ADMINISTRATIVE CODE

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM

Section 2080.10 Authority

Section 2080.20 Incorporation by Reference and Definitions

Section 2080.30 General Description

Section 2080.40 Official Triplicate Prescription Blanks (Repealed)

Section 2080.50 Authorized Prescribers

Section 2080.60 Application (Repealed)

Section 2080.70 Schedule II-V Drug Prescription Requirements

Section 2080.80 Prohibited use of the Official Triplicate Prescription Blank (Repealed)

Section 2080.90 Dispensing a Schedule II, III, IV or V Drug

Section 2080.100 Dispenser Responsibility

Section 2080.110 Partial filling of prescriptions (Repealed)

Section 2080.120 Emergency situations (Repealed)

Section 2080.130 Prescriptions from out-of-state prescribers and exempt Federal practitioners (Repealed)

Section 2080.140 Exemption for prescribers in hospitals and institutions (Repealed)

Section 2080.150 Exemptions for long term care and home infusion services (Repealed)

Section 2080.160 Exemptions for narcotic treatment programs (Repealed)

Section 2080.170 Exemptions for research (Repealed)

Section 2080.180 Investigatory and regulatory referrals (Repealed)

Section 2080.190 Reports

Section 2080.200 Prescriber and Dispenser Inquiry System

Section 2080.203 Registering with the ILPMP

Section 2080.205 Accessing the ILPMP

Section 2080.207 EHR Integration with the ILPMP

Section 2080.208 Pharmacy Management Systems Integration with the ILPMP

Section 2080.210 Access to the Prescription Information Library (PIL) (Repealed)

Section 2080.211 Other State Prescription Monitoring Authority Access

Section 2080.220 Error Reporting

Section 2080.230 Designated Controlled Substances and Other Selected Drugs

Section 2080.240 Mid-Level Practitioners Prescriptive Authority Reporting

Section 2080.245 Advanced Practice Registered Nurse with Full Practice Authority

Section 2080.250 Mailing of Controlled Substances

Section 2080.320 Illinois Prescription Monitoring Program Advisory Committee (ILPMPAC)

Section 2080.325 Peer Review Committee

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM
SECTION 2080.10 AUTHORITY

Section 2080.10 Authority

This Part is promulgated pursuant to the Illinois Controlled Substances Act (the Act) [720 ILCS 570] which empowers the Department of Human Services to codify the efforts of this State to conform with the regulatory systems of the federal government and other states to establish national coordination of efforts to control the abuse of Schedule II-V dispensed drugs. It relates to the collection of prescription information listed in Schedule II-V within Sections 206, 208, 210, and 212 of the Act, or in the federal Schedule II-V and "Amendment of Schedules" list of drugs at 21 USC 812(b)(2), (b)(3), (b)(4), (b)(5) and (c).

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM
SECTION 2080.20 INCORPORATION BY REFERENCE AND DEFINITIONS

Section 2080.20 Incorporation by Reference and Definitions

No incorporations by reference in this Part include any later amendments or editions. The definitions that apply to this Part are those found in the Act.

"Act" means the Illinois Controlled Substances Act [720 ILCS 570].

"Account" refers to the licensed healthcare entity or authorized user that is providing direct patient care and is registered with the ILPMP to have access to patient-specific data through the ILPMP.

"Application Vendor" refers to the EHR, Electronic Medical Record (EMR), Certified Health IT module in combination with an EHR or EMR, or pharmacy management software that is an end user interface, being utilized by a healthcare entity, prescriber, or dispenser in the treatment of a patient.

"Birth Date" means the medication recipient's birth date.

"Central Repository" means a place designated by the Department where Schedule II-V drug data and other healthcare data are stored or housed.

"Certified Health IT Module" means any service, component, or a combination thereof that can meet the requirements of at least one certification criterion adopted under the Office of the National Coordinator for Health Information Technology (ONC), for purposes of electronic health records systems/electronic medical records systems, including, but not limited to, the 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications (available at https://www.federalregister.gov/documents/2015/10/16/2015-25597/2015-edition-health-information-technology-health-it-certification-criteria-2015-edition-base); https://www.healthit.gov; and NCPDP Protocols available to members at https://www.ncpdp.org/.

"Clinical Director" means a Department of Human Services administrative employee licensed to either prescribe or dispense controlled substances who shall run the clinical aspects of the Department of Human Services Prescription Monitoring Program and its Prescription Information Library [720 ILCS 570/102 (d-5)].

"Connecting Entity" or "Entity" means the health system, hospital, medical office, clinic, or practice that maintains the Electronic Health Record system or employs the professional making the ILPMP query.

"Controlled Substance" means a drug, substance, immediate precursor, or synthetic drug in the Schedules of Article II of the Illinois Controlled Substances Act or a drug or other substance, or immediate precursor, designated as a controlled substance by DHS through administrative rule. The term does not include distilled spirits, wine, malt beverages, or tobacco, as those terms are defined or used in the Liquor Control Act of 1934 and the Tobacco Products Act of 1995 [720 ILCS 570/102(f)].

"DEA Number" means the United States Drug Enforcement Administration prescriber or dispenser registration number.

"Department" or "DHS" means the Illinois Department of Human Services or its successor agency. [720 ILCS 570/102(d-5)]

"DFPR" means the Illinois Department of Financial and Professional Regulation.

"Dispense" means to deliver a controlled substance to an ultimate user or research subject by or pursuant to the lawful order of a prescriber, including the prescribing, administering, packaging, labeling or compounding necessary to prepare the substance for that delivery. [720 ILCS 570/102(p)]

"Dispenser" means a practitioner who dispenses a controlled substance [720 ILCS 570/102(p) and (q)].

"DoIT" means the Illinois Department of Innovation and Technology.

"DPH" means the Illinois Department of Public Health.

"EHR" means electronic health record for a Licensed Healthcare Entity.

"Electronic Integration" means the process by which ILPMP data is directly accessible within the EHR or pharmacy management/dispensing system.

"Freestanding Clinic" means urgent care operations or outpatient surgery centers and similar operations that do not provide overnight in-house stays.

"Gender" includes the social, psychological, cultural, and behavioral aspects of identifying as a man, woman, gender diverse, or other gender identity.

"ILPMP" means the Illinois Prescription Monitoring Program.

"ILPMP Administrator" means an employee of the Department with a background in computer and business processes who operates under the designated, specific authority of the Clinical Director.

"Illinois Healthcare License Number" means the license assigned by DPH to facilities designated to provide specific types or levels of healthcare.

"Initial CII Narcotics Prescription" means the initial CII narcotics prescription issued to a patient for the initialization of treatment, in accordance with 720 ILCS 570-314.5.

"Integration Vendor" means a vendor that provides connectivity between an end user interface, such as an EHR, Certified Health IT Module, or a pharmacy management system and the ILPMP.

"Interstate Data Sharing" means sharing of PMP controlled substance prescription data from states other than Illinois.

"Licensed Healthcare Entity" means those operations that are licensed to provide health services by either DPH or DFPR.

"Licensed Healthcare Provider" means any individual who meets the professional licensing requirements and follows the standards set forth by DFPR and is authorized to prescribe or dispense controlled substances within Illinois.

"Medication Shopping" means the conduct prohibited under Section 314.5(a) of the Act.

"Mid-level Practitioner" means:

a physician assistant who has been delegated authority to prescribe through a written delegation of authority by a physician licensed to practice medicine in all of its branches, in accordance with Section 7.5 of the Physician Assistant Practice Act of 1987 [225 ILCS 95];

an advanced practice registered nurse who has been delegated authority to prescribe through a written delegation of authority by a physician licensed to practice medicine in all of its branches or by a podiatrist, in accordance with Section 65-40 of the Nurse Practice Act [225 ILCS 65];

an advanced practice registered nurse certified as a nurse practitioner, nurse midwife, or clinical nurse specialist who has been granted authority to prescribe by a hospital affiliate in accordance with Section 65-45 of the Nurse Practice Act [225 ILCS 65]; or

an animal euthanasia agency [720 ILCS 570/102(t-5)]; or

a prescribing psychologist. [720 ILCS 570/102(z-10)]

"National Drug Code Identification Number" or "NDC Identification Number" means the number used to provide uniform product identification for all substances recognized as drugs in the United States Pharmacopoeia National Formulary, USP31-NF26 (US Pharmacopoeial Convention, 12601 Twinbrook Parkway, Rockville, Maryland 20852 (2023)).

