Public Act 1046 98TH GENERAL ASSEMBLY

HB5925 Enrolled LRB098 20292 RPM 55726 b

Public Act 098-1046

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. The Illinois Health Information Exchange and Technology Act is amended by changing Section 40 as follows:

(20 ILCS 3860/40)

(Section scheduled to be repealed on January 1, 2021)

Sec. 40. Reliance on data. Any health care provider who relies in good faith upon any information provided through the ILHIE in his, her, or its treatment of a patient shall be immune from criminal or civil liability or professional discipline arising from any damages caused by such good faith reliance. This immunity does not apply to acts or omissions constituting gross negligence or reckless, wanton, or intentional misconduct. Notwithstanding this provision, the Authority does not waive any immunities provided under State or federal law.

(Source: P.A. 96-1331, eff. 7-27-10.)

Section 5. The Illinois Clinical Laboratory and Blood Bank Act is amended by adding Sections 2-134, 2-135, 2-136, and 2-137 and by changing Section 7-102 as follows:

(210 ILCS 25/2-134 new)

Sec. 2-134. Health care operations. "Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(210 ILCS 25/2-135 new)

Sec. 2-135. HIPAA. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information and Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.

(210 ILCS 25/2-136 new)

Sec. 2-136. Payment. "Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(210 ILCS 25/2-137 new)

Sec. 2-137. Treatment. "Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(210 ILCS 25/7-102) (from Ch. 111 1/2, par. 627-102)

Sec. 7-102. Reports of test results.

(a) Clinical laboratory test results may be reported or transmitted to:

(1) the licensed physician or other authorized person who requested the test, their designee, or both;

(2) any health care provider who is providing treatment to the patient;

(3) an electronic health information exchange for the purposes of transmitting, using, or disclosing clinical laboratory test results in any manner required or permitted by HIPAA. The result of a test shall be reported directly to the licensed physician or other authorized person who requested it.

(b) No interpretation, diagnosis, or prognosis or suggested treatment shall appear on the laboratory report form, except that a report made by a physician licensed to practice medicine in Illinois, a dentist licensed in Illinois, or an optometrist licensed in Illinois may include such information.

(c) Nothing in this Act prohibits the sharing of information as authorized in Section 2.1 of the Department of Public Health Act.

(Source: P.A. 98-185, eff. 1-1-14.)

Section 7. The Medical Patient Rights Act is amended by changing Section 3 as follows:

(410 ILCS 50/3) (from Ch. 111 1/2, par. 5403)

Sec. 3. The following rights are hereby established:

(a) The right of each patient to care consistent with sound nursing and medical practices, to be informed of the name of the physician responsible for coordinating his or her care, to receive information concerning his or her condition and proposed treatment, to refuse any treatment to the extent permitted by law, and to privacy and confidentiality of records except as otherwise provided by law.

(b) The right of each patient, regardless of source of payment, to examine and receive a reasonable explanation of his total bill for services rendered by his physician or health care provider, including the itemized charges for specific services received. Each physician or health care provider shall be responsible only for a reasonable explanation of those specific services provided by such physician or health care provider.

(c) In the event an insurance company or health services corporation cancels or refuses to renew an individual policy or plan, the insured patient shall be entitled to timely, prior notice of the termination of such policy or plan.

An insurance company or health services corporation that requires any insured patient or applicant for new or continued insurance or coverage to be tested for infection with human immunodeficiency virus (HIV) or any other identified causative agent of acquired immunodeficiency syndrome (AIDS) shall (1) give the patient or applicant prior written notice of such requirement, (2) proceed with such testing only upon the written authorization of the applicant or patient, and (3) keep the results of such testing confidential. Notice of an adverse underwriting or coverage decision may be given to any appropriately interested party, but the insurer may only disclose the test result itself to a physician designated by the applicant or patient, and any such disclosure shall be in a manner that assures confidentiality.

The Department of Insurance shall enforce the provisions of this subsection.

(d) The right of each patient to privacy and confidentiality in health care. Each physician, health care provider, health services corporation and insurance company shall refrain from disclosing the nature or details of services provided to patients, except that such information may be disclosed: (1) to the patient, (2) to the party making treatment decisions if the patient is incapable of making decisions regarding the health services provided, (3) for those parties directly involved with providing treatment in accordance with 45 CFR 164.501 and 164.506, (4) for to the patient or processing the payment in accordance with 45 CFR 164.501 and 164.506, (5) to for that treatment, those parties responsible for peer review, utilization review, and quality assurance, (6) for health care operations in accordance with 45 CFR 164.501 and 164.506, (7) to and those parties required to be notified under the Abused and Neglected Child Reporting Act or , the Illinois Sexually Transmissible Disease Control Act, or (8) as where otherwise permitted, authorized, or required by State or federal law. This right may be waived in writing by the patient or the patient's guardian or legal representative, but a physician or other health care provider may not condition the provision of services on the patient's, or guardian's, or legal representative's agreement to sign such a waiver. In the interest of public health, safety, and welfare, patient information, including, but not limited to, health information, demographic information, and information about the services provided to patients, may be transmitted to or through a health information exchange, as that term is defined in Section 2 of the Mental Health and Developmental Disabilities Confidentiality Act, in accordance with the disclosures permitted pursuant to this Section. Patients shall be provided the opportunity to opt out of their health information being transmitted to or through a health information exchange in accordance with the regulations, standards, or contractual obligations adopted by the Illinois Health Information Exchange Authority in accordance with Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, Section 9.6 of the AIDS Confidentiality Act, or Section 31.8 of the Genetic Information Privacy Act, as applicable. In the case of a patient choosing to opt out of having his or her information available on an HIE, nothing in this Act shall cause the physician or health care provider to be liable for the release of a patient's health information by other entities that may possess such information, including, but not limited to, other health professionals, providers, laboratories, pharmacies, hospitals, ambulatory surgical centers, and nursing homes.

(Source: P.A. 86-895; 86-902; 86-1028; 87-334.)

Section 10. The AIDS Confidentiality Act is amended by changing Sections 2, 3, 9, 10, and 16 and by adding Sections 9.1, 9.2, 9.3, 9.4, 9.4a, 9.6, 9.7, 9.8, 9.9, and 9.10 as follows:

(410 ILCS 305/2) (from Ch. 111 1/2, par. 7302)

Sec. 2. The General Assembly finds that:

(1) The use of tests designed to reveal a condition indicative of Human Immunodeficiency Virus (HIV) infection can be a valuable tool in protecting the public health.

(2) Despite existing laws, regulations and professional standards which require or promote the informed, voluntary and confidential use of tests designed to reveal HIV infection, many members of the public are deterred from seeking such testing because they misunderstand the nature of the test or fear that test results or other health information that reveals their HIV status will be disclosed without their consent.

(3) The public health will be served by facilitating informed, voluntary and confidential use of tests designed to reveal HIV infection and appropriately protecting the health information privacy of patients who are HIV-positive.

(4) The public health will also be served by expanding the availability of informed, voluntary, and confidential HIV testing and treatment and making HIV testing a routine part of general medical care, as recommended by the United States Centers for Disease Control and Prevention.

(5) The use of electronic health record systems and the exchange of electronic patient records, both paper and electronic, through secure means, including through secure health information exchanges, should be encouraged to improve patient health care and care coordination, facilitate public health reporting, and control health care costs, among other purposes.

(6) Limiting the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish an intended purpose, when being transmitted by or on behalf of a covered entity under HIPAA, is a key component of health information privacy. The disclosure of HIV-related information, when allowed by this Act, shall be performed in accordance with the minimum necessary standard when required under HIPAA.

(Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/3) (from Ch. 111 1/2, par. 7303)

Sec. 3. When used in this Act:

(a) "AIDS" means acquired immunodeficiency syndrome.

(b) "Authority" means the Illinois Health Information Exchange Authority established pursuant to the Illinois Health Information Exchange and Technology Act.

(c) "Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(d) "Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(e) "De-identified information" means health information that is not individually identifiable as described under HIPAA, as specified in 45 CFR 164.514(b).

(f) (a) "Department" means the Illinois Department of Public Health or its designated agents.

(g) "Disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(h) "Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(i) "Health care professional" means (i) a licensed physician, (ii) a physician assistant to whom the physician assistant's supervising physician has delegated the provision of AIDS and HIV-related health services, (iii) an advanced practice registered nurse who has a written collaborative agreement with a collaborating physician which authorizes the provision of AIDS and HIV-related health services, (iv) a licensed dentist, (v) a licensed podiatric physician, or (vi) an individual certified to provide HIV testing and counseling by a state or local public health department.

(j) "Health care provider" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(b) "AIDS" means acquired immunodeficiency syndrome.

(c) "HIV" means the Human Immunodeficiency Virus or any other identified causative agent of AIDS.

(d) "Informed consent" means a written or verbal agreement by the subject of a test or the subject's legally authorized representative without undue inducement or any element of force, fraud, deceit, duress or other form of constraint or coercion, which entails at least the following pre-test information:

(1) a fair explanation of the test, including its purpose, potential uses, limitations and the meaning of its results; and

(2) a fair explanation of the procedures to be followed, including the voluntary nature of the test, the right to withdraw consent to the testing process at any time, the right to anonymity to the extent provided by law with respect to participation in the test and disclosure of test results, and the right to confidential treatment of information identifying the subject of the test and the results of the test, to the extent provided by law.

Pre-test information may be provided in writing, verbally, or by video, electronic, or other means. The subject must be offered an opportunity to ask questions about the HIV test and decline testing. Nothing in this Act shall prohibit a health care provider from combining a form used to obtain informed consent for HIV testing with forms used to obtain written consent for general medical care or any other medical test or procedure provided that the forms make it clear that the subject may consent to general medical care, tests, or medical procedures without being required to consent to HIV testing and clearly explain how the subject may opt-out of HIV testing.

(k) (e) "Health facility" means a hospital, nursing home, blood bank, blood center, sperm bank, or other health care institution, including any "health facility" as that term is defined in the Illinois Finance Authority Act.

(l) "Health information exchange" or "HIE" means a health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules adopted thereunder; (ii) has established a data sharing arrangement with the Authority; or (iii) as of August 16, 2013, was designated by the Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee. In certain circumstances, in accordance with HIPAA, an HIE will be a business associate.

(m) "Health oversight agency" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(n) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.

(o) "HIV" means the human immunodeficiency virus.

(p) "HIV-related information" means the identity of a person upon whom an HIV test is performed, the results of an HIV test, as well as diagnosis, treatment, and prescription information that reveals a patient is HIV-positive, including such information contained in a limited data set. "HIV-related information" does not include information that has been de-identified in accordance with HIPAA.

(q) "Informed consent" means a written or verbal agreement by the subject of a test or the subject's legally authorized representative without undue inducement or any element of force, fraud, deceit, duress, or other form of constraint or coercion, which entails at least the following pre-test information:

(1) a fair explanation of the test, including its purpose, potential uses, limitations, and the meaning of its results;

(2) a fair explanation of the procedures to be followed, including the voluntary nature of the test, the right to withdraw consent to the testing process at any time, the right to anonymity to the extent provided by law with respect to participation in the test and disclosure of test results, and the right to confidential treatment of information identifying the subject of the test and the results of the test, to the extent provided by law; and

(3) where the person providing informed consent is a participant in an HIE, a fair explanation that the results of the patient's HIV test will be accessible through an HIE and meaningful disclosure of the patient's opt-out right under Section 9.6 of this Act.

Pre-test information may be provided in writing, verbally, or by video, electronic, or other means. The subject must be offered an opportunity to ask questions about the HIV test and decline testing. Nothing in this Act shall prohibit a health care provider or health care professional from combining a form used to obtain informed consent for HIV testing with forms used to obtain written consent for general medical care or any other medical test or procedure provided that the forms make it clear that the subject may consent to general medical care, tests, or medical procedures without being required to consent to HIV testing and clearly explain how the subject may opt out of HIV testing.

(r) "Limited data set" has the meaning ascribed to it under HIPAA, as described in 45 CFR 164.514(e)(2).

(s) "Minimum necessary" means the HIPAA standard for using, disclosing, and requesting protected health information found in 45 CFR 164.502(b) and 164.514(d).

(t) "Organized health care arrangement" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(u) "Patient safety activities" has the meaning ascribed to it under 42 CFR 3.20.

(v) "Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(w) "Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity.

(x) "Protected health information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

(y) "Research" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(z) "State agency" means an instrumentality of the State of Illinois and any instrumentality of another state that, pursuant to applicable law or a written undertaking with an instrumentality of the State of Illinois, is bound to protect the privacy of HIV-related information of Illinois persons.

(f) "Health care provider" means any health care professional, nurse, paramedic, psychologist or other person providing medical, nursing, psychological, or other health care services of any kind.

(f-5) "Health care professional" means (i) a licensed physician, (ii) a physician assistant to whom the physician assistant's supervising physician has delegated the provision of AIDS and HIV-related health services, (iii) an advanced practice registered nurse who has a written collaborative agreement with a collaborating physician which authorizes the provision of AIDS and HIV-related health services, (iv) a licensed dentist, (v) a licensed podiatric physician, or (vi) an individual certified to provide HIV testing and counseling by a state or local public health department.

(aa) (g) "Test" or "HIV test" means a test to determine the presence of the antibody or antigen to HIV, or of HIV infection.

(bb) "Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

(cc) "Use" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103, where context dictates.

(h) "Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility or other legal entity.

(Source: P.A. 98-214, eff. 8-9-13.)

(410 ILCS 305/9) (from Ch. 111 1/2, par. 7309)

Sec. 9. (1) No person may disclose or be compelled to disclose HIV-related information the identity of any person upon whom a test is performed, or the results of such a test in a manner which permits identification of the subject of the test, except to the following persons:

(a) The subject of an HIV the test or the subject's legally authorized representative. A physician may notify the spouse of the test subject, if the test result is positive and has been confirmed pursuant to rules adopted by the Department, provided that the physician has first sought unsuccessfully to persuade the patient to notify the spouse or that, a reasonable time after the patient has agreed to make the notification, the physician has reason to believe that the patient has not provided the notification. This paragraph shall not create a duty or obligation under which a physician must notify the spouse of the test results, nor shall such duty or obligation be implied. No civil liability or criminal sanction under this Act shall be imposed for any disclosure or non-disclosure of a test result to a spouse by a physician acting in good faith under this paragraph. For the purpose of any proceedings, civil or criminal, the good faith of any physician acting under this paragraph shall be presumed.

(b) Any person designated in a legally effective authorization for release of the HIV-related information test results executed by the subject of the HIV-related information test or the subject's legally authorized representative.

(c) An authorized agent or employee of a health facility or health care provider if the health facility or health care provider itself is authorized to obtain the test results, the agent or employee provides patient care or handles or processes specimens of body fluids or tissues, and the agent or employee has a need to know such information.

