refuses to renew an individual policy or plan, the insured patient shall be entitled to timely, prior notice of the termination of such policy or plan.

An insurance company or health services corporation that requires any insured patient or applicant for new or continued insurance or coverage to be tested for infection with human immunodeficiency virus (HIV) or any other identified causative agent of acquired immunodeficiency syndrome (AIDS) shall (1) give the patient or applicant prior written notice of such requirement, (2) proceed with such testing only upon the written authorization of the applicant or patient, and (3) keep the results of such testing confidential. Notice of an adverse underwriting or coverage decision may be given to any appropriately interested party, but the insurer may only disclose the test result itself to a physician designated by the applicant or patient, and any such disclosure shall be in a manner that assures confidentiality.

The Department of Insurance shall enforce the provisions of this subsection.

(d) The right of each patient to privacy and confidentiality in health care. Each physician, health care provider, health services corporation and insurance company shall refrain from disclosing the nature or details of services provided to patients, except that such information may be disclosed: (1) to the patient, (2) to the party making treatment decisions if the patient is incapable of making decisions regarding the health services provided, (3) for treatment in accordance with 45 CFR 164.501 and 164.506, (4) for payment in accordance with 45 CFR 164.501 and 164.506, (5) to those parties responsible for peer review, utilization review, and quality assurance, (6) for health care operations in accordance with 45 CFR 164.501 and 164.506, (7) to those parties required to be notified under the Abused and Neglected Child Reporting Act or the Illinois Sexually Transmissible Disease Control Act, or (8) as otherwise permitted, authorized, or required by State or federal law. This right may be waived in writing by the patient or the patient's guardian or legal representative, but a physician or other health care provider may not condition the provision of services on the patient's, guardian's, or legal representative's agreement to sign such a waiver. In the interest of public health, safety, and welfare, patient information, including, but not limited to, health information, demographic information, and information about the services provided to patients, may be transmitted to or through a health information exchange, as that term is defined in Section 2 of the Mental Health and Developmental Disabilities Confidentiality Act, in accordance with the disclosures permitted pursuant to this Section. Patients shall be provided the opportunity to opt out of their health information being transmitted to or through a health information exchange in accordance with the regulations, standards, or contractual obligations adopted by the Illinois Health Information Exchange Office in accordance with Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, Section 9.6 of the AIDS Confidentiality Act, or Section 31.8 of the Genetic Information Privacy Act, as applicable. In the case of a patient choosing to opt out of having his or her information available on an HIE, nothing in this Act shall cause the physician or health care provider to be liable for the release of a patient's health information by other entities that may possess such information, including, but not limited to, other health professionals, providers, laboratories, pharmacies, hospitals, ambulatory surgical centers, and nursing homes.

(Source: P.A. 101-649, eff. 7-7-20.)

Section 25. The AIDS Confidentiality Act is amended by changing Section 3 as follows:

(410 ILCS 305/3) (from Ch. 111 1/2, par. 7303)

Sec. 3. Definitions. When used in this Act:

(a) "AIDS" means acquired immunodeficiency syndrome.

(b) "Authority" means the Illinois Health Information Exchange Authority established pursuant to the Illinois Health Information Exchange and Technology Act.

(c) "Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(d) "Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(e) "De-identified information" means health information that is not individually identifiable as described under HIPAA, as specified in 45 CFR 164.514(b).

(f) "Department" means the Illinois Department of Public Health or its designated agents.

(g) "Disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(h) "Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(i) "Health care professional" means (i) a licensed physician, (ii) a licensed physician assistant, (iii) a licensed advanced practice registered nurse, (iv) an advanced practice registered nurse or physician assistant who practices in a hospital or ambulatory surgical treatment center and possesses appropriate clinical privileges, (v) a licensed dentist, (vi) a licensed podiatric physician, or (vii) an individual certified to provide HIV testing and counseling by a state or local public health department.

(j) "Health care provider" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(k) "Health facility" means a hospital, nursing home, blood bank, blood center, sperm bank, or other health care institution, including any "health facility" as that term is defined in the Illinois Finance Authority Act.

(l) "Health information exchange" or "HIE" means a health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules adopted thereunder; (ii) has established a data sharing arrangement with the Authority; or (iii) as of August 16, 2013, was designated by the Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee. In certain circumstances, in accordance with HIPAA, an HIE will be a business associate.