"NCPDP Protocol" means the computing standards implemented by the National Council for Prescription Drug Programs at https://standards.ncpdp.org/Access-to-Standards.aspx.

"One-to-One Secure Link" or "One-to-One Connection" means connecting a provider and the ILPMP through an EHR or a pharmacy management system.

"Patient ID" means the identification of the individual receiving the medication or the responsible individual obtaining the medication on behalf of the recipient or the owner of the animal. The standards for establishing patient ID for proper filling of a prescription are established by Section 2080.70(d).

"Patient Location Code" means the location of the patient when receiving pharmacy services.

"Pharmacist-In-Charge" means the licensed pharmacist whose name appears on the pharmacy license and who is responsible for all aspects of the operation related to the practice of pharmacy.

"Pharmacy Shopping" means the conduct prohibited under Section 314.5(b) of the Act.

"PMIX-Based Protocol" means industry and government standards used to facilitate and reduce the cost of participating and sharing the ILPMP information by requiring end-to-end security, standards-based exchange services, common exchange data and metadata.

"Prescribed" means ordered by a prescriber verbally, electronically, or in writing.

"Prescriber" means:

a physician licensed to practice medicine in all its branches, dentist, optometrist, podiatric physician or veterinarian who issues a prescription,

a prescribing psychologist licensed under Section 4.2 of the Clinical Psychologist Licensing Act with prescriptive authority delegated under Section 4.3 of the Clinical Psychologist Licensing Act,

a physician assistant who issues a prescription for a controlled substance in accordance with Section 303.05, a written delegation, and a written collaborative agreement required under Section 7.5 of the Physician Assistant Practice Act of 1987,

an advanced practice registered nurse with prescriptive authority delegated under Section 65-40 of the Nurse Practice Act and in accordance with Section 303.05, a written delegation, and a written collaborative agreement under Section 65-35 of the Nurse Practice Act,

an advanced practice registered nurse certified as a nurse practitioner, nurse midwife, or clinical nurse specialist who has full practice authority pursuant to Section 65-43 of the Nurse Practice Act. [720 ILCS 570/102(mm)]

"Prescription Monitoring Program" or "PMP" means the entity that collects, tracks, and stores reported data on controlled substances and select drugs pursuant to Section 316 of the Act. [720 ILCS 570/102(nn-5)]

"Prescription Monitoring Program Advisory Committee" or "PMPAC" means a committee consisting of licensed healthcare providers representing professions that are licensed to prescribe or dispense controlled substances. The committee serves in a consultant context regarding longitudinal evaluations of compliance with evidence-based clinical practice and controlled substances. The committee makes recommendations regarding the scheduling of controlled substances and recommendations concerning continuing education designed to improve the health and safety of the citizens of Illinois regarding pharmacotherapies of controlled substances.

"Provider" means the prescriber or dispenser acting in the direct care of the patient.

"Recipient's Name" means the given or common name of a person who is the intended user of a dispensed medication. It may also mean the species or common name or common given name of an animal that is the intended user of a dispensed medication. If an animal's name is entered, the owner's name is required also.

"Requester" means the prescriber, dispenser, or registered designee that is initiating a patient query of ILPMP data. A Requester must be authorized to access ILPMP data via a valid ILPMP registered website (www.ilpmp.org) user account.

"RESTful Based Web Service" means a computing architectural style, consisting of a coordinated set of components, connectors, and data elements within a distributed hypermedia system, in which the focus is on component roles and a specific set of interactions between data elements rather than implementation details. Its purpose is to induce performance, scalability, simplicity, modifiability, visibility, portability, and reliability.

"Sample Trend Analysis" means the summary reports that look at utilization rates for specific classes of medications over time.

"Schedule Drug" means any substances listed in the federal Controlled Substances Act (21 U.S.C. 812) or the Illinois Controlled Substances Act [720 ILCS 570] or by the Department pursuant to its authority under Section 202 of the Illinois Controlled Substances Act [720 ILCS 570/202]. Schedule I-V substances are listed in section 812 of the federal Controlled Substances Act (21 U.S.C. 812(b)(2), (b)(3), (b)(4), (b)(5) and (c)) and Sections 204, 206, 208, 210 and 212 of the Illinois Controlled Substances Act [720 ILCS 570/204, 206, 208, 210 and 212].

"SOAP Based Web Service" means a messaging protocol that allows programs that run on disparate operating systems (e.g., Windows or Linux) to communicate using Hypertext Transfer Protocol (HTTP) and its Extensible Markup Language (XML).

"State of Illinois PMPnow" means the State of Illinois automated, one-to-one connection service that allows an ILPMP patient profile request to be generated directly within a Requester's EHR or pharmacy management system.

(Source: Amended at 48 Ill. Reg. 15062, effective October 8, 2024)

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM
SECTION 2080.30 GENERAL DESCRIPTION

Section 2080.30 General Description

The ILPMP monitors all prescriptions for Schedule II-V drugs and drugs of interest (i.e., select drugs that are not included in Schedule II, III, IV or V) that are dispensed (except for hospital inpatients unless required by 720 ILCS 570/313) within the State of Illinois. Each time a Schedule II-V drug or drug of interest is dispensed, the dispenser must transmit specific information to a central repository within the ILPMP designated by the Department. The complete drug list is listed in the Illinois Data Submitter's Guide which is located at https://rxsubmit-il.logicoy.com/PDMPSystemApp/guidebeforelogin#!#documents.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.40 Official Triplicate Prescription Blanks (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.50 Authorized Prescribers

A prescription for a Schedule II-V drug shall be issued only by a prescriber who:

a) Possesses a valid professional license issued by DFPR as a physician licensed to practice medicine in all of its branches, dentist, optometrist, podiatrist, veterinarian, advanced practice registered nurse granted full practice authority, advanced practice registered nurse with delegated prescriptive authority, a physician assistant with delegated prescriptive authority, or other licensed prescriber of another state or jurisdiction;

b) Is licensed to prescribe Schedule II-V drugs by the State of Illinois or any state;

c) Must be registered by the United States Drug Enforcement Administration (DEA) to prescribe Schedule II-V drugs; and

d) Complies with all requirements under 21 CFR 1306.08 and 21 CFR 1311.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.60 Application (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.70 Schedule II-V Drug Prescription Requirements

a) A dispenser may fill a prescription for a Schedule II-V drug upon receipt of a written, electronic, facsimile, or verbal order of a prescriber unless otherwise specifically exempted or allowed by federal or State law.

b) A prescription for a Schedule II-V drug shall:

1) Be dated as of and signed on the day when issued;

2) Bear the full name and address of the patient, or in the case of veterinary treatment, the full name and address of the animal owner, as well as the species or common name of the animal being treated;

3) Bear the full name and address of the prescriber;

4) Bear the DEA Registration number of the prescriber;

5) Have affixed to the face of the prescription the prescriber's electronic or handwritten signature, initials, thumbprint, or other biometric or electronic identification process approved by DFPR pursuant to Section 3 of the Pharmacy Practice Act [225 ILCS 85];

6) If written, be written in ink with a pen, typewriter, or computer printer or with an indelible pencil;

7) Specify the drug name, strength, dosage, and form;

8) Specify the quantity of drug to be dispensed, both written and numeric;

9) Not allow a Schedule II prescription to be filled more than 90 days after the date of issue;

10) Not allow more than a 30-day supply of a Schedule II drug on any one prescription;

11) Not allow for any refills of Schedule II drugs;

12) Contain only one Schedule II drug prescription order per prescription blank;

13) Limit the maximum time allowed for a Schedule III, IV or V prescription to be filled at six months with a maximum of five refills;

14) Allow more than one prescription order per prescription blank for a Schedule III-V drug;

15) Allow electronic prescriptions in accordance with federal rules set forth in 21 CFR 1300, 1304, 1306, 1311 (2010) [720 ILCS 570/311.5]; and

16) Allow an individual physician the authority to prescribe multiple prescriptions (3 sequential 30-day supplies) for the same Schedule II controlled substance, authorizing up to a 90-day supply [720 ILCS 570/312(a-5)].

c) In the case of an emergency, a prescriber may issue a lawful oral prescription when failure to issue might result in loss of life or intense suffering. The oral prescription shall include a statement concerning the circumstances constituting the emergency for which the oral prescription was used. Within 7 days after issuing an emergency prescription, the prescriber shall cause a written prescription for the emergency quantity prescribed to be delivered to the dispensing pharmacist. The prescription shall comply with all requirements of Section 309 of the Act.

d) Patient ID for Proper Filling:

1) The gender field is a verifying element of a patient ID. The patient's gender shall be entered in the gender field.