(d) The Department and local health authorities serving a population of over 1,000,000 residents or other local health authorities as designated by the Department, in accordance with rules for reporting, preventing, and controlling the spread of disease and the conduct of public health surveillance, public health investigations, and public health interventions, as otherwise provided by State law. The Department, local health authorities, and authorized representatives shall not disclose HIV test results and HIV-related information and records held by them relating to known or suspected cases of AIDS or HIV infection, publicly or in any action of any kind in any court or before any tribunal, board, or agency. HIV test results and HIV-related information AIDS and HIV infection data shall be protected from disclosure in accordance with the provisions of Sections 8-2101 through 8-2105 of the Code of Civil Procedure.

(e) A health facility, or health care provider, or health care professional which procures, processes, distributes or uses: (i) a human body part from a deceased person with respect to medical information regarding that person; or (ii) semen provided prior to the effective date of this Act for the purpose of artificial insemination.

(f) Health facility staff committees for the purposes of conducting program monitoring, program evaluation or service reviews.

(f-5) A court in accordance with the provisions of Section 12-5.01 of the Criminal Code of 2012.

(g) (Blank).

(h) Any health care provider, health care professional, or employee of a health facility, and any firefighter or EMT-A, EMT-P, or EMT-I, involved in an accidental direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment.

(i) Any law enforcement officer, as defined in subsection (c) of Section 7, involved in the line of duty in a direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment.

(j) A temporary caretaker of a child taken into temporary protective custody by the Department of Children and Family Services pursuant to Section 5 of the Abused and Neglected Child Reporting Act, as now or hereafter amended.

(k) In the case of a minor under 18 years of age whose test result is positive and has been confirmed pursuant to rules adopted by the Department, the health care professional provider who ordered the test shall make a reasonable effort to notify the minor's parent or legal guardian if, in the professional judgment of the health care professional provider, notification would be in the best interest of the child and the health care professional provider has first sought unsuccessfully to persuade the minor to notify the parent or legal guardian or a reasonable time after the minor has agreed to notify the parent or legal guardian, the health care professional provider has reason to believe that the minor has not made the notification. This subsection shall not create a duty or obligation under which a health care professional provider must notify the minor's parent or legal guardian of the test results, nor shall a duty or obligation be implied. No civil liability or criminal sanction under this Act shall be imposed for any notification or non-notification of a minor's test result by a health care professional provider acting in good faith under this subsection. For the purpose of any proceeding, civil or criminal, the good faith of any health care professional provider acting under this subsection shall be presumed.

(2) All information and records held by a State agency, local health authority, or health oversight agency pertaining to HIV-related information shall be strictly confidential and exempt from copying and inspection under the Freedom of Information Act. The information and records shall not be released or made public by the State agency, local health authority, or health oversight agency, shall not be admissible as evidence nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person, and shall be treated in the same manner as the information and those records subject to the provisions of Part 21 of Article VIII of the Code of Civil Procedure, except under the following circumstances:

(A) when made with the written consent of all persons to whom the information pertains; or

(B) when authorized by Section 5-4-3 of the Unified Code of Corrections.

Disclosure shall be limited to those who have a need to know the information, and no additional disclosures may be made.

(Source: P.A. 96-328, eff. 8-11-09; 97-1046, eff. 8-21-12; 97-1150, eff. 1-25-13.)

(410 ILCS 305/9.1 new)

Sec. 9.1. Uses and disclosures for treatment, payment, and health care operations. Notwithstanding Sections 9 and 10 of this Act, a covered entity may, without a patient's consent:

(1) use or disclose HIV-related information for its own treatment, payment, or health care operations;

(2) disclose HIV-related information for treatment activities of a health care provider or health care professional;

(3) disclose HIV-related information to another covered entity or health care provider or health care professional for the payment activities of the entity that receives the information;

(4) disclose HIV-related information to another covered entity for health care operations activities of the entity that receives the information, if each entity has or had a relationship with the individual who is the subject of the HIV-related information being requested, the HIV-related information pertains to such relationship, and the disclosure is for the purpose of (A) conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management, and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (B) reviewing the competence or qualifications of health care professionals or health care providers, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities; or (C) health care fraud and abuse detection or compliance; and

(5) disclose HIV-related information to other participants in an organized health care arrangement in which the covered entity is also a participant for any health care operations activities of the organized health care arrangement.

(410 ILCS 305/9.2 new)

Sec. 9.2. Uses and disclosures for health oversight activities.

(a) Notwithstanding Sections 9 and 10 of this Act, a covered entity may disclose HIV-related information, without a patient's consent, to a health oversight agency for health oversight activities authorized by law, including audits, civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil administrative or criminal proceedings or actions; or other activities necessary for appropriate oversight of (i) the health care system; (ii) government benefit programs for which health information is relevant to beneficiary eligibility; (iii) entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or (iv) entities subject to civil rights laws for which health information is necessary for determining compliance.

(b) For purposes of the disclosures permitted by this Section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to (i) the receipt of health care; (ii) a claim for public benefits related to health; or (iii) qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services, except that, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of this Section.

(c) If a covered entity is also a health oversight agency, the covered entity may use HIV-related information for health oversight activities permitted by this Section.

(410 ILCS 305/9.3 new)

Sec. 9.3. Business associates.

(a) Notwithstanding Sections 9 and 10 of this Act, a covered entity may, without a patient's consent, disclose a patient's HIV-related information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains, through a written contract or other written agreement or arrangement that meets the applicable requirements of 45 CFR 164.504(e), satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(b) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(410 ILCS 305/9.4 new)

Sec. 9.4. Use and disclosure of information to an HIE. Notwithstanding the provisions of Sections 9 and 10 of this Act, a covered entity may, without a patient's consent, disclose the identity of any patient upon whom a test is performed and such patient's HIV-related information from a patient's record to an HIE if the disclosure is a required or permitted disclosure to a business associate or is a disclosure otherwise required or permitted under this Act. An HIE may, without a patient's consent, use or disclose such information to the extent it is allowed to use or disclose such information as a business associate in compliance with 45 CFR 164.502(e) or for such other purposes as are specifically allowed under this Act.

(410 ILCS 305/9.4a new)

Sec. 9.4a. Other disclosures. Nothing in this Act shall be construed (1) to limit the use of an HIE to facilitate disclosures permitted by this Act or (2) to allow for the disclosure of information from a patient's record to law enforcement or for law enforcement purposes.

(410 ILCS 305/9.6 new)

Sec. 9.6. HIE opt out. Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act is incorporated herein by reference. In addition to the requirements set out in Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, at the time of a patient's first encounter for HIV-related care with a health care provider, health care professional, or health facility that participates in an HIE, or, in the event of a medical emergency that makes it impossible, as soon thereafter as is practicable, the patient shall receive meaningful disclosure regarding the HIE in which the health care provider, health care professional, or health facility participates and shall be afforded an opportunity to opt out of disclosure of the patient's health information through the HIE.

(410 ILCS 305/9.7 new)

Sec. 9.7. Record locator service to support HIE. Section 9.9 of the Mental Health and Developmental Disabilities and Confidentiality Act is herein incorporated by reference.

