103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB3437

 

Introduced 2/8/2024, by Sen. David Koehler

 

SYNOPSIS AS INTRODUCED:
 
720 ILCS 570/316.1
720 ILCS 570/318

    Amends the Illinois Controlled Substances Act. Deletes provision that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System must meet applicable requirements outlined in administrative rules of the Department of Human Services. Provides that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System that meets either the requirements of at least one certification criterion adopted under the Office of National Coordinator for Health Information Technology (ONC) or HITRUST certification shall be deemed qualified by the Department of Human Services to integrate pharmacy records with the Prescription Monitoring Program, subject to specified requirements. Defines "one-to-one secure link".


LRB103 38535 RLC 68671 b

 

 

A BILL FOR

 

SB3437LRB103 38535 RLC 68671 b

1    AN ACT concerning criminal law.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Illinois Controlled Substances Act is
5amended by changing Sections 316.1 and 318 as follows:
 
6    (720 ILCS 570/316.1)
7    (This Section may contain text from a Public Act with a
8delayed effective date)
9    Sec. 316.1. Access to the integration of pharmacy records
10with the Prescription Monitoring Program.
11    (a) Subject to the requirements and limitations set out in
12this Section and in administrative rule, the Department shall
13not require, either expressly or effectively, Electronic
14Health Records Systems, pharmacies, or other providers to
15utilize a particular entity or system for access to the
16integration of pharmacy records with the Prescription
17Monitoring Program.
18        (1) Any entity or system for integration (transmitting
19    the data maintained by the Prescription Monitoring
20    Program) into an Electronic Health Records System,
21    Certified Health IT Module, Pharmacy Dispensing System, or
22    Pharmacy Management System that meets either the
23    requirements of at least one certification criterion

 

 

SB3437- 2 -LRB103 38535 RLC 68671 b

1    adopted under the Office of National Coordinator for
2    Health Information Technology (ONC) or HITRUST
3    certification shall be deemed qualified by the Department
4    to integrate pharmacy records with the Prescription
5    Monitoring Program, subject to must meet applicable
6    requirements outlined in administrative rule, including,
7    but not limited to, the following:
8            (A) enter into a data sharing agreement with the
9        Department of Human Services, Prescription Monitoring
10        Program;
11            (B) all security requirements noted within this
12        Section, administrative rule, and all other applicable
13        State and federal security and privacy requirements;
14            (C) the Prescription Monitoring Program shall have
15        administrative control over the approval of each site
16        and individual integration point and the Prescription
17        Monitoring Program shall have the ability to disable
18        individual integration points, at no additional cost
19        to the State;
20            (D) interstate data sharing shall be completed
21        with written authorization from the Prescription
22        Monitoring Program;
23            (E) data available from the Prescription
24        Monitoring Program shall not be stored, cached, or
25        sold and the State may inspect and review an entity or
26        system for integration to assure and confirm the same,

 

 

SB3437- 3 -LRB103 38535 RLC 68671 b

1        subject to a reasonable non-disclosure agreement, as
2        permitted by State law, to protect the entity's or
3        system's trade secrets or other proprietary
4        information;
5            (F) analysis of data shall only be allowed with
6        express written permission from the Prescription
7        Monitoring Program; and
8            (G) access to audit data, shall be available in
9        hourly to real-time increments at no cost to the
10        State.
11        (2) Electronic Health Record Systems, Certified Health
12    IT Modules, Pharmacy Management Systems, and Pharmacy
13    Dispensing Systems integrated with the Prescription
14    Monitoring Program must meet applicable requirements
15    outlined in rule, including, but not limited to, the
16    following:
17            (A) provide their customers (healthcare entity,
18        pharmacy, provider, prescriber, dispenser, etc.) the
19        choice of approved integration vendor, meeting the
20        requirements of this Section and administrative rule,
21        or direct connect to the Illinois Prescription
22        Monitoring Program;
23            (B) provide their customers with access to the
24        data provided by the customer's chosen integration
25        vendor as allowed under State and federal statute; and
26            (C) follow all State and federal security and

 

 