2) The birth date is a verifying element of a patient ID and needs to be entered in the birth date field (yyyymmdd).

3) The final verifying element of a patient ID for an animal or individual is not a set standard. Each pharmacy or chain may adopt its own standard. The concern is that if a standard is too rigid, the enterprise's business activity will suffer. Any of the following may be used. If the primary choice is not available (e.g., if the patient is an undocumented immigrant), another choice may be used:

A) Driver's license or equivalent, state-issued ID;

B) Telephone number of the patient (include area code);

C) An internal pharmacy ID system;

D) Employer ID;

E) Student ID;

F) Insurance ID.

4) If a child's or other person's prescription is delivered to or accepted by a person other than the intended user, an ID should verify the name of the individual accepting the prescription.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.80 Prohibited use of the Official Triplicate Prescription Blank (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.90 Dispensing a Schedule II, III, IV or V Drug

A prescriber who administers a Schedule II, III, IV or V drug in the course of the prescriber's professional practice subject to the Act may do so without issuing a written prescription for that drug.

(Source: Amended at 33 Ill. Reg. 17333, effective December 9, 2009)

Section 2080.100 Dispenser Responsibility

a) Each time a Schedule II-V drug or other selected drugs, as described in Section 2080.230, is dispensed, the dispenser must transmit electronically, by the end of the business day, to the central repository the following data, and any other data deemed necessary by the ILPMPAC:

1) Dispenser DEA number.

2) Recipient's (or animal and owner's) name and address.

3) NDC identification number of the Schedule II-V drug dispensed.

4) Quantity of the Schedule II-V drug dispensed.

5) Date prescription filled.

6) Date prescription written.

7) Prescriber DEA number.

8) Patient ID, for LTC submissions only.

9) Patient gender; see Submitter's Guide at https://www.ilpmp.org/CDC/ILPMPinfo.php for additional gender categories.

10) Patient birth date (yyyymmdd – year, month, day).

11) Payment type (i.e., Medicaid, cash, third-party insurance).

12) Patient location code (i.e., home, nursing home, outpatient, etc.), for LTC submissions only.

13) Days' supply (based on dispensed quantity).

b) If no Schedule II-V drug or other selected drugs, as described in Section 2080.230, is dispensed, the dispenser must transmit a zero report, as outlined in the American Society of Automation in Pharmacy (ASAP) Prescription Monitoring Program Standard Version 4.2 (2011), to the central repository, no later than the end of the business day. The incorporation by reference includes no later amendments or editions.

c) For hospitals licensed under the Hospital Licensing Act [210 ILCS 85], any discharge or outpatient prescription exceeding a 72-hour quantity must be reported to the ILPMP central repository no later than the end of the business day. The report shall contain the following data, or any other data deemed necessary by the ILPMPAC:

1) Dispenser DEA number.

2) Recipient's (or animal and owner's) name and address.

3) NDC identification number of the Schedule II-V drug dispensed.

4) Quantity of the Schedule II-V drug dispensed.

5) Date prescription filled.

6) Date prescription written.

7) Prescriber DEA number.

8) Patient ID, for LTC submissions only.

9) Patient gender; see Submitter's Guide at https://www.ilpmp.org/CDC/ILPMPinfo.php for additional gender categories.

10) Patient birth (yyyymmdd – year, month, day).

11) Payment type (i.e., Medicaid, cash, third-party insurance).

12) Patient location code (i.e., home, nursing home, outpatient, etc.), for LTC submissions only.

13) Days' supply (based on dispensed quantity).

d) The Department may impose a civil fine of $100 per day for willful failure to comply with statutory reporting requirements (see 720 ILCS 570/316(a)(4)). The fine shall be calculated on no more than the number of days from the time the report was required to be made until the time the problem was resolved. Fines shall be payable to the Prescription Monitoring Program.

(Source: Amended at 48 Ill. Reg. 15062, effective October 8, 2024)

Section 2080.110 Partial filling of prescriptions (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.120 Emergency situations (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.130 Prescriptions from out-of-state prescribers and exempt Federal practitioners (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.140 Exemption for prescribers in hospitals and institutions (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.150 Exemptions for long term care and home infusion services (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.160 Exemptions for narcotic treatment programs (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.170 Exemptions for research (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

Section 2080.180 Investigatory and regulatory referrals (Repealed)

(Source: Repealed at 26 Ill. Reg. 3975, effective March 4, 2002)

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM
SECTION 2080.190 REPORTS

Section 2080.190 Reports

a) For the purpose of intervention to prevent misuse, a prescriber or dispenser may request that reports about their patients be sent to them via a secure method if a patient meets the current PMP indications of potential misuse criteria set forth by the PMPAC.

b) A personal information report of a patient's prescription profile may be obtained if:

1) The patient, parent, or guardian completes a notarized request; and

2) The patient, parent, or guardian submits the notarized request by mail to the ILPMP at:

Illinois Prescription Monitoring Program

401 North 4^th Street, First Floor

Springfield, Illinois 62702

c) When a person has been identified as having 5 or more prescribers or 5 or more pharmacies, or both, that do not utilize a common electronic file as specified in Section 20 of the Pharmacy Practice Act [225 ILCS 85] for controlled substances within the course of a 6-month period, the ILPMP may issue an unsolicited report to the prescribers informing them of the potential medication shopping [720 ILCS 570/314.5(d)]. If an unsolicited report is issued to a prescriber or prescribers, then the report must also be sent to the applicable dispensing pharmacy. The individual prescriber's judgment determines what actions, if any, they should take upon receipt of the unsolicited 5-5-6 reports.

d) The ILPMP is authorized to develop operational reports to entities with compatible electronic medical records [720 ILCS 570/318(n)]. The report will only include information for patients that are in the entity's electronic health record (EHR). It is the responsibility of the entity to keep the access to this confidential patient information secure. These entities must:

1) Meet and maintain the ILPMP's current security standards as set forth by the Office of the National Coordinator for Health Information Technology (ONC) at https://www.healthit.gov/topic/privacy-security-and-hipaa/health-it-privacy-and security-resources-providers prior to the electronic transfer of information from the ILPMP to its respective EHR;

2) Be a licensed healthcare entity; and

3) Only use this confidential patient information for the treatment of the relevant patient.

e) Technical error and administrative function reports needed to determine that the records are received and maintained in good order may be used.

f) Sample trend analysis reports may be prepared extemporaneously by ILPMP staff. The distribution of all extemporaneous reports shall be at the discretion of the Clinical Director of the ILPMP.

g) Authorized persons listed in this subsection may request information from the ILPMP.

1) Official inquiries must be from any one of the following:

A) DFPR;

B) An investigator from the Illinois Consumer Protection Division of the Office of the Attorney General;

C) A law enforcement officer; or

D) Representatives of the Department of Children and Family Services.