(410 ILCS 305/9.8 new)

Sec. 9.8. Disclosure of limited data sets and de-identified information. Notwithstanding the provisions of Sections 9 and 10 of this Act:

(1) a covered entity may, without a patient's consent, create, use, and disclose a limited data set using HIV-related information from a patient's record or disclose HIV-related information from a patient's record to a business associate for the purpose of establishing a limited data set; the creation, use, and disclosure of such a limited data set must comply with the requirements set forth under HIPAA;

(2) a covered entity may, without a patient's consent, create, use, and disclose de-identified information using information from a patient's record that is subject to this Act or disclose HIV-related information from a patient's record to a business associate for the purpose of de-identifying the information; the creation, use, and disclosure of such de-identified data must comply with the requirements set forth under HIPAA. A covered entity or a business associate may disclose information that is de-identified; and

(3) the recipient of de-identified information shall not re-identify de-identified information using any public or private data source.

(410 ILCS 305/9.9 new)

Sec. 9.9. Research. HIV-related information may be disclosed for research in accordance with the requirements set forth under HIPAA.

(410 ILCS 305/9.10 new)

Sec. 9.10. Minimum necessary. When using and disclosing HIV-related information under this Act, a covered entity shall do so in accordance with the minimum necessary standard under HIPAA.

(410 ILCS 305/10) (from Ch. 111 1/2, par. 7310)

Sec. 10. No person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized under this Act by Section 9.

(Source: P.A. 85-677; 85-679.)

(410 ILCS 305/16) (from Ch. 111 1/2, par. 7316)

Sec. 16. The Department shall promulgate rules and regulations concerning implementation and enforcement of this Act, except to the extent that this Act delegates to the Authority the promulgation or adoption of any rules, regulations, standards, or contractual obligations. The rules and regulations promulgated by the Department pursuant to this Act may include procedures for taking appropriate action with regard to health care facilities or health care providers which violate this Act or the regulations promulgated hereunder. The provisions of The Illinois Administrative Procedure Act shall apply to all administrative rules and procedures of the Department pursuant to this Act, except that in case of conflict between The Illinois Administrative Procedure Act and this Act, the provisions of this Act shall control. The Department shall conduct training, technical assistance, and outreach activities, as needed, to implement routine HIV testing in healthcare medical settings.

(Source: P.A. 95-7, eff. 6-1-08.)

Section 15. The Genetic Information Privacy Act is amended by changing Sections 5, 10, 20, 25, 30, 35, and 40 and by adding Sections 31, 31.1, 31.2, 31.3, 31.4, 31.5, 31.6, 31.7, 31.8, 31.9, and 31.10 as follows:

(410 ILCS 513/5)

Sec. 5. Legislative findings; intent. The General Assembly finds that:

(1) The use of genetic testing can be valuable to an individual.

(2) Despite existing laws, regulations, and professional standards which require or promote voluntary and confidential use of genetic testing information, many members of the public are deterred from seeking genetic testing because of fear that test results will be disclosed without consent in a manner not permitted by law or will be used in a discriminatory manner.

(3) The public health will be served by facilitating voluntary and confidential nondiscriminatory use of genetic testing information.

(4) The use of electronic health record systems and the exchange of patient records, both paper and electronic, through secure means, including through secure health information exchanges, should be encouraged to improve patient health care and care coordination, facilitate public health reporting, and control health care costs, among other purposes.

(5) Limiting the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish an intended purpose, when being transmitted by or on behalf of a covered entity under HIPAA, is a key component of health information privacy. The disclosure of genetic information, when allowed by this Act, shall be performed in accordance with the minimum necessary standard when required under HIPAA.

(Source: P.A. 90-25, eff. 1-1-98.)

(410 ILCS 513/10)

Sec. 10. Definitions. As used in this Act:

"Authority" means the Illinois Health Information Exchange Authority established pursuant to the Illinois Health Information Exchange and Technology Act.

"Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"De-identified information" means health information that is not individually identifiable as described under HIPAA, as specified in 45 CFR 164.514(b).

"Disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.

"Employment agency" means both public and private employment agencies and any person, labor organization, or labor union having a hiring hall or hiring office regularly undertaking, with or without compensation, to procure opportunities to work, or to procure, recruit, refer, or place employees.

"Family member" means, with respect to an individual, (i) the spouse of the individual; (ii) a dependent child of the individual, including a child who is born to or placed for adoption with the individual; (iii) any other person qualifying as a covered dependent under a managed care plan; and (iv) all other individuals related by blood or law to the individual or the spouse or child described in subsections (i) through (iii) of this definition.

"Genetic information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103. means, with respect to any individual, information about (i) the individual's genetic tests; (ii) the genetic tests of a family member of the individual; and (iii) the manifestation or possible manifestation of a disease or disorder in a family member of the individual. Genetic information does not include information about the sex or age of any individual.

"Genetic monitoring" means the periodic examination of employees to evaluate acquired modifications to their genetic material, such as chromosomal damage or evidence of increased occurrence of mutations that may have developed in the course of employment due to exposure to toxic substances in the workplace in order to identify, evaluate, and respond to effects of or control adverse environmental exposures in the workplace.

"Genetic services" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103 means a genetic test, genetic counseling, including obtaining, interpreting, or assessing genetic information, or genetic education.

"Genetic testing" and "genetic test" have the meaning ascribed to "genetic test" under HIPAA, as specified in 45 CFR 160.103. mean a test or analysis of human genes, gene products, DNA, RNA, chromosomes, proteins, or metabolites that detect genotypes, mutations, chromosomal changes, abnormalities, or deficiencies, including carrier status, that (i) are linked to physical or mental disorders or impairments, (ii) indicate a susceptibility to illness, disease, impairment, or other disorders, whether physical or mental, or (iii) demonstrate genetic or chromosomal damage due to environmental factors. Genetic testing and genetic tests do not include routine physical measurements; chemical, blood and urine analyses that are widely accepted and in use in clinical practice; tests for use of drugs; tests for the presence of the human immunodeficiency virus; analyses of proteins or metabolites that do not detect genotypes, mutations, chromosomal changes, abnormalities, or deficiencies; or analyses of proteins or metabolites that are directly related to a manifested disease, disorder, or pathological condition that could reasonably be detected by a health care professional with appropriate training and expertise in the field of medicine involved.

"Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Health care professional" means (i) a licensed physician, (ii) a physician assistant to whom the physician assistant's supervising physician has delegated the provision of genetic testing or genetic counseling-related services, (iii) an advanced practice registered nurse who has a written collaborative agreement with a collaborating physician which authorizes the provision of genetic testing or genetic counseling-related health services, (iv) a licensed dentist, (v) a licensed podiatrist, (vi) a licensed genetic counselor, or (vii) an individual certified to provide genetic testing by a state or local public health department.

"Health care provider" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Health facility" means a hospital, blood bank, blood center, sperm bank, or other health care institution, including any "health facility" as that term is defined in the Illinois Finance Authority Act.

"Health information exchange" or "HIE" means a health information exchange or health information organization that exchanges health information electronically that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules promulgated thereunder; (ii) has established a data sharing arrangement with the Authority; or (iii) as of August 16, 2013, was designated by the Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee. In certain circumstances, in accordance with HIPAA, an HIE will be a business associate.

"Health oversight agency" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.

"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance transacts an insurance business and (ii) a managed care plan.

"Labor organization" includes any organization, labor union, craft union, or any voluntary unincorporated association designed to further the cause of the rights of union labor that is constituted for the purpose, in whole or in part, of collective bargaining or of dealing with employers concerning grievances, terms or conditions of employment, or apprenticeships or applications for apprenticeships, or of other mutual aid or protection in connection with employment, including apprenticeships or applications for apprenticeships.

