Section 550.130  Confidentiality and Availability of Data

a)         All reports and records made pursuant to the Act and maintained by the Department and other appropriate persons, officials and institutions pursuant to the Act shall be confidential. Information shall not be made available to any individual or institution except to:

1)         Appropriate staff of the Department;

2)         Any person engaged in a bona fide research project, with the permission of the Director of Public Health, except that no information identifying the subjects of the reports or the reporters shall be made available to researchers unless the Department requests and receives consent for such release pursuant to the provisions of this Section;

3)         The Council, except that no information identifying the subjects of the reports or the reporters shall be made available to the Council unless consent for release is requested and received pursuant to the provisions of this Section. Only information pertaining to head and spinal cord injuries as defined in Section 1 of the Act shall be released to the Council. (Section 3 of the Act); and

4)         The Department for the purpose of injury prevention or determining the impact of head and spinal cord injuries.

A)        All information and data shared with the Department shall be kept confidential and limited to the scope of the project. No data may be shared with the Department that could lead to the identity of any facility, or the identity of any person whose condition or treatment is submitted to the Department.

B)        The Department requesting data shall enter into a written agreement with the Division of EMS which shall include, at minimum:

i)          Data being requested;

ii)         Proposed usage of data;

iii)        Responsible Individual charged with ensuring the confidentiality of the data.

C)        The written agreement must be approved by the providing and receiving Department Deputy Director and the Director of the Department.

b)         The Department shall not reveal the identity of a patient, physician or hospital, except that the identity of the patient may be released upon written consent of the patient, parent (in the case of a minor patient) or guardian, the identity of the physician may be released upon written consent of the physician; and the identity of the hospital may be released upon written consent of the hospital. (Section 3 of the Act)

c)         The Department shall request consent for release from a patient, a physician or hospital only upon a showing by the applicant for such release that obtaining the identities of certain patients, physicians or hospitals is necessary for his bona fide research directly related to the objectives of the Act. (Section 3 of the Act)

d)         The Department shall at least annually compile a report of the data accumulated through the reporting system established under Section 2 of the Act and shall submit such data relating to spinal cord and head injuries in accordance with confidentiality restrictions established pursuant to the Act to the Council. (Section 3 of the Act)

e)         Head and Spinal Cord Injury Registry data may be provided for medical or epidemiological research by bona fide scientific researchers in accordance with subsection (f). All requests by bona fide scientific researchers for such data must be submitted in writing to the Department at https://dph.illinois.gov/data-statistics/institutional-review-board.html. The request must include a study protocol that contains:  objectives of the research; rationale for the research including scientific literature justifying the current proposal; overall study methods, including copies of forms, questionnaires, and consent forms used to contact facilities, physicians or study subjects; methods for the processing of data; storage and security measures taken to ensure confidentiality of patient and facility identifying information; time frame of the study; a description of the funding source of the study (e.g., federal contract); the curriculum vitae of the principal researcher and a list of collaborators. In addition, the research request must specify what patient or facility identifying information is needed and how the information will be used.

f)         All requests to conduct research and modifications to approved research proposals involving the use of data that includes patient or facility identifying information shall be subject to a review to determine compliance with all the following conditions:

1)         The request for patient or facility identifying information contains stated goals or objectives.

2)         The request documents the feasibility of the study design in achieving the stated goals and objectives.

3)         The request documents the need for the requested data to achieve the stated goals and objectives.

4)         The requested data can be provided within the time frame set forth in the request.

5)         The request clearly documents that the principal researcher has qualifications relevant to the type of research being conducted and qualifies as a bona fide researcher.

6)         The research will not duplicate other research already underway using the same registry data when both require the contact of a patient, reporting facility or physician about an individual patient involved in the previously approved concurrent research.

7)         Other such conditions relevant to the need for the patient or facility identifying information and the patient's confidentiality rights. The Department will only release the patient, physician in accordance with the provisions of this Section, or facility identifying information that is necessary for the research.

g)         The Department will enter into a written Research Agreement for all approved research requests. The Agreement shall specify the information that is being released and how it can be used, in accordance with subsection (e) above. The Department will only provide available data relevant to the goals and objectives of the specific research approved by the Department.

h)         The identity of any facility or individual, or any group of facts that tends to lead to the identity of any person whose condition or treatment is submitted to the Department, shall not be open to public inspection or dissemination.

i)          Every hospital shall provide representatives of the Department with access to information from all medical, pathological, and other pertinent records and logs related to reportable registry information. The Department shall not require hospitals to provide information on cases that are dated more than two years before the Department's request for further information.

j)          Every hospital shall provide access to information regarding specified patients or other patients specified for research studies, related to reportable registry information, conducted by the Department.

(Source:  Amended at 46 Ill. Reg. 15700, effective August 30, 2022)