2) All written notices, request and communications may be made by electronic mail to dhs.pmp@illinois.gov. Inquiries must demonstrate that:

A) The applicant has reason to believe that a violation under State or federal law that involves a controlled substance by an individual has occurred; and [720 ILCS 570/318(e)(1)]

B) The requested information is reasonably related to the investigation of the individual, adjudication, or prosecution of the violation. [720 ILCS 570/318(e)(2)]

3) The Department may impose a fee for the cost of generating and furnishing the requested information.

h) Any other reports concerning the information received from dispensers shall only be prepared at the direction of the Clinical Director [720 ILCS 570/102(d-5)] or successor administrator who meets the statutory requirements. The information described in 720 ILCS 570/318(f) may not be released until it has been reviewed by an employee of the Department who is licensed as a prescriber or a dispenser and until that employee has certified that further investigation is warranted [720 ILCS 570/318(g)].

i) As directed by the Clinical Director for the ILPMP, aggregate data that does not indicate any prescriber, practitioner, dispenser, or patient may be used for clinical studies under Article VIII, Part 21 of the Code of Civil Procedure [735 ILCS 5/Art. VIII, Part 21] (Medical Studies).

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.200 Prescriber and Dispenser Inquiry System

The Department's Bureau of Pharmacy and Clinical Support Systems or successor shall establish, operate, maintain, and enhance a stand-alone, one-to-one secure link with the necessary encrypted software that shall function as a prescriber and dispenser inquiry system to be known as the Illinois Prescription Monitoring Program (ILPMP). The Bureau must install a system to track each use of the ILPMP. The tracking system will only be utilized for the following purposes:

a) Determining if a prescriber or dispenser is properly using the ILPMP. If it is considered by the ILPMP staff that any registered user is not using the ILPMP responsibly, an investigator from DFPR's Bureau of Drug Compliance will be contacted in order to investigate the issue. If the ILPMP supervisor considers the issue serious and of immediate concern, the registered user's ILPMP access may be suspended.

b) Determining if a non-registered person or entity is attempting to access the system. The ILPMP staff shall report the situation to the Department and to one or more of the following entities:

1) Illinois law enforcement agency;

2) Illinois regulatory entity;

3) federal agency; or

4) an agency in another state.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.203 Registering with the ILPMP

Each prescriber possessing an Illinois Controlled Substance License shall register with the ILPMP at the ILPMP website.

(Source: Added at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.205 Accessing the ILPMP

a) Prescribers or dispensers or their authorized designee may utilize the ILPMP for patient care after obtaining access authorization from the ILPMP staff.

b) Each prescriber or their designee shall also document an attempt to access patient information in the ILPMP to assess patient access to controlled substances when providing an initial prescription for Schedule II narcotics such as opioids, except for oncology treatment, palliative care, or for a 7-day or less supply provided by a hospital emergency department when treating an acute, traumatic medical condition. This attempt to access shall be documented in the patient's medical record. [705 ILCS 570/314.5(c-5)]

c) Only the following licensed or non-licensed designee employed in that licensed prescriber's office or a licensed designee in a licensed pharmacist's pharmacy who has received training in the federal Health Insurance Portability and Accountability Act and 42 CFR 2 to consult the Illinois Prescription Monitoring Program on their behalf [720 ILCS 570/316(g)] shall serve as an authorized designee for a prescriber or dispenser for entity or pharmacy practice sites:

1) registered nurse;

2) licensed practical nurse;

3) pharmacy technician;

4) student pharmacist;

5) certified medical assistant;

6) dental hygienist; or

7) dental assistant.

d) The prescriber or dispenser shall only have up to five designees, with the exception of a hospital or other authorized location such as a long-term care facility/opioid treatment facility.

e) The hospital, pharmacy, or authorized location shall facilitate the designation of a prescriber's designee for the purpose of accessing the ILPMP for services provided at that location. The EHR system shall send the user's name or other individual identifier to document the person accessing the ILPMP data.

f) The prescriber and dispenser shall register the designees and must also agree to the terms and conditions for designees.

g) Each designee shall have an individual account that must be linked to the prescriber or dispenser.

h) ILPMP staff shall verify the following information about each designee:

1) license/certification number, if applicable;

2) employer's phone number and address; and

3) work email address. If no work email address is available, ILPMP staff shall contact the prescriber or dispenser to verify the designee.

4) For a medical assistant or dental assistant, a certificate of completion for the required HIPAA training, as outlined in 720 ILCS 520/316(g), must be provided to the authorizing prescriber annually.

i) ILPMP shall send out a notice for the prescriber or dispenser to ensure continued employment of their designees. If the prescriber or dispenser determines that the designee is no longer employed with the prescriber or dispenser, the prescriber or dispenser shall terminate the designee's access to the ILPMP by locking the designee's account or by notifying the ILPMP that the designee's account should be locked.

j) A user may only access the ILPMP for a patient's medical treatment.

k) Department staff shall develop, modify, and maintain data files of the ILPMP.

l) Requesters are responsible for any unauthorized use of their ILPMP credentials.

m) In order to expedite the approval and oversight of ILPMP applicants and users, the ILPMP must be managed by a licensed dispenser or licensed prescriber.

n) ILPMP staff determine if a PMP user applicant may become a ILPMP user. The applicant must include the following information which can be submitted on the ILPMP website:

1) Applicant's first and last name;

2) Pharmacy, clinic, or office street address, city, state, and zip code;

3) DEA number;

4) For a pharmacist's application, the pharmacy DEA number;

5) Illinois prescriber or dispenser license number; and

6) Business telephone number.

o) PMP staff shall determine if a ILPMP user applicant may become a ILPMP group user by applying the following criteria:

1) The prescriber or dispenser who will be the account's custodian shall provide the following information:

A) First and last name;

B) DEA number;

C) National Provider Identifier (NPI) number;

D) Illinois prescriber or dispenser license number; and

E) Business telephone number;

2) Hospital emergency department's or other authorized location's street address, city, state, and zip code;

3) The pharmacist-in-charge (PIC) as the central user of the hospital pharmacy; and

4) A listing of all users with the following information:

A) First and last name;

B) Individual NPI;

C) DEA number; and

D) Illinois healthcare license number.

p) The denial appeal process for consideration to obtain access to the ILPMP is stated as the following: The ILPMP Clinical Director or Designee will forward the appeal request to the Bureau Chief for final decision.

q) For ILPMP user applications for which ILPMP staff is unable to make a determination, the Clinical Director or designee shall review those user applications and render a professional decision as to whether access shall be granted.

r) The ILPMP Administrator shall review the user access log for any unusual or improper activity by a user.

s) The Clinical Director or their designee shall directly monitor the development, modification, and/or expansion of the ILPMP.

(Source: Added at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.207 EHR Integration with the ILPMP

As required under 720 ILCS 570/318(j), based upon federal, initial and maintenance funding, a prescriber and dispenser inquiry system shall be developed to assist the health care community in its goal of effective clinical practice and to prevent patients from diverting or abusing medications. The Department shall provide a one-to-one secure link and encrypted software necessary to establish the link between an inquirer and the Department. Technical assistance shall also be provided. Healthcare facilities and their selected EHR systems are required to ensure that their authorized users have access to the State of Illinois PMPnow through this integration pursuant to 720 ILCS 570/316. The State of Illinois PMPnow is a one-to-one secure link from the ILPMP servers directly to the Requester through the EHR or EHR with an agreement with an ONC Certified Health IT Module allowing the information to return in a secure and confidential manner.

a) Security Requirements

1) All security requirements noted within this Part, and all other applicable State and federal security and privacy requirements shall apply.

2) The connecting entity must maintain both an electronic and physical safeguard of the information.

3) Security failures or misuse will be handled as any other violation of the Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. 1320 et seq.).

b) Administrative Control

1) Administrative control, authorization, and determination of all integrations to the ILPMP databases remain the authority of the ILPMP.

2) All data provided by ILPMP will remain the property of the ILPMP and solely be used in compliance with this Part in addition to State and federal laws.