"Licensing agency" means a board, commission, committee, council, department, or officers, except a judicial officer, in this State or any political subdivision authorized to grant, deny, renew, revoke, suspend, annul, withdraw, or amend a license or certificate of registration.

"Limited data set" has the meaning ascribed to it under HIPAA, as described in 45 CFR 164.514(e)(2).

"Labor organization" includes any organization, labor union, craft union, or any voluntary unincorporated association designed to further the cause of the rights of union labor that is constituted for the purpose, in whole or in part, of collective bargaining or of dealing with employers concerning grievances, terms or conditions of employment, or apprenticeships or applications for apprenticeships, or of other mutual aid or protection in connection with employment, including apprenticeships or applications for apprenticeships.

"Managed care plan" means a plan that establishes, operates, or maintains a network of health care providers that have entered into agreements with the plan to provide health care services to enrollees where the plan has the ultimate and direct contractual obligation to the enrollee to arrange for the provision of or pay for services through:

(1) organizational arrangements for ongoing quality assurance, utilization review programs, or dispute resolution; or

(2) financial incentives for persons enrolled in the plan to use the participating providers and procedures covered by the plan.

A managed care plan may be established or operated by any entity including a licensed insurance company, hospital or medical service plan, health maintenance organization, limited health service organization, preferred provider organization, third party administrator, or an employer or employee organization.

"Minimum necessary" means HIPAA's standard for using, disclosing, and requesting protected health information found in 45 CFR 164.502(b) and 164.514(d).

"Nontherapeutic purpose" means a purpose that is not intended to improve or preserve the life or health of the individual whom the information concerns.

"Organized health care arrangement" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Patient safety activities" has the meaning ascribed to it under 42 CFR 3.20.

"Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity.

"Protected health information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.103.

"Research" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"State agency" means an instrumentality of the State of Illinois and any instrumentality of another state which pursuant to applicable law or a written undertaking with an instrumentality of the State of Illinois is bound to protect the privacy of genetic information of Illinois persons.

"Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.

"Use" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103, where context dictates.

(Source: P.A. 95-927, eff. 1-1-09.)

(410 ILCS 513/20)

Sec. 20. Use of genetic testing information for insurance purposes.

(a) An insurer may not seek information derived from genetic testing for use in connection with a policy of accident and health insurance. Except as provided in subsection (c) (b), an insurer that receives information derived from genetic testing, regardless of the source of that information, may not use the information for a nontherapeutic purpose as it relates to a policy of accident and health insurance.

(b) An insurer shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of this Section, "underwriting purposes" means, with respect to an insurer:

(1) rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(2) the computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities, such as completing a health risk assessment or participating in a wellness program);

(3) the application of any pre-existing condition exclusion under the plan, coverage, or policy; and

(4) other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

"Underwriting purposes" does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.

This subsection (b) does not apply to insurers that are issuing a long-term care policy, excluding a nursing home fixed indemnity plan.

(c) (b) An insurer may consider the results of genetic testing in connection with a policy of accident and health insurance if the individual voluntarily submits the results and the results are favorable to the individual.

(d) (c) An insurer that possesses information derived from genetic testing may not release the information to a third party, except as specified in this Act Section 30.

(Source: P.A. 92-430, eff. 8-17-01.)

(410 ILCS 513/25)

Sec. 25. Use of genetic testing information by employers.

(a) An employer, employment agency, labor organization, and licensing agency shall treat genetic testing and genetic information in such a manner that is consistent with the requirements of federal law, including but not limited to the Genetic Information Nondiscrimination Act of 2008, the Americans with Disabilities Act, Title VII of the Civil Rights Act of 1964, the Family and Medical Leave Act of 1993, the Occupational Safety and Health Act of 1970, the Federal Mine Safety and Health Act of 1977, or the Atomic Energy Act of 1954.

(b) An employer may release genetic testing information only in accordance with Sections 15 and 30 of this Act.

(c) An employer, employment agency, labor organization, and licensing agency shall not directly or indirectly do any of the following:

(1) solicit, request, require or purchase genetic testing or genetic information of a person or a family member of the person, or administer a genetic test to a person or a family member of the person as a condition of employment, preemployment application, labor organization membership, or licensure;

(2) affect the terms, conditions, or privileges of employment, preemployment application, labor organization membership, or licensure, or terminate the employment, labor organization membership, or licensure of any person because of genetic testing or genetic information with respect to the employee or family member, or information about a request for or the receipt of genetic testing by such employee or family member of such employee;

(3) limit, segregate, or classify employees in any way that would deprive or tend to deprive any employee of employment opportunities or otherwise adversely affect the status of the employee as an employee because of genetic testing or genetic information with respect to the employee or a family member, or information about a request for or the receipt of genetic testing or genetic information by such employee or family member of such employee; and

(4) retaliate through discharge or in any other manner against any person alleging a violation of this Act or participating in any manner in a proceeding under this Act.

(d) An agreement between a person and an employer, prospective employer, employment agency, labor organization, or licensing agency, or its employees, agents, or members offering the person employment, labor organization membership, licensure, or any pay or benefit in return for taking a genetic test is prohibited.

(e) An employer shall not use genetic information or genetic testing in furtherance of a workplace wellness program benefiting employees unless (1) health or genetic services are offered by the employer, (2) the employee provides written authorization and informed consent in accordance with Section 30 of this Act, (3) only the employee or family member if the family member is receiving genetic services and the licensed health care professional or licensed genetic counselor involved in providing such services receive individually identifiable information concerning the results of such services, and (4) any individually identifiable information is only available for purposes of such services and shall not be disclosed to the employer except in aggregate terms that do not disclose the identity of specific employees.

(f) Nothing in this Act shall be construed to prohibit genetic testing of an employee who requests a genetic test and who provides written authorization and informed consent, in accordance with Section 30 of this Act, from taking a genetic test for the purpose of initiating a workers' compensation claim under the Workers' Compensation Act.

(g) A purchase of commercially and publicly available documents, including newspapers, magazines, periodicals, and books but not including medical databases or court records or inadvertently requesting family medical history by an employer, employment agency, labor organization, and licensing agency does not violate this Act.

(h) Nothing in this Act shall be construed to prohibit an employer that conducts DNA analysis for law enforcement purposes as a forensic laboratory and that includes such analysis in the Combined DNA Index System pursuant to the federal Violent Crime Control and Law Enforcement Act of 1994 from requesting or requiring genetic testing or genetic information of such employer's employees, but only to the extent that such genetic testing or genetic information is used for analysis of DNA identification markers for quality control to detect sample contamination.

(i) Nothing in this Act shall be construed to prohibit an employer from requesting or requiring genetic information to be used for genetic monitoring of the biological effects of toxic substances in the workplace, but only if (1) the employer provides written notice of the genetic monitoring to the employee; (2) the employee provides written authorization and informed consent under Section 30 of this Act or the genetic monitoring is required by federal or State law; (3) the employee is informed of individual monitoring results; (4) the monitoring is in compliance with any federal genetic monitoring regulations or State genetic monitoring regulations under the authority of the federal Occupational Safety and Health Act of 1970; and (5) the employer, excluding any health care provider, licensed health care professional, or health facility licensed genetic counselor that is involved in the genetic monitoring program, receives the results of the monitoring only in aggregate terms that do not disclose the identity of specific employees.

(j) Despite lawful acquisition of genetic testing or genetic information under subsections (e) through (i) of this Section, an employer, employment agency, labor organization, and licensing agency still may not use or disclose the genetic test or genetic information in violation of this Act.

