(410 ILCS 130/145)

Sec. 145. Confidentiality.

(a) The following information received and records kept by the Department of Public Health, Department of Financial and Professional Regulation, Department of Agriculture, or Illinois State Police for purposes of administering this Act are subject to all applicable federal privacy laws, confidential, and exempt from the Freedom of Information Act, and not subject to disclosure to any individual or public or private entity, except as necessary for authorized employees of those authorized agencies to perform official duties under this Act and the following information received and records kept by Department of Public Health, Department of Agriculture, Department of Financial and Professional Regulation, and Illinois State Police, excluding any existing or non-existing Illinois or national criminal history record information as defined in subsection (d), may be disclosed to each other upon request:

(1) Applications and renewals, their contents, and supporting information submitted by qualifying patients and designated caregivers, including information regarding their designated caregivers and certifying health care professionals.

(2) Applications and renewals, their contents, and supporting information submitted by or on behalf of cultivation centers and dispensing organizations in compliance with this Act, including their physical addresses. This does not preclude the release of ownership information of cannabis business establishment licenses.

(3) The individual names and other information identifying persons to whom the Department of Public Health has issued registry identification cards.

(4) Any dispensing information required to be kept under Section 135, Section 150, or Department of Public Health, Department of Agriculture, or Department of Financial and Professional Regulation rules shall identify cardholders and registered cultivation centers by their registry identification numbers and medical cannabis dispensing organizations by their registration number and not contain names or other personally identifying information.

(5) All medical records provided to the Department of Public Health in connection with an application for a registry card.

(b) Nothing in this Section precludes the following:

(1) Department of Agriculture, Department of Financial and Professional Regulation, or Public Health employees may notify law enforcement about falsified or fraudulent information submitted to the Departments if the employee who suspects that falsified or fraudulent information has been submitted conferred with his or her supervisor and both agree that circumstances exist that warrant reporting.

(2) If the employee conferred with his or her supervisor and both agree that circumstances exist that warrant reporting, Department of Public Health employees may notify the Department of Financial and Professional Regulation if there is reasonable cause to believe a certifying health care professional:

(A) issued a written certification without a bona fide health care professional-patient relationship under this Act;

(B) issued a written certification to a person who was not under the certifying health care professional's care for the debilitating medical condition; or

(C) failed to abide by the acceptable and prevailing standard of care when evaluating a patient's medical condition.

(3) The Department of Public Health, Department of Agriculture, and Department of Financial and Professional Regulation may notify State or local law enforcement about apparent criminal violations of this Act if the employee who suspects the offense has conferred with his or her supervisor and both agree that circumstances exist that warrant reporting.

(4) Medical cannabis cultivation center agents and medical cannabis dispensing organizations may notify the Department of Public Health, Department of Financial and Professional Regulation, or Department of Agriculture of a suspected violation or attempted violation of this Act or the rules issued under it.

(5) Each Department may verify registry identification cards under Section 150.

(6) The submission of the report to the General Assembly under Section 160.

(b-5) Each Department responsible for licensure under this Act shall publish on the Department's website a list of the ownership information of cannabis business establishment licensees under the Department's jurisdiction. The list shall include, but shall not be limited to, the name of the person or entity holding each cannabis business establishment license and the address at which the entity is operating under this Act. This list shall be published and updated monthly.

(c) Except for any ownership information released pursuant to subsection (b-5) or as otherwise authorized or required by law, it is a Class B misdemeanor with a $1,000 fine for any person, including an employee or official of the Department of Public Health, Department of Financial and Professional Regulation, or Department of Agriculture or another State agency or local government, to breach the confidentiality of information obtained under this Act.

(d) The Department of Public Health, the Department of Agriculture, the Illinois State Police, and the Department of Financial and Professional Regulation shall not share or disclose any existing or non-existing Illinois or national criminal history record information. For the purposes of this Section, "any existing or non-existing Illinois or national criminal history record information" means any Illinois or national criminal history record information, including but not limited to the lack of or non-existence of these records.

(Source: P.A. 101-363, eff. 8-9-19; 102-98, eff. 7-15-21; 102-538, eff. 8-20-21; 102-813, eff. 5-13-22.)