(m) "Health oversight agency" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(n) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.

(o) "HIV" means the human immunodeficiency virus.

(p) "HIV-related information" means the identity of a person upon whom an HIV test is performed, the results of an HIV test, as well as diagnosis, treatment, and prescription information that reveals a patient is HIV-positive, including such information contained in a limited data set. "HIV-related information" does not include information that has been de-identified in accordance with HIPAA.

(q) "Informed consent" means:

(1) where a health care provider, health care professional, or health facility has implemented opt-in testing, a process by which an individual or their legal representative receives pre-test information, has an opportunity to ask questions, and consents verbally or in writing to the test without undue inducement or any element of force, fraud, deceit, duress, or other form of constraint or coercion; or

(2) where a health care provider, health care professional, or health facility has implemented opt-out testing, the individual or their legal representative has been notified verbally or in writing that the test is planned, has received pre-test information, has been given the opportunity to ask questions and the opportunity to decline testing, and has not declined testing; where such notice is provided, consent for opt-out HIV testing may be incorporated into the patient's general consent for medical care on the same basis as are other screening or diagnostic tests; a separate consent for opt-out HIV testing is not required.

In addition, where the person providing informed consent is a participant in an HIE, informed consent requires a fair explanation that the results of the patient's HIV test will be accessible through an HIE and meaningful disclosure of the patient's opt-out right under Section 9.6 of this Act.

A health care provider, health care professional, or health facility undertaking an informed consent process for HIV testing under this subsection may combine a form used to obtain informed consent for HIV testing with forms used to obtain written consent for general medical care or any other medical test or procedure, provided that the forms make it clear that the subject may consent to general medical care, tests, or procedures without being required to consent to HIV testing, and clearly explain how the subject may decline HIV testing. Health facility clerical staff or other staff responsible for the consent form for general medical care may obtain consent for HIV testing through a general consent form.

(r) "Limited data set" has the meaning ascribed to it under HIPAA, as described in 45 CFR 164.514(e)(2).

(s) "Minimum necessary" means the HIPAA standard for using, disclosing, and requesting protected health information found in 45 CFR 164.502(b) and 164.514(d).

(s-1) "Opt-in testing" means an approach where an HIV test is presented by offering the test and the patient accepts or declines testing.

(s-3) "Opt-out testing" means an approach where an HIV test is presented such that a patient is notified that HIV testing may occur unless the patient declines.

(t) "Organized health care arrangement" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(u) "Patient safety activities" has the meaning ascribed to it under 42 CFR 3.20.

(v) "Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(w) "Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity.

(w-5) "Pre-test information" means:

(1) a reasonable explanation of the test, including its purpose, potential uses, limitations, and the meaning of its results; and

(2) a reasonable explanation of the procedures to be followed, including the voluntary nature of the test, the availability of a qualified person to answer questions, the right to withdraw consent to the testing process at any time, the right to anonymity to the extent provided by law with respect to participation in the test and disclosure of test results, and the right to confidential treatment of information identifying the subject of the test and the results of the test, to the extent provided by law.

Pre-test information may be provided in writing, verbally, or by video, electronic, or other means and may be provided as designated by the supervising health care professional or the health facility.

For the purposes of this definition, a qualified person to answer questions is a health care professional or, when acting under the supervision of a health care professional, a registered nurse, medical assistant, or other person determined to be sufficiently knowledgeable about HIV testing, its purpose, potential uses, limitations, the meaning of the test results, and the testing procedures in the professional judgment of a supervising health care professional or as designated by a health care facility.

(x) "Protected health information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(y) "Research" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(z) "State agency" means an instrumentality of the State of Illinois and any instrumentality of another state that, pursuant to applicable law or a written undertaking with an instrumentality of the State of Illinois, is bound to protect the privacy of HIV-related information of Illinois persons.

(aa) "Test" or "HIV test" means a test to determine the presence of the antibody or antigen to HIV, or of HIV infection.

(bb) "Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(cc) "Use" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103, where context dictates.

(Source: P.A. 99-54, eff. 1-1-16; 99-173, eff. 7-29-15; 99-642, eff. 7-28-16; 100-513, eff. 1-1-18.)