3) A message envelope addressing which patient's data is being requested, including from which state and to which state, when applicable, may be retained for audit purposes. The Requester and routing information for a patient request, including the state from which the request was made, may be retained for audit purposes. Personal health information (PHI) content of a transaction may not be stored or retained.

4) The ILPMP Administrator will direct all performance functions related to the ILPMP databases and servers.

5) Executed and current data sharing agreements shall outline the responsibilities of integration vendors.

6) The ILPMP shall have administrative authority over and the ability to disable individual integration points at no additional cost to the State.

7) All Illinois end user connection points to the ILPMP must reside on the State of Illinois PMPnow Console where administrative tracking and reporting of all connections are maintained.

c) Interstate Data Sharing

1) Interstate data sharing is allowed through the State of Illinois PMPnow when the ILPMP has written authorized permission from the state through which the data is shared.

2) In addition to interstate data sharing through the ILPMP, interstate data sharing is allowed through an integration vendor via an approved data sharing hub. There are only two approved interstate data sharing hubs, states must have agreements between each other to share data. Notwithstanding the above, when working with an Illinois user, as to Illinois data, an integration vendor may only transmit Illinois data, received directly from the ILPMP consistent with and pursuant to Illinois laws and regulations.

3) Interstate data sharing agreements shall be mutual; Illinois will share data if the reciprocal state shares their data.

d) Licensed Healthcare Entity Responsibilities

1) The connecting entity is responsible for compliance with security elements under this rule and under State and federal laws.

2) Any licensed healthcare entity establishing a new integration or changing a current integration must enter into a memorandum of understanding (MOU) with the ILPMP to ensure all parties are aware of the agreements and responsibilities of the parties.

3) A list of providers and locations served by the EHR system used by the licensed healthcare entity must be provided to the ILPMP on a semi-annual basis, supplied by the licensed healthcare entity or pharmacist in charge (this may also be done at the corporate level of a licensed healthcare entity or pharmacy organization) and:

A) Shall contain the following information:

i) Location name;

ii) Address;

iii) City;

iv) State;

v) Zip code;

vi) Contact at facility;

vii) Facility contact email address;

viii) Health care provider name (first and last);

ix) Health care provider DEA;

x) Health care provider NPI (National Provider Identifier); and

xi) Health care provider license number.

B) Shall be sent to the ILPMP in one of the following electronic formats:

i) Excel (.xlsx or .xls); or

ii) Comma separated values (.csv).

4) Upon request, the licensed healthcare entity or their integration vendor must provide an audit of the user that performed the search, the patient information that was searched on, and the date and time of the search.

5) While the Department does not restrict access to the State of Illinois PMPnow to a specific integration vendor, the Department does require integration vendors to have a data sharing agreement (DSA) in place with the ILPMP to define the roles and responsibilities of each party and the security requirements.

6) The licensed healthcare entity is the party for whom the decision of the method of integration rests. The licensed healthcare entity is fiscally responsible for the cost of their EHR services and so the licensed healthcare entity shall remain the responsible party for this decision. This decision shall be documented in a memorandum of understanding (MOU) with the ILPMP and contain the following minimum points:

A) The licensed healthcare entity is aware of the statutory requirement to integrate with the State of Illinois PMPnow.

B) The licensed healthcare entity is aware of the choices in integration vendor and the costs associated with their choice. This cost may come from either the EHR and/or the integration vendor. The ILPMP shall not levy additional fees.

C) The licensed healthcare entity is aware some states require this MOU for interstate data sharing. The MOU will contain the states from which the entity is interested in receiving data and if there is a choice of always querying that state or only having the query available upon the healthcare professional's choice. Interstate data sharing logic will be built to reflect the agreement between the two states exchanging data. The entity shall be notified of any conflicting state statutes and limitations between Illinois and a requested state. ILPMP shall work diligently to resolve when possible.

D) The licensed healthcare entity may choose the integration vendor from those parties who have an approved and current DSA with the Department.

E) Licensed healthcare entity previously integrated with the State of Illinois PMPnow shall not be required to enter into an MOU unless the entity is requesting a change in their application vendor integration method, integration vendor, or interstate data sharing.

F) Following successful testing, ILPMP will activate the production environment for the entity's use in exchanging transactions.

e) Electronic integration shall be done using the following process:

1) The licensed healthcare entity shall either email dhs.pmp@illinois.gov to request the State of Illinois PMPnow integration or request that the EHR vendor provides the State of Illinois PMPnow integration to the vendor's Requesters as a function of its general software configuration.

2) An executed MOU will be necessary to continue.

3) The licensed healthcare entity shall determine which integration vendor meets the needs of their organization.

f) Integration Vendor

1) The licensed healthcare entity shall work with their EHR vendor and, if applicable, integration vendor to determine its feasibility for connectivity to the State of Illinois PMPnow service. The State of Illinois PMPnow supports the following connectivity options, one of which shall be used by the connecting entity:

A) A SOAP-based web service that uses a PMIX-based protocol;

B) A RESTful-based web service that uses the NCPDP protocol;

C) A RESTful-based web service that uses a PMIX-based protocol;

D) Fast Healthcare Interoperability Resources (FHIR);

E) Access to ILPMP through a verified, federally sponsored connection; or

F) The use of an ILPMP authorized/funded integration application.

2) The technology used for connecting/integration with the ILPMP must meet the one-to-one secure link connection requirement (see Section 2080.207).

3) A one-to-one secure link connects the provider and the ILPMP through an EHR. An EHR system may provide this connection directly, or through a designated a Certified Health IT Module that is an integrated component of that EHR. If a Certified Health IT Module is used, it must meet the following requirements:

A) The Certified Health IT Module connection shall ensure that the Requester has access to the ILPMP data at any point in the Requester's workflow.

B) ILPMP data may not be used for any risk analysis or alert without explicitly displaying the method used for analysis.

C) The licensed healthcare entity must attest to the existence of a legal agreement between the EHR vendor and the Certified Health IT Module vendor and that the Certified Health IT Module serves as an integrated component of the EHR when using a Certified Health IT Module access method.

D) The Certified Health IT Module connection must meet the security requirements for electronic health record systems set forth by the Office of the National Coordinator for Health Information Technology (ONC), available at https://www.healthit.gov/topic/certification-ehrs/certification-criteria.

E) The Certified Health IT Module must be certified by the ONC or an ONC-Authorized Certification Body (ONC-ACB). Certification must be published on the ONC's Certified Health IT Product List. The ILPMP reserves the right to terminate the connection points if the vendor/product is decertified by an ONC-ACB.

g) Data Uses and Retention

1) Data passed directly from the ILPMP to the EHR authenticated Requester shall not be:

A) Unencrypted in transit;

B) Analyzed;

C) Data mined or scrapped;

D) Deconstructed;

E) Stored or cached;

F) Sold; or

G) Used for other collection of individual data points. Prescription Monitoring Program data shall only be disclosed as permitted by law.

2) A message envelope addressing which patient's data is being requested, from which state, and to which state may be retained for audit purposes as applicable. The Requester and routing information for a patient request, including the state from which the request was made, may be retained for audit purposes. PHI content of a message may not be stored or retained.

3) Data from the ILPMP may not be pre-fetched.

4) An EHR authenticated Requester is an individual granted a username and password by the licensed healthcare entity for which the EHR is utilized for patient care.

5) With permission from the ILPMP, electronic messaging to authenticate that the Requester performed a qualified search of the ILPMP may be returned to the EHR for documentation of the query.

6) Data sets displayed through the ILPMP extend beyond controlled substances and shall not be distributed or accessed without authorized permission from the Clinical Director or the Director's designee.

7) The State retains the right to inspect and review an entity or system transmitting ILPMP data to assure and confirm that the data is not being put to a prohibited use as detailed in subsection (g)(1), subject to a reasonable non-disclosure agreement as permitted by State law to protect the entity's or system's trade secrets or other proprietary information.

8) Analysis of ILPMP data shall only be allowed with the express written permission of the ILPMP.