(k) Except as provided in subsections (e), (f), (h), and (i) of this Section, a person shall not knowingly sell to or interpret for an employer, employment agency, labor organization, or licensing agency, or its employees, agents, or members, a genetic test of an employee, labor organization member, or license holder, or of a prospective employee, member, or license holder.

(Source: P.A. 95-927, eff. 1-1-09.)

(410 ILCS 513/30)

Sec. 30. Disclosure of person tested and test results.

(a) No person may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test, except to the following persons:

(1) The subject of the test or the subject's legally authorized representative. This paragraph does not create a duty or obligation under which a health care provider must notify the subject's spouse or legal guardian of the test results, and no such duty or obligation shall be implied. No civil liability or criminal sanction under this Act shall be imposed for any disclosure or nondisclosure of a test result to a spouse by a physician acting in good faith under this paragraph. For the purpose of any proceedings, civil or criminal, the good faith of any physician acting under this paragraph shall be presumed.

(2) Any person designated in a specific written legally effective authorization for release release of the test results executed by the subject of the test or the subject's legally authorized representative.

(3) An authorized agent or employee of a health facility or health care provider if the health facility or health care provider itself is authorized to obtain the test results, the agent or employee provides patient care, and the agent or employee has a need to know the information in order to conduct the tests or provide care or treatment.

(4) A health facility, or health care provider, or health care professional that procures, processes, distributes, or uses:

(A) a human body part from a deceased person with respect to medical information regarding that person; or

(B) semen provided prior to the effective date of this Act for the purpose of artificial insemination.

(5) Health facility staff committees for the purposes of conducting program monitoring, program evaluation, or service reviews.

(6) In the case of a minor under 18 years of age, the health care provider, health care professional, or health facility who ordered the test shall make a reasonable effort to notify the minor's parent or legal guardian if, in the professional judgment of the health care provider, health care professional, or health facility, notification would be in the best interest of the minor and the health care provider, health care professional, or health facility has first sought unsuccessfully to persuade the minor to notify the parent or legal guardian or after a reasonable time after the minor has agreed to notify the parent or legal guardian, the health care provider, health care professional, or health facility has reason to believe that the minor has not made the notification. This paragraph shall not create a duty or obligation under which a health care provider, health care professional, or health facility must notify the minor's parent or legal guardian of the test results, nor shall a duty or obligation be implied. No civil liability or criminal sanction under this Act shall be imposed for any notification or non-notification of a minor's test result by a health care provider, health care professional, or health facility acting in good faith under this paragraph. For the purpose of any proceeding, civil or criminal, the good faith of any health care provider, health care professional, or health facility acting under this paragraph shall be presumed.

(b) (7) All information and records held by a State agency, or local health authority, or health oversight agency pertaining to genetic information shall be strictly confidential and exempt from copying and inspection under the Freedom of Information Act. The information and records shall not be released or made public by the State agency, or local health authority, or health oversight agency and shall not be admissible as evidence nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person and shall be treated in the same manner as the information and those records subject to the provisions of Part 21 of Article VIII of the Code of Civil Procedure except under the following circumstances:

(A) when made with the written consent of all persons to whom the information pertains;

(B) when authorized by Section 5-4-3 of the Unified Code of Corrections;

(C) when made for the sole purpose of implementing the Newborn Metabolic Screening Act and rules; or

(D) when made under the authorization of the Illinois Parentage Act of 1984.

Disclosure shall be limited to those who have a need to know the information, and no additional disclosures may be made.

(c) (b) Disclosure by an insurer in accordance with the requirements of the Article XL of the Illinois Insurance Code shall be deemed compliance with this Section.

(Source: P.A. 96-328, eff. 8-11-09.)

(410 ILCS 513/31 new)

Sec. 31. Uses and disclosures for treatment, payment, and health care operations. Notwithstanding Sections 30 and 35 of this Act, a covered entity may, without a patient's consent:

(1) use or disclose genetic information for its own treatment, payment, or health care operations;

(2) disclose genetic information for treatment activities of a health care provider;

(3) disclose genetic information to another covered entity or health care provider for the payment activities of the entity that receives the information;

(4) disclose genetic information to another covered entity for health care operations activities of the entity that receives the information, if each entity has or had a relationship with the individual who is the subject of the genetic information being requested, the genetic information pertains to such relationship, and the disclosure is for the purpose of (A) conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management, and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (B) reviewing the competence or qualifications of health care professionals or health care providers, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities; or (C) health care fraud and abuse detection or compliance; and

(5) disclose genetic information to other participants in an organized health care arrangement in which the covered entity is also a participant for any health care operations activities of the organized health care arrangement.

(410 ILCS 513/31.1 new)

Sec. 31.1. Uses and disclosures for health oversight activities.

(a) Notwithstanding Sections 30 and 35 of this Act, a covered entity may disclose genetic information, without a patient's consent, to a health oversight agency for health oversight activities authorized by law, including audits, civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil administrative or criminal proceedings or actions; or other activities necessary for appropriate oversight of (i) the health care system; (ii) government benefit programs for which health information is relevant to beneficiary eligibility; (iii) entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or (iv) entities subject to civil rights laws for which health information is necessary for determining compliance.

(b) For purposes of the disclosures permitted by this Section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to (i) the receipt of health care; (ii) a claim for public benefits related to health; or (iii) qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services, except that, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of this Section.

(c) If a covered entity is also a health oversight agency, the covered entity may use genetic information for health oversight activities permitted by this Section.

(410 ILCS 513/31.2 new)

Sec. 31.2. Uses and disclosures for public health activities. Notwithstanding Sections 30 and 35 of this Act, genetic information may be disclosed without a patient's consent for public health activities and purposes to the Department, when the Department is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions.

(410 ILCS 513/31.3 new)

Sec. 31.3. Business associates.

(a) Notwithstanding Sections 30 and 35 of this Act, a covered entity may, without a patient's consent, disclose a patient's genetic information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains, through a written contract or other written agreement or arrangement that meets the applicable requirements of 45 CFR 164.504(e), satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(b) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(410 ILCS 513/31.4 new)

Sec. 31.4. Record locator service to support HIE. Section 9.9 of the Mental Health and Developmental Disabilities Confidentiality Act is herein incorporated by reference.

(410 ILCS 513/31.5 new)

Sec. 31.5. Use and disclosure of information to an HIE. Notwithstanding the provisions of Section 30 and 35 of this Act, a covered entity may, without a patient's consent, disclose the identity of any patient upon whom a test is performed and such patient's genetic information from a patient's record to a HIE if the disclosure is a required or permitted disclosure to a business associate or is a disclosure otherwise required or permitted under this Act. An HIE may, without a patient's consent, use or disclose such information to the extent it is allowed to use or disclose such information as a business associate in compliance with 45 CFR 164.502(e) or for such other purposes as are specifically allowed under this Act.

(410 ILCS 513/31.6 new)

Sec. 31.6. Other disclosures. Nothing in this Act shall be construed (1) to limit the use of an HIE to facilitate disclosures permitted by this Act or (2) to allow for the disclosure of information from a patient's record to law enforcement or for law enforcement purposes.

(410 ILCS 513/31.7 new)

Sec. 31.7. Establishment and disclosure of limited data sets and de-identified information.

(a) A covered entity may, without a genetic information test subject's consent, create, use, and disclose a limited data set using information subject to this Act or disclose information subject to this Act to a business associate for the purpose of establishing a limited data set. The creation, use, and disclosure of such a limited data set must comply with the requirements set forth under HIPAA.