Section 30. The Genetic Information Privacy Act is amended by changing Section 10 as follows:

(410 ILCS 513/10)

Sec. 10. Definitions. As used in this Act:

"Office" means the Illinois Health Information Exchange Office established pursuant to the Illinois Health Information Exchange and Technology Act.

"Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"De-identified information" means health information that is not individually identifiable as described under HIPAA, as specified in 45 CFR 164.514(b).

"Disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.

"Employment agency" means both public and private employment agencies and any person, labor organization, or labor union having a hiring hall or hiring office regularly undertaking, with or without compensation, to procure opportunities to work, or to procure, recruit, refer, or place employees.

"Family member" means, with respect to an individual, (i) the spouse of the individual; (ii) a dependent child of the individual, including a child who is born to or placed for adoption with the individual; (iii) any other person qualifying as a covered dependent under a managed care plan; and (iv) all other individuals related by blood or law to the individual or the spouse or child described in subsections (i) through (iii) of this definition.

"Genetic information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Genetic monitoring" means the periodic examination of employees to evaluate acquired modifications to their genetic material, such as chromosomal damage or evidence of increased occurrence of mutations that may have developed in the course of employment due to exposure to toxic substances in the workplace in order to identify, evaluate, and respond to effects of or control adverse environmental exposures in the workplace.

"Genetic services" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Genetic testing" and "genetic test" have the meaning ascribed to "genetic test" under HIPAA, as specified in 45 CFR 160.103. "Genetic testing" includes direct-to-consumer commercial genetic testing.

"Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Health care professional" means (i) a licensed physician, (ii) a licensed physician assistant, (iii) a licensed advanced practice registered nurse, (iv) a licensed dentist, (v) a licensed podiatrist, (vi) a licensed genetic counselor, or (vii) an individual certified to provide genetic testing by a state or local public health department.

"Health care provider" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Health facility" means a hospital, blood bank, blood center, sperm bank, or other health care institution, including any "health facility" as that term is defined in the Illinois Finance Authority Act.

"Health information exchange" or "HIE" means a health information exchange or health information organization that exchanges health information electronically that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules promulgated thereunder; (ii) has established a data sharing arrangement with the Office; or (iii) as of August 16, 2013, was designated by the Illinois Health Information Exchange Authority (now Office) Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee. In certain circumstances, in accordance with HIPAA, an HIE will be a business associate.

"Health oversight agency" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.

"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.

"Labor organization" includes any organization, labor union, craft union, or any voluntary unincorporated association designed to further the cause of the rights of union labor that is constituted for the purpose, in whole or in part, of collective bargaining or of dealing with employers concerning grievances, terms or conditions of employment, or apprenticeships or applications for apprenticeships, or of other mutual aid or protection in connection with employment, including apprenticeships or applications for apprenticeships.

"Licensing agency" means a board, commission, committee, council, department, or officers, except a judicial officer, in this State or any political subdivision authorized to grant, deny, renew, revoke, suspend, annul, withdraw, or amend a license or certificate of registration.

"Limited data set" has the meaning ascribed to it under HIPAA, as described in 45 CFR 164.514(e)(2).

"Managed care plan" means a plan that establishes, operates, or maintains a network of health care providers that have entered into agreements with the plan to provide health care services to enrollees where the plan has the ultimate and direct contractual obligation to the enrollee to arrange for the provision of or pay for services through:

(1) organizational arrangements for ongoing quality assurance, utilization review programs, or dispute resolution; or

(2) financial incentives for persons enrolled in the plan to use the participating providers and procedures covered by the plan.

A managed care plan may be established or operated by any entity including a licensed insurance company, hospital or medical service plan, health maintenance organization, limited health service organization, preferred provider organization, third party administrator, or an employer or employee organization.

"Minimum necessary" means HIPAA's standard for using, disclosing, and requesting protected health information found in 45 CFR 164.502(b) and 164.514(d).

"Nontherapeutic purpose" means a purpose that is not intended to improve or preserve the life or health of the individual whom the information concerns.

"Organized health care arrangement" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Patient safety activities" has the meaning ascribed to it under 42 CFR 3.20.

"Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity.

"Protected health information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.103.