9) Access to audit data shall be available in hourly to real-time increments at no cost to the State.

10) Non-compliance by the integration vendor, Electronic Health Record System, Certified Health IT Module, Pharmacy Management System or Pharmacy Dispensing System, their customers, or any parties required to comply with this Section, may result in the party being prohibited from serving as an entity or system for integration with or utilizing the Prescription Monitoring Program and contracts, agreements, or other business relationship may be terminated. The Department shall institute appropriate cure notices, as necessary, to remedy non-compliance. [720 ILCS 570/316.1(c)]

h) The Department may impose a civil fine of $100 per day on any licensed healthcare entity and/or EHR vendor that willfully fails to comply with statutory integration requirements as reflected in this Section. (See 720 ILCS 570/316(a)(4)) Assessment of the fine may begin on January 1, 2026, two years after the statutory requirement took effect on January 1, 2024, and shall remain in effect until the facility and/or vendor completes the EHR integration process. Fines will be assessed on a monthly basis. Fines shall be payable to the Illinois Prescription Monitoring Program. Fines will not be assessed if the delay in integration is due to Department resources/limitations. Fines will be assessed pursuant to 720 ILCS 570/318(b) as follows:

1) The licensed healthcare entity and/or EHR vendor will be informed of the potential fines for not complying with the requirements. Letters will be physically mailed and e-mailed.

A) The first letter sent to the licensed healthcare entity and/or EHR will be considered the First Warning of Willful Non-Compliance. The date of the notice of non-compliance, mailed pursuant to subsection (h)(1)(C), will be the start date from which the ILPMP will assess potential fines.

B) During the first full calendar week of the following month, a second letter will be sent. This letter will be considered the Second and Final Warning of Willful Non-Compliance.

C) During the first full calendar week of the next month, a notice of non-compliance will be sent to the licensed healthcare entity and/or EHR vendor that will include a notice of referral to the Bureau of Collections (Referral to Bureau of Collections Due to Willful Non-Compliance with the Illinois Controlled Substances Act) [720 ILCS 570/316].

2) Compliance will be tracked within the Department.

3) After sending the third letter pursuant to subsection (h)(1)(C), copies of communications, previous warning letters, and notices shall be sent to the Bureau of Collections along with any additional documentation to support the establishment of collection activities in the Revenue Management Section (RMS).

i) Exemptions to connection/integration requirements.

1) Providers who do not use an EHR system or electronic prescription system may provide a written notification that they do not have/use an EHR system or electronic prescription system within their practice/facility/location.

2) Prescribers who certify with DFPR that they will not issue more than 150 prescriptions during a 12-month period shall provide a written notification to the ILPMP, for exemption from the integration requirements. The written notification may be sent to DHS.PMP@Illinois.gov.

3) Healthcare entities that perform occupational health/employee health services are exempt from the integration process from their electronic system to the ILPMP for the purposes of this Section for occupational health/employee health services. All prescribers are encouraged to follow proper clinical protocols/best practices of their professional prescribing guidelines. The prescriber is still able to utilize the ILPMP website for necessary viewing.

(Source: Amended at 48 Ill. Reg. 15062, effective October 8, 2024)

Section 2080.208 Pharmacy Management Systems Integration with the ILPMP

As required under 720 ILCS 570/318(j), based upon federal, initial and maintenance funding, a prescriber and dispenser inquiry system shall be developed to assist the health care community in its goal of effective clinical practice and to prevent patients from diverting or abusing medications. The Department shall provide a one-to-one secure link and encrypted software necessary to establish the link between an inquirer and the Department. Technical assistance shall also be provided. Pharmacies and their selected pharmacy management systems are required to ensure that their authorized users have access to the State of Illinois PMPnow through this integration (see 720 ILCS 570/316). The State of Illinois PMPnow is a one-to-one secure link from the ILPMP servers directly to the Requester through the pharmacy management system allowing the information to return in a secure and confidential manner.

a) Security Requirements

1) All security requirements noted within this Section, administrative rule, and all other applicable State and federal security and privacy requirements shall apply.

2) The connecting entity must maintain both an electronic and physical safeguard of the information.

3) Security failures or misuse will be handled as any other violation of the Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. 1320 et seq.).

b) Administrative Control

1) Administrative control, authorization, and determination of all integrations to the Illinois Prescription Monitoring Program's databases remain the authority of the ILPMP.

2) All data provided by ILPMP will remain the property of the ILPMP and solely be used in compliance with this Part in addition to State and federal laws.

4) Functions performed related to the ILPMP databases and servers will be under the direction of the ILPMP Administrator.

5) Executed and current data sharing agreements shall outline the responsibilities of integration vendors.

6) The ILPMP shall have administrative authority and the ability to disable individual integration points at no additional cost to the State.

7) All Illinois end user connection points to the ILPMP must reside on the State of Illinois PMPnow Console where administrative tracking and reporting of all connections are maintained.

c) Interstate Data Sharing

1) Interstate data sharing is allowed through the State of Illinois PMPnow when the ILPMP has written authorized permission from the state through which the data is shared.

2) In addition to interstate data sharing through the ILPMP, interstate data sharing is allowed through an integration vendor via an approved data sharing hub. There are only two approved interstate data sharing hubs, RxCheck and PMPi. Regardless of the integration vendor, the individual states must have agreements between each other to share data. Notwithstanding the above, when working with an Illinois user, as to Illinois data, an integration vendor may only transmit Illinois data received directly from the ILPMP, consistent with and pursuant to Illinois laws and regulations.

3) Interstate data sharing agreements shall be mutual; Illinois will share data if the reciprocal state shares their data.

d) Pharmacy Entity Responsibilities

1) The connecting entity is responsible for compliance with security elements under this rule and under State and federal laws.

2) Any pharmacy entity establishing a new integration or changing a current integration must enter into a memorandum of understanding (MOU) with the ILPMP to ensure all parties are aware of the agreements and responsibilities of the parties.

3) A list of pharmacists and pharmacy locations served by the pharmacy management system used by the pharmacy entity must be provided to the ILPMP on a semiannual basis, supplied by the pharmacy entity or pharmacist in charge (this may also be done at the corporate level of a pharmacy entity) and:

A) Shall contain the following information:

i) Location name;

ii) Address;

iii) City;

iv) State;

v) Zip code;

vi) Contact at the pharmacy;

vii) Pharmacy contact email address;

viii) Pharmacist name (first and last);

ix) Pharmacy DEA number;

x) National Provider Identifier (NPI), when available; and

xi) Pharmacist license number.

B) Shall be sent to the ILPMP in one of the following electronic formats:

i) Excel (.xlsx or .xls); or

ii) Comma separated values (.csv).

4) Upon request, the pharmacy entity or their integration vendor must provide an audit of the user that performed the search, the patient information that was searched on, and the date and time of the search.

6) The pharmacy entity is the party for whom the decision of the method of integration rests. The pharmacy entity is fiscally responsible for the cost of their pharmacy management system services and for the cost of their integration vendor, if they choose to use an integration option other than that provided by ILPMP, and so the pharmacy entity shall remain the responsible party for this decision. This decision shall be documented in a memorandum of understanding (MOU) with the ILPMP and contain the following minimum points:

A) The pharmacy entity is aware of the statutory requirement to integrate with the State of Illinois PMPnow ILPMP.

B) The pharmacy entity is aware of the choices in integration vendor and the costs associated with their choice. This cost may come from either the pharmacy management vendor and/or the integration vendor. The ILPMP shall not levy additional fees.

C) The pharmacy entity is aware some states require an MOU for interstate data sharing. The MOU will contain the states from which the entity is interested in receiving data and if there is a choice of always querying that state or only having the query available upon the pharmacist's choice. Interstate data sharing logic will be built to reflect the agreement between the two states exchanging data. The entity shall be notified of any conflicting state statutes and limitations between Illinois and requested states. ILPMP shall work diligently to resolve when possible.