SB3437- 4 -LRB103 38535 RLC 68671 b

1        privacy standards.
2        (3) Customers required to integrate under State or
3    federal law must meet the requirements outlined in
4    administrative rule, including, but not limited to, the
5    following:
6            (A) the customer retains the choice of which
7        integration vendor or direct connect is utilized to
8        connect to the Illinois Prescription Monitoring
9        Program; and
10            (B) customers seeking to contract with a new
11        integration vendor, shall enter into a memorandum of
12        understanding with the Prescription Monitoring
13        Program.
14    (b) The Illinois Prescription Monitoring Program may
15exercise the power, by rule, to require Memoranda of
16Understanding with all customers. The general contents of the
17memorandum of understanding shall be set out in rule and shall
18include, but not be limited to:
19        (1) the acknowledgment and choice of the customer of
20    the method of integration with the Prescription Monitoring
21    Program and
22        (2) the data use and other requirements on the
23    customer in accessing and using the Prescription
24    Monitoring Program.
25    A fee cannot be levied as part of a memorandum of
26understanding required by the Department under this Section.

 

 

SB3437- 5 -LRB103 38535 RLC 68671 b

1    (c) Non-compliance by the Integration Vendor, Electronic
2Health Record System, Certified Health IT Module, Pharmacy
3Management System or Pharmacy Dispensing System, customer, or
4any parties required to comply with this Section may result in
5the party being prohibited from serving as entity or system
6for integration with the Prescription Monitoring Program,
7termination of contracts, agreements, or other business
8relationships. The Department shall institute appropriate cure
9notices, as necessary to remedy non-compliance.
10(Source: P.A. 103-477, eff. 7-1-24.)
 
11    (720 ILCS 570/318)
12    Sec. 318. Confidentiality of information.
13    (a) Information received by the central repository under
14Section 316 and former Section 321 is confidential.
15    (a-1) To ensure the federal Health Insurance Portability
16and Accountability Act and confidentiality of substance use
17disorder patient records rules that mandate the privacy of an
18individual's prescription data reported to the Prescription
19Monitoring Program received from a retail dispenser under this
20Act, and in order to execute the duties and responsibilities
21under Section 316 of this Act and rules for disclosure under
22this Section, the Clinical Director of the Prescription
23Monitoring Program or his or her designee shall maintain
24direct access to all Prescription Monitoring Program data. Any
25request for Prescription Monitoring Program data from any

 

 

SB3437- 6 -LRB103 38535 RLC 68671 b

1other department or agency must be approved in writing by the
2Clinical Director of the Prescription Monitoring Program or
3his or her designee unless otherwise permitted by law.
4Prescription Monitoring Program data shall only be disclosed
5as permitted by law.
6    (a-2) As an active step to address the current opioid
7crisis in this State and to prevent and reduce addiction
8resulting from a sports injury or an accident, the
9Prescription Monitoring Program and the Department of Public
10Health shall coordinate a continuous review of the
11Prescription Monitoring Program and the Department of Public
12Health data to determine if a patient may be at risk of opioid
13addiction. Each patient discharged from any medical facility
14with an International Classification of Disease, 10th edition
15code related to a sport or accident injury shall be subject to
16the data review. If the discharged patient is dispensed a
17controlled substance, the Prescription Monitoring Program
18shall alert the patient's prescriber as to the addiction risk
19and urge each to follow the Centers for Disease Control and
20Prevention guidelines or his or her respective profession's
21treatment guidelines related to the patient's injury. This
22subsection (a-2), other than this sentence, is inoperative on
23or after January 1, 2024.
24    (b) The Department must carry out a program to protect the
25confidentiality of the information described in subsection
26(a). The Department may disclose the information to another

 

 

SB3437- 7 -LRB103 38535 RLC 68671 b

1person only under subsection (c), (d), or (f) and may charge a
2fee not to exceed the actual cost of furnishing the
3information.
4    (c) The Department may disclose confidential information
5described in subsection (a) to any person who is engaged in
6receiving, processing, or storing the information.
7    (d) The Department may release confidential information
8described in subsection (a) to the following persons:
9        (1) A governing body that licenses practitioners and
10    is engaged in an investigation, an adjudication, or a
11    prosecution of a violation under any State or federal law
12    that involves a controlled substance.
13        (2) An investigator for the Consumer Protection
14    Division of the office of the Attorney General, a
15    prosecuting attorney, the Attorney General, a deputy
16    Attorney General, or an investigator from the office of
17    the Attorney General, who is engaged in any of the
18    following activities involving controlled substances:
19            (A) an investigation;
20            (B) an adjudication; or
21            (C) a prosecution of a violation under any State
22        or federal law that involves a controlled substance.
23        (3) A law enforcement officer who is:
24            (A) authorized by the Illinois State Police or the
25        office of a county sheriff or State's Attorney or
26        municipal police department of Illinois to receive