(b) A covered entity may, without a genetic information test subject's consent, create, use, and disclose de-identified information using information subject to this Act or disclose information subject to this Act to a business associate for the purpose of de-identifying the information. The creation, use, and disclosure of such de-identified information must comply with the requirements set forth under HIPAA. A covered entity or a business associate may disclose information that is de-identified in accordance with HIPAA.

(c) The recipient of de-identified information shall not re-identify de-identified information using any public or private data source.

(410 ILCS 513/31.8 new)

Sec. 31.8. HIE opt out. Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act is incorporated herein by reference. In addition to the requirements set out in Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, at the time of a patient's first encounter for genetic testing with a health care provider, health care professional, or health facility that participates in an HIE, or, in the event of a medical emergency that makes it impossible, as soon thereafter as is practicable, the patient shall receive meaningful disclosure regarding the HIE in which the health care provider, health care professional, or health facility participates and shall be afforded an opportunity to opt out of disclosure of the patient's health information through the HIE.

(410 ILCS 513/31.9 new)

Sec. 31.9. Research. Genetic information may be disclosed for research, in accordance with the requirements set forth under HIPAA.

(410 ILCS 513/31.10 new)

Sec. 31.10. Minimum necessary. When using or disclosing genetic-related information under this Act, a covered entity shall do so in accordance with the minimum necessary standard under HIPAA.

(410 ILCS 513/35)

Sec. 35. Disclosure by person to whom results have been disclosed. No person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized under this Act by Section 30.

(Source: P.A. 90-25, eff. 1-1-98.)

(410 ILCS 513/40)

Sec. 40. Right of action.

(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court against an offending party. A prevailing party may recover for each violation:

(1) Against any party who negligently violates a provision of this Act, liquidated damages of $2,500 or actual damages, whichever is greater.

(2) Against any party who intentionally or recklessly violates a provision of this Act, liquidated damages of $15,000 or actual damages, whichever is greater.

(3) Reasonable attorney's fees and costs, including expert witness fees and other litigation expenses.

(4) Such other relief, including an injunction, as the State or federal court may deem appropriate.

(b) Article XL of the Illinois Insurance Code shall provide the exclusive remedy for violations of Section 30 by insurers.

(c) Notwithstanding any provisions of the law to the contrary, any person alleging a violation of subsection (a) of Section 15, subsection (b) of Section 25, Section 30, Section 31, or Section 35 of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court to seek a preliminary injunction preventing the release or disclosure of genetic testing or genetic information pending the final resolution of any action under this Act.

(Source: P.A. 95-927, eff. 1-1-09.)

Section 20. The Unified Code of Corrections is amended by changing Sections 3-8-2 and 3-10-2 as follows:

(730 ILCS 5/3-8-2) (from Ch. 38, par. 1003-8-2)

Sec. 3-8-2. Social Evaluation; physical examination; HIV/AIDS.

(a) A social evaluation shall be made of a committed person's medical, psychological, educational and vocational condition and history, including the use of alcohol and other drugs, the circumstances of his offense, and such other information as the Department may determine. The committed person shall be assigned to an institution or facility in so far as practicable in accordance with the social evaluation. Recommendations shall be made for medical, dental, psychiatric, psychological and social service treatment.

(b) A record of the social evaluation shall be entered in the committed person's master record file and shall be forwarded to the institution or facility to which the person is assigned.

(c) Upon admission to a correctional institution each committed person shall be given a physical examination. If he is suspected of having a communicable disease that in the judgment of the Department medical personnel requires medical isolation, the committed person shall remain in medical isolation until it is no longer deemed medically necessary.

(d) Upon arrival at a reception and classification center or an inmate's final destination, the Department must provide the committed person with appropriate information in writing, verbally, by video or other electronic means concerning HIV and AIDS. The Department shall develop the informational materials in consultation with the Department of Public Health. At the same time, the Department also must offer the committed person the option of being tested, with no copayment, for infection with human immunodeficiency virus (HIV). Pre-test information shall be provided to the committed person and informed consent obtained as required in subsection (q) (d) of Section 3 and Section 5 of the AIDS Confidentiality Act. The Department may conduct opt-out HIV testing as defined in Section 4 of the AIDS Confidentiality Act. If the Department conducts opt-out HIV testing, the Department shall place signs in English, Spanish and other languages as needed in multiple, highly visible locations in the area where HIV testing is conducted informing inmates that they will be tested for HIV unless they refuse, and refusal or acceptance of testing shall be documented in the inmate's medical record. The Department shall follow procedures established by the Department of Public Health to conduct HIV testing and testing to confirm positive HIV test results. All testing must be conducted by medical personnel, but pre-test and other information may be provided by committed persons who have received appropriate training. The Department, in conjunction with the Department of Public Health, shall develop a plan that complies with the AIDS Confidentiality Act to deliver confidentially all positive or negative HIV test results to inmates or former inmates. Nothing in this Section shall require the Department to offer HIV testing to an inmate who is known to be infected with HIV, or who has been tested for HIV within the previous 180 days and whose documented HIV test result is available to the Department electronically. The testing provided under this subsection (d) shall consist of a test approved by the Illinois Department of Public Health to determine the presence of HIV infection, based upon recommendations of the United States Centers for Disease Control and Prevention. If the test result is positive, a reliable supplemental test based upon recommendations of the United States Centers for Disease Control and Prevention shall be administered.

(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11; 97-813, eff. 7-13-12.)

(730 ILCS 5/3-10-2) (from Ch. 38, par. 1003-10-2)

Sec. 3-10-2. Examination of Persons Committed to the Department of Juvenile Justice.

(a) A person committed to the Department of Juvenile Justice shall be examined in regard to his medical, psychological, social, educational and vocational condition and history, including the use of alcohol and other drugs, the circumstances of his offense and any other information as the Department of Juvenile Justice may determine.

(a-5) Upon admission of a person committed to the Department of Juvenile Justice, the Department of Juvenile Justice must provide the person with appropriate information concerning HIV and AIDS in writing, verbally, or by video or other electronic means. The Department of Juvenile Justice shall develop the informational materials in consultation with the Department of Public Health. At the same time, the Department of Juvenile Justice also must offer the person the option of being tested, at no charge to the person, for infection with human immunodeficiency virus (HIV). Pre-test information shall be provided to the committed person and informed consent obtained as required in subsection (q) (d) of Section 3 and Section 5 of the AIDS Confidentiality Act. The Department of Juvenile Justice may conduct opt-out HIV testing as defined in Section 4 of the AIDS Confidentiality Act. If the Department conducts opt-out HIV testing, the Department shall place signs in English, Spanish and other languages as needed in multiple, highly visible locations in the area where HIV testing is conducted informing inmates that they will be tested for HIV unless they refuse, and refusal or acceptance of testing shall be documented in the inmate's medical record. The Department shall follow procedures established by the Department of Public Health to conduct HIV testing and testing to confirm positive HIV test results. All testing must be conducted by medical personnel, but pre-test and other information may be provided by committed persons who have received appropriate training. The Department, in conjunction with the Department of Public Health, shall develop a plan that complies with the AIDS Confidentiality Act to deliver confidentially all positive or negative HIV test results to inmates or former inmates. Nothing in this Section shall require the Department to offer HIV testing to an inmate who is known to be infected with HIV, or who has been tested for HIV within the previous 180 days and whose documented HIV test result is available to the Department electronically. The testing provided under this subsection (a-5) shall consist of a test approved by the Illinois Department of Public Health to determine the presence of HIV infection, based upon recommendations of the United States Centers for Disease Control and Prevention. If the test result is positive, a reliable supplemental test based upon recommendations of the United States Centers for Disease Control and Prevention shall be administered.