D) The pharmacy entity may choose the integration vendor from those parties who have an approved and current DSA with the Department.

E) The pharmacy entities previously integrated with the State of Illinois PMPnow shall not be required to enter into an MOU unless the pharmacy entity is requesting a change in their application vendor integration method, integration vendor, or interstate data sharing.

F) Following successful testing, ILPMP will activate the production environment for the pharmacy entity's use in exchanging transactions.

e) Electronic integration shall be performed using the following process:

1) The pharmacy entity shall either email dhs.pmp@illinois.gov to request the State of Illinois PMPnow integration or request that the pharmacy management system vendor provides the State of Illinois PMPnow integration to the vendor's Requesters as a function of the vendor's general software configuration.

2) An executed MOU will be necessary to continue.

3) The pharmacy entity shall determine which integration vendor meets the needs of their organization.

f) Integration Vendor

1) The pharmacy entity shall work with their pharmacy management system vendor and, if applicable, their integration vendor to determine its feasibility for connectivity to the State of Illinois PMPnow service. The State of Illinois PMPnow supports the following connectivity options, one of which must be used by the connecting entity:

A) A SOAP-based web service that uses a PMIX-based protocol;

B) A RESTful-based web service that uses the NCPDP protocol;

C) A RESTful-based web service that uses a PMIX-based protocol;

D) Fast Healthcare Interoperability Resources (FHIR);

E) Access to the ILPMP through a verified, federally sponsored connection; or

F) The use of an ILPMP authorized/funded integration application.

2) The technology used for connecting/integration with the ILPMP must meet the one-to-one secure link connection requirement (see Section 2080.208).

3) A one-to-one secure link (see Section 2080.208) connects the pharmacist and the ILPMP through a pharmacy management system.

g) Data Uses and Retention

1) Data passed directly from the ILPMP to the pharmacy management system's authenticated Requester shall not be:

A) Unencrypted in transit;

B) Analyzed;

C) Data mined or scrapped;

D) Deconstructed;

E) Stored or cached;

F) Sold; or

G) Used for other collection of individual data points. Prescription Monitoring Program data shall only be disclosed as permitted by law.

3) Data from the ILPMP may not be pre-fetched.

4) A pharmacy management system authenticated Requester is an individual granted a username and password by the pharmacy/location for which the pharmacy management system is utilized for patient care.

5) With permission from the ILPMP, electronic messaging to authenticate that the Requester performed a qualified search of the ILPMP may be returned to the pharmacy management system for documentation of the query.

8) Analysis of ILPMP data shall only be allowed with the express written permission of the ILPMP.

9) Access to audit data shall be available in hourly to real-time increments at no cost to the State.

10) Non-compliance by the integration vendor, Electronic Health Record System, Certified Health IT Module, pharmacy management system or pharmacy dispensing system, their customers, or any parties required to comply with this Section, may result in the party being prohibited from serving as an entity or system for integration with or utilizing the Prescription Monitoring Program and contracts, agreements, or other business relationship may be terminated. The Department shall institute appropriate cure notices, as necessary, to remedy non-compliance. [720 ILCS 570/316.1(c)]

h) The Department may impose a civil fine of $100 per day on any pharmacy entity and/or pharmacy management software vendor that willfully fails to comply with statutory integration requirements as reflected in this Section. (See 720 ILCS 570/316(a)(4)) Assessment of the fine may begin on January 1, 2026, two years after the statutory requirement took effect on January 1, 2024, and shall remain in effect until the pharmacy and/or vendor completes the integration process. Fines will be assessed on a monthly basis. Fines shall be payable to the Illinois Prescription Monitoring Program. Fines will not be assessed if the delay in integration is due to Department resources/limitations. Fines will be assessed pursuant to 720 ILCS 570/318(b) as follows:

1) The pharmacy entity and/or pharmacy management system will be informed of the potential fines for not complying with the requirements. Letters will be physically mailed and e-mailed.

A) The first letter sent to the pharmacy entity and/or pharmacy management system will be considered the First Warning of Willful Non-Compliance. The date of the notice of non-compliance, mailed pursuant to subsection (h)(1)(C), will be the start date from which the ILPMP will assess potential fines.

B) During the first full calendar week of the following month, a second letter will be sent. This letter will be considered the Second and Final Warning of Willful Non-Compliance.

C) During the first full calendar week of the next month, a notice of non-compliance will be sent to the pharmacy entity and/or pharmacy management system that will include a notice of referral to the Bureau of Collections (Referral to Bureau of Collections Due to Willful Non-Compliance with the Illinois Controlled Substances Act) [720 ILCS 570/316].

2) Compliance will be tracked within the Department.

i) Exemptions to connection/integration requirements

1) Pharmacies that do not use a pharmacy management system or electronic pharmacy dispensing system may certify that they do not have/use an electronic system within their pharmacy location.

2) Pharmacies that are departments of inpatient hospital facilities.

(Source: Amended at 48 Ill. Reg. 15062, effective October 8, 2024)

Section 2080.210 Access to the Prescription Information Library (PIL) (Repealed)

(Source: Repealed at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.211 Other State Prescription Monitoring Authority Access

a) Other states may request access to the PMP database:

1) After approval of a Memorandum of Understanding from the Illinois Department of Human Services; and

2) After approval from the Department's Bureau of Pharmacy and Clinical Support Systems' manager; the request must be:

A) related to a "probable cause" investigation; or

B) for a health care inquiry system for prescribers and dispensers.

b) Each state requesting access must comply with Illinois law and allow reciprocity.

(Source: Added at 33 Ill. Reg. 17333, effective December 9, 2009)

TITLE 77: PUBLIC HEALTH
CHAPTER X: DEPARTMENT OF HUMAN SERVICES
SUBCHAPTER e: CONTROLLED SUBSTANCES ACTIVITIES
PART 2080 ELECTRONIC PRESCRIPTION MONITORING PROGRAM
SECTION 2080.220 ERROR REPORTING

Section 2080.220 Error Reporting

a) If a prescriber notices an error in their prescription information, they shall report it to the dispensing pharmacy within 7 days after discovery of the error.

b) A dispenser who notices an error in a prescription they have dispensed and transmitted shall retract the incorrect prescription and retransmit the prescription correctly within 7 days after discovery of the error.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.230 Designated Controlled Substances and Other Selected Drugs

For tracking purposes, the Department, upon recommendation of the PMPAC, may designate and list drugs, other substances, and immediate precursors as:

a) A Schedule I if the Department finds that:

1) the substance has high potential for abuse; and

2) the substance has no currently accepted medical use in treatment in the United States or lacks accepted safety for use in treatment under medical supervision [720 ILCS 570/203].

b) A Schedule II if the Department finds that:

1) the substance has high potential for abuse;

2) the substance has currently accepted medical use in treatment in the United States, or currently accepted medical use with severe restrictions; and

3) the abuse of the substance may lead to severe psychological or physiological dependence [720 ILCS 570/205].

c) A Schedule III if the Department finds that:

1) the substance has a potential for abuse less than the substances listed in Schedules I and II;

2) the substance has currently accepted medical use in treatment in the United States; and

3) abuse of the substance may lead to moderate or low physiological dependence or high psychological dependence [720 ILCS 570/207].

d) A Schedule IV if the Department finds that:

1) the substance has a low potential for abuse relative to substances in Schedule III;

2) the substance has currently accepted medical use in treatment in the United States; and

3) abuse of the substance may lead to limited physiological dependence or psychological dependence relative to the substances in Schedule III [720 ILCS 570/209].

e) A Schedule V if the Department finds that:

1) the substance has low potential for abuse relative to the controlled substances listed in Schedule IV;

2) the substance has currently accepted medical use in treatment in the United States; and

3) abuse of the substance may lead to limited physiological dependence or psychological dependence relative to the substances in Schedule IV, or the substance is a targeted methamphetamine precursor as defined in the Methamphetamine Precursor Control Act [720 ILCS 648]. [720 ILCS 570/211]

f) Other Selected Drugs, including:

1) those medications that may contribute to clinical reviews of scheduled medications;

2) those medications determined to need additional monitoring or to assist in facilitating medication optimization and utilization; and

3) the dispensing of Naloxone for opioid overdose prevention.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.240 Mid-Level Practitioners Prescriptive Authority Reporting

In order to prevent erroneous association of prescriptions and remain compliant with the PMP, any supervising or collaborating physician who has delegated prescriptive authority to a mid-level practitioner is required to log in and fill out the electronic form on the PMP website (www.ilpmp.org) detailing what prescriptive authority he or she has delegated in compliance with the Act. It is incumbent upon the collaborating or supervising physician to keep this record up to date. The form will require, but is not limited to, the following data fields:

a) Mid-level practitioner's information necessary for the electronic PMP form:

1) Name (First, MI, Last);

2) DEA number;

3) Profession; and

4) Mid-Level Practitioner's Professional License Numbers.

b) Delegating physician or podiatrist:

1) Name (First, MI, Last);

2) DEA number;

3) Profession; and

4) Mid-Level Practitioner's Professional License Numbers.

c) List of drugs delegated.