 

 

SB3437- 8 -LRB103 38535 RLC 68671 b

1        information of the type requested for the purpose of
2        investigations involving controlled substances; or
3            (B) approved by the Department to receive
4        information of the type requested for the purpose of
5        investigations involving controlled substances; and
6            (C) engaged in the investigation or prosecution of
7        a violation under any State or federal law that
8        involves a controlled substance.
9        (4) Select representatives of the Department of
10    Children and Family Services through the indirect online
11    request process. Access shall be established by an
12    intergovernmental agreement between the Department of
13    Children and Family Services and the Department of Human
14    Services.
15    (e) Before the Department releases confidential
16information under subsection (d), the applicant must
17demonstrate in writing to the Department that:
18        (1) the applicant has reason to believe that a
19    violation under any State or federal law that involves a
20    controlled substance has occurred; and
21        (2) the requested information is reasonably related to
22    the investigation, adjudication, or prosecution of the
23    violation described in subdivision (1).
24    (f) The Department may receive and release prescription
25record information under Section 316 and former Section 321
26to:

 

 

SB3437- 9 -LRB103 38535 RLC 68671 b

1        (1) a governing body that licenses practitioners;
2        (2) an investigator for the Consumer Protection
3    Division of the office of the Attorney General, a
4    prosecuting attorney, the Attorney General, a deputy
5    Attorney General, or an investigator from the office of
6    the Attorney General;
7        (3) any Illinois law enforcement officer who is:
8            (A) authorized to receive the type of information
9        released; and
10            (B) approved by the Department to receive the type
11        of information released; or
12        (4) prescription monitoring entities in other states
13    per the provisions outlined in subsection (g) and (h)
14    below;
15confidential prescription record information collected under
16Sections 316 and 321 (now repealed) that identifies vendors or
17practitioners, or both, who are prescribing or dispensing
18large quantities of Schedule II, III, IV, or V controlled
19substances outside the scope of their practice, pharmacy, or
20business, as determined by the Advisory Committee created by
21Section 320.
22    (f-5) In accordance with a confidentiality agreement
23entered into with the Department, a medical director, or a
24public health administrator and their delegated analysts, of a
25county or municipal health department or the Department of
26Public Health shall have access to data from the system for any

 

 

SB3437- 10 -LRB103 38535 RLC 68671 b

1of the following purposes:
2            (1) developing education programs or public health
3        interventions relating to prescribing trends and
4        controlled substance use; or
5            (2) conducting analyses and publish reports on
6        prescribing trends in their respective jurisdictions.
7    At a minimum, the confidentiality agreement entered into
8with the Department shall:
9        (i) prohibit analysis and reports produced under
10    subparagraph (2) from including information that
11    identifies, by name, license, or address, any
12    practitioner, dispenser, ultimate user, or other person
13    administering a controlled substance; and
14        (ii) specify the appropriate technical and physical
15    safeguards that the county or municipal health department
16    must implement to ensure the privacy and security of data
17    obtained from the system. The data from the system shall
18    not be admissible as evidence, nor discoverable in any
19    action of any kind in any court or before any tribunal,
20    board, agency, or person. The disclosure of any such
21    information or data, whether proper or improper, shall not
22    waive or have any effect upon its confidentiality,
23    non-discoverability, or non-admissibility.
24    (g) The information described in subsection (f) may not be
25released until it has been reviewed by an employee of the
26Department who is licensed as a prescriber or a dispenser and

 

 

