SB1307 101ST GENERAL ASSEMBLY

LRB101 06900 CPF 51932 b

101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
SB1307

Introduced 2/7/2019, by Sen. Chapin Rose

SYNOPSIS AS INTRODUCED:

410 ILCS 513/31
410 ILCS 513/31.1
410 ILCS 513/31.2
410 ILCS 513/31.3
410 ILCS 513/31.5
410 ILCS 513/31.7

Amends the Genetic Information Privacy Act. In provisions concerning uses and disclosures for treatment, payment, health care operations, health oversight activities, and public health activities; uses and disclosures of information to a health information exchange; business associates; and establishment and disclosure of limited data sets and de-identified information, provides that various uses or disclosures of a patient's genetic information may not (rather than may) occur without the patient's consent. Effective immediately.

A BILL FOR

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Genetic Information Privacy Act is amended by changing Sections 31, 31.1, 31.2, 31.3, 31.5, and 31.7 as follows:

(410 ILCS 513/31)

Sec. 31. Uses and disclosures for treatment, payment, and health care operations. A Notwithstanding Sections 30 and 35 of this Act, a covered entity may not, without a patient's consent:

(1) use or disclose genetic information for its own treatment, payment, or health care operations;

(2) disclose genetic information for treatment activities of a health care provider;

(3) disclose genetic information to another covered entity or health care provider for the payment activities of the entity that receives the information;

(4) disclose genetic information to another covered entity for health care operations activities of the entity that receives the information, if each entity has or had a relationship with the individual who is the subject of the genetic information being requested, the genetic information pertains to such relationship, and the disclosure is for the purpose of (A) conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management, and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (B) reviewing the competence or qualifications of health care professionals or health care providers, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities; or (C) health care fraud and abuse detection or compliance; and

(5) disclose genetic information to other participants in an organized health care arrangement in which the covered entity is also a participant for any health care operations activities of the organized health care arrangement.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 513/31.1)

Sec. 31.1. Uses and disclosures for health oversight activities.

(a) A Notwithstanding Sections 30 and 35 of this Act, a covered entity may not disclose genetic information, without a patient's consent, to a health oversight agency for health oversight activities authorized by law, including audits, civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil administrative or criminal proceedings or actions; or other activities necessary for appropriate oversight of (i) the health care system; (ii) government benefit programs for which health information is relevant to beneficiary eligibility; (iii) entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or (iv) entities subject to civil rights laws for which health information is necessary for determining compliance.

(b) For purposes of the disclosures permitted by this Section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to (i) the receipt of health care; (ii) a claim for public benefits related to health; or (iii) qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services, except that, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of this Section.

(c) If a covered entity is also a health oversight agency, the covered entity may use genetic information for health oversight activities permitted by this Section.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 513/31.2)

Sec. 31.2. Uses and disclosures for public health activities. Genetic Notwithstanding Sections 30 and 35 of this Act, genetic information may not be disclosed without a patient's consent for public health activities and purposes to the Department, when the Department is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 513/31.3)

Sec. 31.3. Business associates.

(a) A Notwithstanding Sections 30 and 35 of this Act, a covered entity may not, without a patient's consent, disclose a patient's genetic information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains, through a written contract or other written agreement or arrangement that meets the applicable requirements of 45 CFR 164.504(e), satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(b) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 513/31.5)

Sec. 31.5. Use and disclosure of information to an HIE. A Notwithstanding the provisions of Section 30 and 35 of this Act, a covered entity may not, without a patient's consent, disclose the identity of any patient upon whom a test is performed and such patient's genetic information from a patient's record to a HIE if the disclosure is a required or permitted disclosure to a business associate or is a disclosure otherwise required or permitted under this Act. An HIE may not, without a patient's consent, use or disclose such information to the extent it is allowed to use or disclose such information as a business associate in compliance with 45 CFR 164.502(e) or for such other purposes as are specifically allowed under this Act.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 513/31.7)

Sec. 31.7. Establishment and disclosure of limited data sets and de-identified information.

(a) A covered entity may not, without a genetic information test subject's consent, create, use, and disclose a limited data set using information subject to this Act or disclose information subject to this Act to a business associate for the purpose of establishing a limited data set. The creation, use, and disclosure of such a limited data set must comply with the requirements set forth under HIPAA.

(b) A covered entity may not, without a genetic information test subject's consent, create, use, and disclose de-identified information using information subject to this Act or disclose information subject to this Act to a business associate for the purpose of de-identifying the information. The creation, use, and disclosure of such de-identified information must comply with the requirements set forth under HIPAA. A covered entity or a business associate may disclose information that is de-identified in accordance with HIPAA.

(c) The recipient of de-identified information shall not re-identify de-identified information using any public or private data source.

(Source: P.A. 98-1046, eff. 1-1-15.)

Section 99. Effective date. This Act takes effect upon becoming law.