HB3120 102ND GENERAL ASSEMBLY

LRB102 10779 CPF 16109 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
HB3120

Introduced 2/19/2021, by Rep. Edgar Gonzalez, Jr.

SYNOPSIS AS INTRODUCED:

410 ILCS 50/3.5 new

Amends the Medical Patient Rights Act. Provides that all contact tracing information shall be kept confidential by any contact tracer and may not be disclosed except as necessary to carry out contact tracing or a permitted purpose. Provides that an individual may waive the confidentiality provided for by this Section only by a written, informed, and voluntary waiver, in plain language and in a language understandable to the individual making the waiver, and not part of any other document. Provides that a disclosure of contact tracing information shall be limited in scope as to the identity of any individual, the information to be disclosed, and the party to which disclosure may be made, and shall not authorize re-disclosure except as explicitly authorized by the terms of the waiver. Provides that the provisions do not bar otherwise lawful disclosure, possession, or use of contact tracing information, including aggregate contact tracing information, that is de-identified. Requires disclosure, possession, or use under the provisions to only be for a public health or public health research purpose. Provides that no contact tracer may provide contact tracing information to a law enforcement agent or entity or immigration authority. Requires the Department of Public Health to adopt specified rules. Contains other provisions. Effective immediately.

FISCAL NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Medical Patient Rights Act is amended by adding Section 3.5 as follows:

(410 ILCS 50/3.5 new)

Sec. 3.5. COVID-19 contact tracing; confidentiality.

(a) In this Section:

"Contact individual" means an individual who has or may have come in contact with a principal individual or who has or may have been exposed to and possibly infected with COVID-19.

"Contact tracer" mean an individual or entity employed by or under contract with the State, a local government, a State or local governmental entity, or an agent thereof, to conduct contact tracing, engage in contact tracing, or receive contact tracing information.

"Contact tracing" means case investigation and identification of principal individuals and contact individuals.

"Contact tracing information" means any information that includes or can reveal the identity of any principal individual or contact individual and any COVID-19-related information or test results received or collected for the purpose or in the course of contact tracing.

"COVID-19" means infection with or the disease caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2).

"De-identified" means, in relation to contact tracing information, that the information cannot identify, be made to identify, or be associated with a particular individual, directly or indirectly, and is subject to technical safeguards and policies and procedures that prevent re-identification, whether intentionally or unintentionally, of any individual.

"Department" means the Department of Public Health.

"Immigration authority" means any entity, officer, employee, or government employee or agent thereof charged with or engaged in enforcement of the federal Immigration and Nationality Act, including the United States Immigration and Customs Enforcement or United States Customs and Border Protection, or any successor legislation or entity.

"Law enforcement agent or entity" means any governmental entity or public servant, or agent, contractor, or employee thereof, authorized to investigate, prosecute, or make an arrest for a criminal or civil offense, or engaged in any such activity, but shall not mean the Department, a local health department, a county health department, a local board of health, or a local health officer.

"Permitted purpose" means:

(1) disclosure to appropriate health care providers or their personnel for the purpose of the clinical diagnosis, care, or treatment of the principal individual or contact individual who is the subject of the information where an emergency exists and the individual is in immediate need of medical attention and an attempt to secure consent would result in delay of treatment that would increase the risk to the individual's life or health;

(2) facilitation of a legally authorized public health-related action, in relation to a specified principal individual or contact individual, where and only to the extent necessary it is to protect the public health; or

(3) the investigation, prosecution, or defense of a civil or legal action for a violation of this Section; provided that if the use is initiated by a party other than the principal individual or contact individual who is the subject of the contact tracing information, the information must be highly material and relevant for the purpose.

"Principal individual" means an individual with a confirmed or probable diagnosis of COVID-19.

"Support" means resources or services provided to an individual to enable the individual to safely quarantine or isolate, including grocery, meal, or pharmacy delivery, laundry services, child or elder care, pet walking, assistance with telephone, Internet, or other communication services or devices, health and mental health services, legal services, provision of appropriate living space for individuals who cannot isolate or quarantine at home, and income replacement. "Support" includes support provided to other individuals for whom the individual commonly provides those resources or services.