SB3437- 11 -LRB103 38535 RLC 68671 b

1until that employee has certified that further investigation
2is warranted. However, failure to comply with this subsection
3(g) does not invalidate the use of any evidence that is
4otherwise admissible in a proceeding described in subsection
5(h).
6    (h) An investigator or a law enforcement officer receiving
7confidential information under subsection (c), (d), or (f) may
8disclose the information to a law enforcement officer or an
9attorney for the office of the Attorney General for use as
10evidence in the following:
11        (1) A proceeding under any State or federal law that
12    involves a controlled substance.
13        (2) A criminal proceeding or a proceeding in juvenile
14    court that involves a controlled substance.
15    (i) The Department may compile statistical reports from
16the information described in subsection (a). The reports must
17not include information that identifies, by name, license or
18address, any practitioner, dispenser, ultimate user, or other
19person administering a controlled substance.
20    (j) Based upon federal, initial and maintenance funding, a
21prescriber and dispenser inquiry system shall be developed to
22assist the health care community in its goal of effective
23clinical practice and to prevent patients from diverting or
24abusing medications.
25        (1) An inquirer shall have read-only access to a
26    stand-alone database which shall contain records for the

 

 

SB3437- 12 -LRB103 38535 RLC 68671 b

1    previous 12 months.
2        (2) Dispensers may, upon positive and secure
3    identification, make an inquiry on a patient or customer
4    solely for a medical purpose as delineated within the
5    federal HIPAA law.
6        (3) The Department shall provide a one-to-one secure
7    link and encrypted software necessary to establish the
8    link between an inquirer and the Department. Technical
9    assistance shall also be provided. "One-to-one secure
10    link" only means connecting a provider and the Illinois
11    Prescription Monitoring Program through an electronic
12    health record or a pharmacy management system by issuing
13    unique credentials for each connecting system that can be
14    individually approved or denied by the Illinois
15    Prescription Monitoring Program. "One-to-one secure link"
16    refers only to the access controls and approval of
17    credentials, not the routing path of the transaction.
18    "One-to-one secure link" or "one-to-one connection" does
19    not mean that the integrating service will provide a
20    direct connection between the Electronic health Records
21    System or pharmacy management system and the Illinois
22    Prescription Monitoring Program.
23        (4) Written inquiries are acceptable but must include
24    the fee and the requester's Drug Enforcement
25    Administration license number and submitted upon the
26    requester's business stationery.

 

 

SB3437- 13 -LRB103 38535 RLC 68671 b

1        (5) As directed by the Prescription Monitoring Program
2    Advisory Committee and the Clinical Director for the
3    Prescription Monitoring Program, aggregate data that does
4    not indicate any prescriber, practitioner, dispenser, or
5    patient may be used for clinical studies.
6        (6) Tracking analysis shall be established and used
7    per administrative rule.
8        (7) Nothing in this Act or Illinois law shall be
9    construed to require a prescriber or dispenser to make use
10    of this inquiry system.
11        (8) If there is an adverse outcome because of a
12    prescriber or dispenser making an inquiry, which is
13    initiated in good faith, the prescriber or dispenser shall
14    be held harmless from any civil liability.
15    (k) The Department shall establish, by rule, the process
16by which to evaluate possible erroneous association of
17prescriptions to any licensed prescriber or end user of the
18Illinois Prescription Information Library (PIL).
19    (l) The Prescription Monitoring Program Advisory Committee
20is authorized to evaluate the need for and method of
21establishing a patient specific identifier.
22    (m) Patients who identify prescriptions attributed to them
23that were not obtained by them shall be given access to their
24personal prescription history pursuant to the validation
25process as set forth by administrative rule.
26    (n) The Prescription Monitoring Program is authorized to

 

 

SB3437- 14 -LRB103 38535 RLC 68671 b

1develop operational push reports to entities with compatible
2electronic medical records. The process shall be covered
3within administrative rule established by the Department.
4    (o) Hospital emergency departments and freestanding
5healthcare facilities providing healthcare to walk-in patients
6may obtain, for the purpose of improving patient care, a
7unique identifier for each shift to utilize the PIL system.
8    (p) The Prescription Monitoring Program shall
9automatically create a log-in to the inquiry system when a
10prescriber or dispenser obtains or renews his or her
11controlled substance license. The Department of Financial and
12Professional Regulation must provide the Prescription
13Monitoring Program with electronic access to the license
14information of a prescriber or dispenser to facilitate the
15creation of this profile. The Prescription Monitoring Program
16shall send the prescriber or dispenser information regarding
17the inquiry system, including instructions on how to log into
18the system, instructions on how to use the system to promote
19effective clinical practice, and opportunities for continuing
20education for the prescribing of controlled substances. The
21Prescription Monitoring Program shall also send to all
22enrolled prescribers, dispensers, and designees information
23regarding the unsolicited reports produced pursuant to Section
24314.5 of this Act.
25    (q) A prescriber or dispenser may authorize a designee to
26consult the inquiry system established by the Department under