"Research" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"State agency" means an instrumentality of the State of Illinois and any instrumentality of another state which pursuant to applicable law or a written undertaking with an instrumentality of the State of Illinois is bound to protect the privacy of genetic information of Illinois persons.

"Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Use" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103, where context dictates.

(Source: P.A. 100-513, eff. 1-1-18; 101-132, eff. 1-1-20; 101-649, eff. 7-7-20.)

Section 35. The Mental Health and Developmental Disabilities Confidentiality Act is amended by changing Sections 2, 9.5, 9.6, 9.8, 9.9, and 9.11 as follows:

(740 ILCS 110/2) (from Ch. 91 1/2, par. 802)

Sec. 2. The terms used in this Act, unless the context requires otherwise, have the meanings ascribed to them in this Section.

"Agent" means a person who has been legally appointed as an individual's agent under a power of attorney for health care or for property.

"Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Confidential communication" or "communication" means any communication made by a recipient or other person to a therapist or to or in the presence of other persons during or in connection with providing mental health or developmental disability services to a recipient. Communication includes information which indicates that a person is a recipient. "Communication" does not include information that has been de-identified in accordance with HIPAA, as specified in 45 CFR 164.514.

"Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Guardian" means a legally appointed guardian or conservator of the person.

"Health information exchange" or "HIE" means a health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules promulgated thereunder; or (ii) has established a data sharing arrangement with the Illinois Health Information Exchange; or (iii) as of the effective date of this amendatory Act of the 98th General Assembly, was designated by the Illinois Health Information Exchange Office Board as a member of, or was represented on, the Office Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee.

"HIE purposes" means those uses and disclosures (as those terms are defined under HIPAA, as specified in 45 CFR 160.103) for activities of an HIE: (i) set forth in the Illinois Health Information Exchange and Technology Act or any subsequent amendments thereto and any administrative rules promulgated thereunder; or (ii) which are permitted under federal law.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and any subsequent amendments thereto and any regulations promulgated thereunder, including the Security Rule, as specified in 45 CFR 164.302-18, and the Privacy Rule, as specified in 45 CFR 164.500-34.

"Integrated health system" means an organization with a system of care which incorporates physical and behavioral healthcare and includes care delivered in an inpatient and outpatient setting.

"Interdisciplinary team" means a group of persons representing different clinical disciplines, such as medicine, nursing, social work, and psychology, providing and coordinating the care and treatment for a recipient of mental health or developmental disability services. The group may be composed of individuals employed by one provider or multiple providers.

"Mental health or developmental disabilities services" or "services" includes but is not limited to examination, diagnosis, evaluation, treatment, training, pharmaceuticals, aftercare, habilitation or rehabilitation.

"Personal notes" means:

(i) information disclosed to the therapist in confidence by other persons on condition that such information would never be disclosed to the recipient or other persons;

(ii) information disclosed to the therapist by the recipient which would be injurious to the recipient's relationships to other persons, and

(iii) the therapist's speculations, impressions, hunches, and reminders.

"Parent" means a parent or, in the absence of a parent or guardian, a person in loco parentis.

"Recipient" means a person who is receiving or has received mental health or developmental disabilities services.

"Record" means any record kept by a therapist or by an agency in the course of providing mental health or developmental disabilities service to a recipient concerning the recipient and the services provided. "Records" includes all records maintained by a court that have been created in connection with, in preparation for, or as a result of the filing of any petition or certificate under Chapter II, Chapter III, or Chapter IV of the Mental Health and Developmental Disabilities Code and includes the petitions, certificates, dispositional reports, treatment plans, and reports of diagnostic evaluations and of hearings under Article VIII of Chapter III or under Article V of Chapter IV of that Code. Record does not include the therapist's personal notes, if such notes are kept in the therapist's sole possession for his own personal use and are not disclosed to any other person, except the therapist's supervisor, consulting therapist or attorney. If at any time such notes are disclosed, they shall be considered part of the recipient's record for purposes of this Act. "Record" does not include information that has been de-identified in accordance with HIPAA, as specified in 45 CFR 164.514. "Record" does not include a reference to the receipt of mental health or developmental disabilities services noted during a patient history and physical or other summary of care.

"Record custodian" means a person responsible for maintaining a recipient's record.