(b) All contact tracing information shall be kept confidential by any contact tracer and may not be disclosed except as necessary to carry out contact tracing or a permitted purpose.

Where a contact tracer discloses contact tracing information for a permitted purpose, the contact tracer shall make a record of the disclosure, including to whom it was made, which shall be part of the contact tracing information.

(c) An individual may waive the confidentiality provided for by this Section only by a written, informed, and voluntary waiver, in plain language and in a language understandable to the individual making the waiver, and not part of any other document. The waiver shall state the scope and limit of the waiver. If an individual lacks the capacity to make a waiver, an individual authorized to consent to health care for the individual, or the individual's legal representative, may make the waiver. However, a waiver of confidentiality is not required to be written if it is solely for the purpose of arranging or providing support for the individual who is the subject of the contact tracing information.

A waiver of confidentiality under this subsection shall only apply for the purpose of arranging or providing support if the individual who is the subject of the contact tracing information provides voluntary, informed consent to the arranging or providing of the support.

(d) A disclosure of contact tracing information authorized under this Section shall be limited in scope as to the identity of any individual, the information to be disclosed, and the party to which disclosure may be made, and as necessary to achieve the purpose of the disclosure under this Section, and shall not authorize re-disclosure except as explicitly authorized by the terms of the waiver under subsection (c). However, this Section does not bar disclosure of contact tracing information pertaining to and identifying a principal individual or contact individual by the individual who is identified.

(e) This Section does not bar otherwise lawful disclosure, possession, or use of contact tracing information, including aggregate contact tracing information, that is de-identified. Disclosure, possession, or use under this Section shall only be for a public health or public health research purpose.

A person or entity may only possess or use de-identified contact tracing information if the person or entity maintains technical safeguards and policies and procedures that prevent re-identification, whether intentional or unintentional, of any individual, as may be required by the Department. The Department shall require safeguards, policies, and procedures under this Section, as the Department deems practicable.

Disclosure, possession, and use of de-identified contact tracing information under this Section shall be only pursuant to approval by the Department specifying the purpose, nature, and scope of the disclosure, possession, and use and measures to ensure that it will comply with this Section and the terms of the approval.

(f) No law enforcement agent or entity or immigration authority shall be a contact tracer or engage in contact tracing. This subsection does not bar an individual who is associated with a law enforcement entity or immigration authority from acting only as a principal individual or contact individual.

(g) No contact tracer may provide contact tracing information to a law enforcement agent or entity or immigration authority. Without consent under subsection (c), contact tracing information and any evidence derived therefrom shall not be subject to or provided in response to any legal process or be admissible for any purpose in any judicial or administrative action or proceeding. However, this subsection does not restrict providing information relating to a specified principal individual or contact individual where a permitted purpose exists, and only to the extent necessary for the permitted purpose.

(h) The Department shall adopt rules to require that contact tracing information possessed, used, or under the control of a contact tracer shall be subject to technical safeguards and policies and procedures for storage, transmission, use, and protection of the information. The rules shall prevent possession, use, or disclosure of the contact tracing information not permitted by this Section and shall be at least as or more protective than the safeguards, policies, and procedures the Department provides for other confidential information.

This subsection applies where contact tracing information is possessed or controlled by a contact tracer that is a nongovernmental individual or entity employed by or under contract with a governmental entity or an agent thereof. Within 30 days after collecting or receiving the contact tracing information, the nongovernmental individual or entity shall (i) remove information from its possession or control and deliver it to the appropriate governmental contact tracing entity, retaining no copy of it; (ii) expunge the information from its possession or control; or (iii) de-identify the information. However, the expungement or de-identification of particular contact tracing information may be postponed for up to 15 days while the contact tracer is actively engaged in contact tracing using that information, provided that the principal individual or contact individual to whom it pertains gives voluntary informed consent. The disclosure, possession, and use of the de-identified contact tracing information shall be subject to subsection (e).

(i) The Department shall adopt rules implementing this Section.

Section 99. Effective date. This Act takes effect upon becoming law.