Also upon admission of a person committed to the Department of Juvenile Justice, the Department of Juvenile Justice must inform the person of the Department's obligation to provide the person with medical care.

(b) Based on its examination, the Department of Juvenile Justice may exercise the following powers in developing a treatment program of any person committed to the Department of Juvenile Justice:

(1) Require participation by him in vocational, physical, educational and corrective training and activities to return him to the community.

(2) Place him in any institution or facility of the Department of Juvenile Justice.

(3) Order replacement or referral to the Parole and Pardon Board as often as it deems desirable. The Department of Juvenile Justice shall refer the person to the Parole and Pardon Board as required under Section 3-3-4.

(4) Enter into agreements with the Secretary of Human Services and the Director of Children and Family Services, with courts having probation officers, and with private agencies or institutions for separate care or special treatment of persons subject to the control of the Department of Juvenile Justice.

(c) The Department of Juvenile Justice shall make periodic reexamination of all persons under the control of the Department of Juvenile Justice to determine whether existing orders in individual cases should be modified or continued. This examination shall be made with respect to every person at least once annually.

(d) A record of the treatment decision including any modification thereof and the reason therefor, shall be part of the committed person's master record file.

(e) The Department of Juvenile Justice shall by certified mail, return receipt requested, notify the parent, guardian or nearest relative of any person committed to the Department of Juvenile Justice of his physical location and any change thereof.

(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11; 97-813, eff. 7-13-12.)

Section 25. The County Jail Act is amended by changing Section 17.10 as follows:

(730 ILCS 125/17.10)

Sec. 17.10. Requirements in connection with HIV/AIDS.

(a) In each county other than Cook, during the medical admissions exam, the warden of the jail, a correctional officer at the jail, or a member of the jail medical staff must provide the prisoner with appropriate written information concerning human immunodeficiency virus (HIV) and acquired immunodeficiency syndrome (AIDS). The Department of Public Health and community-based organizations certified to provide HIV/AIDS testing must provide these informational materials to the warden at no cost to the county. The warden, a correctional officer, or a member of the jail medical staff must inform the prisoner of the option of being tested for infection with HIV by a certified local community-based agency or other available medical provider at no charge to the prisoner.

(b) In Cook County, during the medical admissions exam, an employee of the Cook County Health & Hospitals System must provide the prisoner with appropriate information in writing, verbally or by video or other electronic means concerning human immunodeficiency virus (HIV) and acquired immunodeficiency syndrome (AIDS) and must also provide the prisoner with option of testing for infection with HIV or any other identified causative agent of AIDS, as well as counseling in connection with such testing. The Cook County Health & Hospitals System may provide the inmate with opt-out human immunodeficiency virus (HIV) testing, as defined in Section 4 of the AIDS Confidentiality Act, unless the inmate refuses. If opt-out HIV testing is conducted, the Cook County Health & Hospitals System shall place signs in English, Spanish, and other languages as needed in multiple, highly visible locations in the area where HIV testing is conducted informing inmates that they will be tested for HIV unless they refuse, and refusal or acceptance of testing shall be documented in the inmate's medical record. Pre-test information shall be provided to the inmate and informed consent obtained from the inmate as required in subsection (q) (d) of Section 3 and Section 5 of the AIDS Confidentiality Act. The Cook County Health & Hospitals System shall follow procedures established by the Department of Public Health to conduct HIV testing and testing to confirm positive HIV test results. All aspects of HIV testing shall comply with the requirements of the AIDS Confidentiality Act, including delivery of test results, as determined by the Cook County Health & Hospitals System in consultation with the Illinois Department of Public Health. Nothing in this Section shall require the Cook County Health & Hospitals System to offer HIV testing to inmates who are known to be infected with HIV. The Department of Public Health and community-based organizations certified to provide HIV/AIDS testing may provide these informational materials to the Bureau at no cost to the county. The testing provided under this subsection (b) shall consist of a test approved by the Illinois Department of Public Health to determine the presence of HIV infection, based upon recommendations of the United States Centers for Disease Control and Prevention. If the test result is positive, a reliable supplemental test based upon recommendations of the United States Centers for Disease Control and Prevention shall be administered.

(c) In each county, the warden of the jail must make appropriate written information concerning HIV/AIDS available to every visitor to the jail. This information must include information concerning persons or entities to contact for local counseling and testing. The Department of Public Health and community-based organizations certified to provide HIV/AIDS testing must provide these informational materials to the warden at no cost to the office of the county sheriff.

(d) Implementation of this Section is subject to appropriation.

(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11; 97-813, eff. 7-13-12.)

Section 30. The Code of Civil Procedure is amended by changing Section 8-802 as follows:

(735 ILCS 5/8-802) (from Ch. 110, par. 8-802)

Sec. 8-802. Physician and patient. No physician or surgeon shall be permitted to disclose any information he or she may have acquired in attending any patient in a professional character, necessary to enable him or her professionally to serve the patient, except only (1) in trials for homicide when the disclosure relates directly to the fact or immediate circumstances of the homicide, (2) in actions, civil or criminal, against the physician for malpractice, (3) with the expressed consent of the patient, or in case of his or her death or disability, of his or her personal representative or other person authorized to sue for personal injury or of the beneficiary of an insurance policy on his or her life, health, or physical condition, or as authorized by Section 8-2001.5, (4) in all actions brought by or against the patient, his or her personal representative, a beneficiary under a policy of insurance, or the executor or administrator of his or her estate wherein the patient's physical or mental condition is an issue, (5) upon an issue as to the validity of a document as a will of the patient, (6) in any criminal action where the charge is either first degree murder by abortion, attempted abortion or abortion, (7) in actions, civil or criminal, arising from the filing of a report in compliance with the Abused and Neglected Child Reporting Act, (8) to any department, agency, institution or facility which has custody of the patient pursuant to State statute or any court order of commitment, (9) in prosecutions where written results of blood alcohol tests are admissible pursuant to Section 11-501.4 of the Illinois Vehicle Code, (10) in prosecutions where written results of blood alcohol tests are admissible under Section 5-11a of the Boat Registration and Safety Act, (11) in criminal actions arising from the filing of a report of suspected terrorist offense in compliance with Section 29D-10(p)(7) of the Criminal Code of 2012, or (12) upon the issuance of a subpoena pursuant to Section 38 of the Medical Practice Act of 1987; the issuance of a subpoena pursuant to Section 25.1 of the Illinois Dental Practice Act; the issuance of a subpoena pursuant to Section 22 of the Nursing Home Administrators Licensing and Disciplinary Act; or the issuance of a subpoena pursuant to Section 25.5 of the Workers' Compensation Act, or (13) to or through a health information exchange, as that term is defined in Section 2 of the Mental Health and Developmental Disabilities Confidentiality Act, in accordance with State or federal law.

In the event of a conflict between the application of this Section and the Mental Health and Developmental Disabilities Confidentiality Act to a specific situation, the provisions of the Mental Health and Developmental Disabilities Confidentiality Act shall control.

(Source: P.A. 97-18, eff. 6-28-11; 97-623, eff. 11-23-11; 97-813, eff. 7-13-12; 97-1150, eff. 1-25-13.)