(Source: Added at 39 Ill. Reg. 6421, effective April 22, 2015)

Section 2080.245 Advanced Practice Registered Nurse with Full Practice Authority

a) An advanced practice registered nurse granted Full Practice Authority under 225 ILCS 65/65-43 who prescribes Schedule II narcotic drugs, such as opioids, shall establish a consulting relationship with a physician and shall record that relationship in the ILPMP website (www.ilpmp.org). The advanced practice registered nurse and the physician are both responsible for entering in the ILPMP the name, DEA number, and license number of the consulting physician.

b) Information necessary for the ILPMP form:

1) Name (First, MI, Last);

2) DEA number;

3) Profession of the advanced practice registered nurse; and

4) Professional license numbers.

c) For Schedule II Narcotics (opioids) only, the consulting physician must provide:

1) Name (first, MI, last);

2) DEA number;

3) Profession;

4) Practitioner's professional license numbers; and

5) List of specific Schedule II narcotic drugs by name.

(Source: Added at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.250 Mailing of Controlled Substances

a) Controlled substances may be mailed if all of the following conditions are met:

1) The controlled substances are not outwardly dangerous and are not likely, of their own force, to cause injury to a person's life or health.

2) The inner container of a parcel containing controlled substances must be marked and sealed as required under the Act and be placed in a plain outer container or securely wrapped in plain paper.

3) If the controlled substance consists of prescription medicines, the inner container must be labeled to show the name and address of the pharmacy or practitioner dispensing the prescription.

4) The outside wrapper or container must be free of markings that would indicate the nature of the contents. [720 ILCS 570/312 (k)(1)]

b) No controlled substance may be mailed outside the United States, including US territories, without the mailer:

1) Registering the package with the DEA as an exported product as set forth in 21 CFR 1301 and 1309.

2) Obtaining the necessary permits, or submitting the necessary declarations for export as set forth in 21 CFR 1312 and 1313.

(Source: Added at 39 Ill. Reg. 6421, effective April 22, 2015)

Section 2080.320 Illinois Prescription Monitoring Program Advisory Committee (ILPMPAC)

The Illinois Prescription Monitoring Program Advisory Committee (ILPMPAC) is established to aid in the implementation of the ILPMP and to advise the Clinical Director on the professional performance of prescribers and dispensers and other matters relevant to the ILPMPAC's field of competence. [720 ILCS 570/320(a)]

a) The Clinical Director shall serve as a non-voting secretary of the committee and appoint the members of the ILPMPAC based on nominations from their respective professional associations. The ILPMPAC may appoint a chairperson and other officers as it deems appropriate. [720 ILCS 570/320(b)]

b) Pursuant to 720 ILCS 570/320(b), the ILPMPAC shall consist of the following:

1) one family or primary care physician;

2) one pain specialist physician;

3) four other physicians licensed to practice medicine in all of its branches, one of whom may be an ophthalmologist;

4) three pharmacists;

5) two advanced practice registered nurses;

6) one dentist;

7) one optometrist;

8) one clinical representative from a statewide organization representing hospitals; and

9) one physician assistant.

c) Pursuant to 720 ILCS 570/320(e), the ILPMPAC shall:

1) evaluate and recommend changes to the Illinois Controlled Substances Act [720 ILCS 570];

2) evaluate and recommend changes to the Administrative Rules regarding the ILPMP;

3) recommend inclusion of training materials for prescribers and dispensers regarding Continuing Medical Education and Continuing Education programs;

4) at least on a semi-annual basis, review the contents of the ILPMP website (ilpmp.org) to ensure that the contents are current;

5) at least on a semi-annual basis, review opportunities for federal grants and other forms of funding to support projects to increase the number of EHRs integrating seamlessly to the ILPMP; and

6) at least on a semi-annual basis, review and prepare any communication to be sent to all registered users of the system relevant to prescribing and dispensing of controlled substances.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)

Section 2080.325 Peer Review Committee

The ILPMPAC is authorized to have a standing subcommittee. This subcommittee shall be a ten-member Peer Review Committee. The Peer Review Committee shall advise the ILPMP on matters relating to the advisory committee's field of competence, establish a formal peer review of the professional performance of prescribers and dispensers, and develop communications to transmit to prescribers and dispensers. The deliberations, information, and communications of the Peer Review Committee are privileged and confidential and shall not be disclosed in any manner except in accordance with current law.

a) The ILPMPAC shall select 10 of its members to be part of the Peer Review Committee.

b) The Peer Review Committee shall consist of the following:

1) three physicians;

2) three pharmacists;

3) one dentist;

4) one advanced practice registered nurse;

5) one physician assistant; and

6) one optometrist.

c) The Peer Review Committee shall meet, at a minimum, semi-annually.

d) The Peer Review Committee shall periodically review the data contained within the ILPMP database to identify those prescribers or dispensers who may be prescribing or dispensing outside the currently established professional standards for the prescriber's or dispenser's field of practice and for the type of medication (e.g., opioids) or type of care (e.g., hospice) applicable to the prescription under review. The Peer Review Committee member(s), whose profession is the same as the prescriber or dispenser being reviewed, shall make recommendations for any non-action or action. The ILPMP Clinical Director and staff shall provide necessary assistance and data as required. [720 ILCS 570/320(f)(1)]

e) The Peer Review Committee may request information regarding the prescribing or dispensing practices of identified providers. Requests for information shall be sent via certified mail. A prescriber or dispenser shall have 30 days to respond to the request for information. [720 ILCS 570/320(f)(2)]

f) Pursuant to 720 ILCS 570/320(f)(3), the Peer Review Committee shall refer a prescriber or dispenser to DFPR:

1) if a prescriber or dispenser does not respond to three successive requests for information;

2) if, in the opinion of a majority of the members of the Peer Review Committee, the prescriber or dispenser does not have a satisfactory explanation for the practices identified by the Peer Review Committee or the prescriber or dispenser does not have a satisfactory explanation for the practices identified by the Peer Review Committee in its request for information; or

3) if, following communications with the Peer Review Committee, the prescriber or dispenser does not sufficiently rectify the practices identified in the request for information in the opinion of a majority of the members present of the Peer Review Committee.

g) The Peer Review Committee shall prepare an annual report to the General Assembly starting on July 1, 2017. Pursuant to 720 ILCS 570/320(5), the annual report shall be delivered electronically to the Department and to the General Assembly. The report to the General Assembly shall be filed with the Clerk of the House of Representatives and the Secretary of the Senate in electronic form only, in the manner that the Clerk and the Secretary shall direct. The report shall contain the following information:

1) the number of times the Peer Review Committee was convened;

2) the number of prescribers or dispensers who were reviewed by the Peer Review Committee;

3) the number of requests for information sent out by the Peer Review Committee; and

4) the number of prescribers or dispensers referred to DFPR.

(Source: Amended at 47 Ill. Reg. 13500, effective September 8, 2023)