"Therapist" means a psychiatrist, physician, psychologist, social worker, or nurse providing mental health or developmental disabilities services or any other person not prohibited by law from providing such services or from holding himself out as a therapist if the recipient reasonably believes that such person is permitted to do so. Therapist includes any successor of the therapist.

"Therapeutic relationship" means the receipt by a recipient of mental health or developmental disabilities services from a therapist. "Therapeutic relationship" does not include independent evaluations for a purpose other than the provision of mental health or developmental disabilities services.

(Source: P.A. 101-649, eff. 7-7-20.)

(740 ILCS 110/9.5)

Sec. 9.5. Use and disclosure of information to an HIE.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, or covered entity may, without a recipient's consent, use or disclose information from a recipient's record in connection with an HIE, including disclosure to the Illinois Health Information Exchange Office, an HIE, or the business associate of either. An HIE and its business associate may, without a recipient's consent, use or disclose and re-disclose such information for HIE purposes or for such other purposes as are specifically allowed under this Act.

(b) As used in this Section:

(1) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code; and

(2) the terms "disclosure" and "use" have the meanings ascribed to them under HIPAA, as specified in 45 CFR 160.103.

(Source: P.A. 101-649, eff. 7-7-20.)

(740 ILCS 110/9.6)

Sec. 9.6. HIE opt-out. Participants of The Illinois Health Information Exchange Office shall, through appropriate rules, standards, or contractual obligations, which shall be binding upon any HIE, as defined under Section 2, shall allow require that participants of such HIE provide each recipient whose record is accessible through the health information exchange the reasonable opportunity to expressly decline the further disclosure of the record by the health information exchange to third parties, except to the extent permitted by law such as for purposes of public health reporting. The HIE participants These rules, standards, or contractual obligations shall permit a recipient to revoke a prior decision to opt-out or a decision not to opt-out. These rules, standards, or contractual obligations shall provide for written notice of a recipient's right to opt-out which directs the recipient to a health information exchange website containing (i) an explanation of the purposes of the health information exchange; and (ii) audio, visual, and written instructions on how to opt-out of participation in whole or in part to the extent possible. The process for effectuating an opt-out These rules, standards, or contractual obligations shall be reviewed by the HIE participants annually and updated as the technical options develop. The recipient shall be provided meaningful disclosure regarding the health information exchange, and the recipient's decision whether to opt-out should be obtained without undue inducement or any element of force, fraud, deceit, duress, or other form of constraint or coercion. To the extent that HIPAA, as specified in 45 CFR 164.508(b)(4), prohibits a covered entity from conditioning the provision of its services upon an individual's provision of an authorization, an HIE participant shall not condition the provision of its services upon a recipient's decision to opt-out of further disclosure of the record by an HIE to third parties. The Illinois Health Information Exchange Office shall, through appropriate rules, standards, or contractual obligations, which shall be binding upon any HIE, as defined under Section 2, give consideration to the format and content of the meaningful disclosure and the availability to recipients of information regarding an HIE and the rights of recipients under this Section to expressly decline the further disclosure of the record by an HIE to third parties. The HIE participants Illinois Health Information Exchange Office shall also give annual consideration to enable a recipient to expressly decline the further disclosure by an HIE to third parties of selected portions of the recipient's record while permitting disclosure of the recipient's remaining patient health information. In giving establishing rules, standards, or contractual obligations binding upon HIEs under this Section to give effect to recipient disclosure preferences, the HIE participants Illinois Health Information Exchange Office in its discretion may consider the extent to which relevant health information technologies reasonably available to therapists and HIEs in this State reasonably enable the effective segmentation of specific information within a recipient's electronic medical record and reasonably enable the effective exclusion of specific information from disclosure by an HIE to third parties, as well as the availability of sufficient authoritative clinical guidance to enable the practical application of such technologies to effect recipient disclosure preferences. The provisions of this Section 9.6 shall not apply to the secure electronic transmission of data which is point-to-point communication directed by the data custodian. Any rules or standards promulgated under this Section which apply to HIEs shall be limited to that subject matter required by this Section and shall not include any requirement that an HIE enter a data sharing arrangement or otherwise participate with the Illinois Health Information Exchange. In connection with its annual consideration regarding the issue of segmentation of information within a medical record and prior to the adoption of any rules or standards regarding that issue, the Office Board shall consider information provided by affected persons or organizations regarding the feasibility, availability, cost, reliability, and interoperability of any technology or process under consideration by the Board. Nothing in this Act shall be construed to limit the authority of the Illinois Health Information Exchange Office to impose limits or conditions on consent for disclosures to or through any HIE, as defined under Section 2, which are more restrictive than the requirements under this Act or under HIPAA.