 

 

SB3437- 15 -LRB103 38535 RLC 68671 b

1this subsection on his or her behalf, provided that all the
2following conditions are met:
3        (1) the designee so authorized is employed by the same
4    hospital or health care system; is employed by the same
5    professional practice; or is under contract with such
6    practice, hospital, or health care system;
7        (2) the prescriber or dispenser takes reasonable steps
8    to ensure that such designee is sufficiently competent in
9    the use of the inquiry system;
10        (3) the prescriber or dispenser remains responsible
11    for ensuring that access to the inquiry system by the
12    designee is limited to authorized purposes and occurs in a
13    manner that protects the confidentiality of the
14    information obtained from the inquiry system, and remains
15    responsible for any breach of confidentiality; and
16        (4) the ultimate decision as to whether or not to
17    prescribe or dispense a controlled substance remains with
18    the prescriber or dispenser.
19    The Prescription Monitoring Program shall send to
20registered designees information regarding the inquiry system,
21including instructions on how to log onto the system.
22    (r) The Prescription Monitoring Program shall maintain an
23Internet website in conjunction with its prescriber and
24dispenser inquiry system. This website shall include, at a
25minimum, the following information:
26        (1) current clinical guidelines developed by health

 

 

SB3437- 16 -LRB103 38535 RLC 68671 b

1    care professional organizations on the prescribing of
2    opioids or other controlled substances as determined by
3    the Advisory Committee;
4        (2) accredited continuing education programs related
5    to prescribing of controlled substances;
6        (3) programs or information developed by health care
7    professionals that may be used to assess patients or help
8    ensure compliance with prescriptions;
9        (4) updates from the Food and Drug Administration, the
10    Centers for Disease Control and Prevention, and other
11    public and private organizations which are relevant to
12    prescribing;
13        (5) relevant medical studies related to prescribing;
14        (6) other information regarding the prescription of
15    controlled substances; and
16        (7) information regarding prescription drug disposal
17    events, including take-back programs or other disposal
18    options or events.
19    The content of the Internet website shall be periodically
20reviewed by the Prescription Monitoring Program Advisory
21Committee as set forth in Section 320 and updated in
22accordance with the recommendation of the advisory committee.
23    (s) The Prescription Monitoring Program shall regularly
24send electronic updates to the registered users of the
25Program. The Prescription Monitoring Program Advisory
26Committee shall review any communications sent to registered

 

 

SB3437- 17 -LRB103 38535 RLC 68671 b

1users and also make recommendations for communications as set
2forth in Section 320. These updates shall include the
3following information:
4        (1) opportunities for accredited continuing education
5    programs related to prescribing of controlled substances;
6        (2) current clinical guidelines developed by health
7    care professional organizations on the prescribing of
8    opioids or other drugs as determined by the Advisory
9    Committee;
10        (3) programs or information developed by health care
11    professionals that may be used to assess patients or help
12    ensure compliance with prescriptions;
13        (4) updates from the Food and Drug Administration, the
14    Centers for Disease Control and Prevention, and other
15    public and private organizations which are relevant to
16    prescribing;
17        (5) relevant medical studies related to prescribing;
18        (6) other information regarding prescribing of
19    controlled substances;
20        (7) information regarding prescription drug disposal
21    events, including take-back programs or other disposal
22    options or events; and
23        (8) reminders that the Prescription Monitoring Program
24    is a useful clinical tool.
25    (t) Notwithstanding any other provision of this Act,
26neither the Prescription Monitoring Program nor any other

 

 

SB3437- 18 -LRB103 38535 RLC 68671 b

1person shall disclose any information in violation of the
2restrictions and requirements of paragraph (3.5) of subsection
3(a) of Section 316 as implemented under Public Act 102-527.
4(Source: P.A. 102-751, eff. 1-1-23.)