(Source: P.A. 101-649, eff. 7-7-20.)

(740 ILCS 110/9.8)

Sec. 9.8. Business associates. An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Office, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, utilize the services of and disclose information from a recipient's record to a business associate, as defined by and in accordance with the requirements set forth under HIPAA. As used in this Section, the term "disclosure" has the meaning ascribed to it by HIPAA, as specified in 45 CFR 160.103.

(Source: P.A. 101-649, eff. 7-7-20.)

(740 ILCS 110/9.9)

Sec. 9.9. Record locator service.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Office, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, disclose the existence of a recipient's record to a record locator service, master patient index, or other directory or services necessary to support and enable the establishment and operation of an HIE.

(b) As used in this Section:

(1) the term "disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103; and

(2) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code.

(Source: P.A. 101-649, eff. 7-7-20.)

(740 ILCS 110/9.11)

Sec. 9.11. Establishment and disclosure of limited data sets and de-identified information.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Office, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, use information from a recipient's record to establish, or disclose such information to a business associate to establish, and further disclose information from a recipient's record as part of a limited data set as defined by and in accordance with the requirements set forth under HIPAA, as specified in 45 CFR 164.514(e). An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Office, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, use information from a recipient's record or disclose information from a recipient's record to a business associate to de-identity the information in accordance with HIPAA, as specified in 45 CFR 164.514.

(b) As used in this Section:

(1) the terms "disclosure" and "use" shall have the meanings ascribed to them by HIPAA, as specified in 45 CFR 160.103; and

(2) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code.

(Source: P.A. 101-649, eff. 7-7-20.)

Section 40. The Workers' Compensation Act is amended by changing Section 8.2a as follows:

(820 ILCS 305/8.2a)

Sec. 8.2a. Electronic claims.

(a) The Director of Insurance shall adopt rules to do all of the following:

(1) Ensure that all health care providers and facilities submit medical bills for payment on standardized forms.

(2) Require acceptance by employers and insurers of electronic claims for payment of medical services.

(3) Ensure confidentiality of medical information submitted on electronic claims for payment of medical services.

(4) Ensure that health care providers have an opportunity to comply with requests for records by employers and insurers for the authorization of the payment of workers' compensation claims.

(5) Ensure that health care providers are responsible for supplying only those medical records pertaining to the provider's own claims that are minimally necessary under the federal Health Insurance Portability and Accountability Act of 1996.

(6) Provide that any electronically submitted bill determined to be complete but not paid or objected to within 30 days shall be subject to interest pursuant to item (3) of subsection (d) of Section 8.2.

(7) Provide that the Department of Insurance shall impose an administrative fine if it determines that an employer or insurer has failed to comply with the electronic claims acceptance and response process. The amount of the administrative fine shall be no greater than $1,000 per each violation, but shall not exceed $10,000 for identical violations during a calendar year.

(b) To the extent feasible, standards adopted pursuant to subdivision (a) shall be consistent with existing standards under the federal Health Insurance Portability and Accountability Act of 1996 and standards adopted under the Illinois Health Information Exchange and Technology Act.

(c) The rules requiring employers and insurers to accept electronic claims for payment of medical services shall be proposed on or before January 1, 2012, and shall require all employers and insurers to accept electronic claims for payment of medical services on or before June 30, 2012. The Director of Insurance shall adopt rules by January 1, 2019 to implement the changes to this Section made by this amendatory Act of the 100th General Assembly. The Commission, with assistance from the Department and the Medical Fee Advisory Board, shall publish on its Internet website a companion guide to assist with compliance with electronic claims rules. The Medical Fee Advisory Board shall periodically review the companion guide.

(d) The Director of Insurance shall by rule establish criteria for granting exceptions to employers, insurance carriers, and health care providers who are unable to submit or accept medical bills electronically.

(Source: P.A. 100-1117, eff. 11-27-18.)

Section 99. Effective date. This Act takes effect July 1, 2023.