SB3437 103RD GENERAL ASSEMBLY

LRB103 38535 RLC 68671 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB3437

Introduced 2/8/2024, by Sen. David Koehler

SYNOPSIS AS INTRODUCED:

720 ILCS 570/316.1
720 ILCS 570/318

Amends the Illinois Controlled Substances Act. Deletes provision that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System must meet applicable requirements outlined in administrative rules of the Department of Human Services. Provides that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System that meets either the requirements of at least one certification criterion adopted under the Office of National Coordinator for Health Information Technology (ONC) or HITRUST certification shall be deemed qualified by the Department of Human Services to integrate pharmacy records with the Prescription Monitoring Program, subject to specified requirements. Defines "one-to-one secure link".

A BILL FOR

AN ACT concerning criminal law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Illinois Controlled Substances Act is amended by changing Sections 316.1 and 318 as follows:

(720 ILCS 570/316.1)

(This Section may contain text from a Public Act with a delayed effective date)

Sec. 316.1. Access to the integration of pharmacy records with the Prescription Monitoring Program.

(a) Subject to the requirements and limitations set out in this Section and in administrative rule, the Department shall not require, either expressly or effectively, Electronic Health Records Systems, pharmacies, or other providers to utilize a particular entity or system for access to the integration of pharmacy records with the Prescription Monitoring Program.

(1) Any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System that meets either the requirements of at least one certification criterion adopted under the Office of National Coordinator for Health Information Technology (ONC) or HITRUST certification shall be deemed qualified by the Department to integrate pharmacy records with the Prescription Monitoring Program, subject to must meet applicable requirements outlined in administrative rule, including, but not limited to, the following:

(A) enter into a data sharing agreement with the Department of Human Services, Prescription Monitoring Program;

(B) all security requirements noted within this Section, administrative rule, and all other applicable State and federal security and privacy requirements;

(C) the Prescription Monitoring Program shall have administrative control over the approval of each site and individual integration point and the Prescription Monitoring Program shall have the ability to disable individual integration points, at no additional cost to the State;

(D) interstate data sharing shall be completed with written authorization from the Prescription Monitoring Program;

(E) data available from the Prescription Monitoring Program shall not be stored, cached, or sold and the State may inspect and review an entity or system for integration to assure and confirm the same, subject to a reasonable non-disclosure agreement, as permitted by State law, to protect the entity's or system's trade secrets or other proprietary information;

(F) analysis of data shall only be allowed with express written permission from the Prescription Monitoring Program; and

(G) access to audit data, shall be available in hourly to real-time increments at no cost to the State.

(2) Electronic Health Record Systems, Certified Health IT Modules, Pharmacy Management Systems, and Pharmacy Dispensing Systems integrated with the Prescription Monitoring Program must meet applicable requirements outlined in rule, including, but not limited to, the following:

(A) provide their customers (healthcare entity, pharmacy, provider, prescriber, dispenser, etc.) the choice of approved integration vendor, meeting the requirements of this Section and administrative rule, or direct connect to the Illinois Prescription Monitoring Program;

(B) provide their customers with access to the data provided by the customer's chosen integration vendor as allowed under State and federal statute; and

(C) follow all State and federal security and privacy standards.

(3) Customers required to integrate under State or federal law must meet the requirements outlined in administrative rule, including, but not limited to, the following:

(A) the customer retains the choice of which integration vendor or direct connect is utilized to connect to the Illinois Prescription Monitoring Program; and

(B) customers seeking to contract with a new integration vendor, shall enter into a memorandum of understanding with the Prescription Monitoring Program.

(b) The Illinois Prescription Monitoring Program may exercise the power, by rule, to require Memoranda of Understanding with all customers. The general contents of the memorandum of understanding shall be set out in rule and shall include, but not be limited to:

(1) the acknowledgment and choice of the customer of the method of integration with the Prescription Monitoring Program and

(2) the data use and other requirements on the customer in accessing and using the Prescription Monitoring Program.

A fee cannot be levied as part of a memorandum of understanding required by the Department under this Section.

(c) Non-compliance by the Integration Vendor, Electronic Health Record System, Certified Health IT Module, Pharmacy Management System or Pharmacy Dispensing System, customer, or any parties required to comply with this Section may result in the party being prohibited from serving as entity or system for integration with the Prescription Monitoring Program, termination of contracts, agreements, or other business relationships. The Department shall institute appropriate cure notices, as necessary to remedy non-compliance.

(Source: P.A. 103-477, eff. 7-1-24.)

(720 ILCS 570/318)

Sec. 318. Confidentiality of information.

(a) Information received by the central repository under Section 316 and former Section 321 is confidential.

(a-1) To ensure the federal Health Insurance Portability and Accountability Act and confidentiality of substance use disorder patient records rules that mandate the privacy of an individual's prescription data reported to the Prescription Monitoring Program received from a retail dispenser under this Act, and in order to execute the duties and responsibilities under Section 316 of this Act and rules for disclosure under this Section, the Clinical Director of the Prescription Monitoring Program or his or her designee shall maintain direct access to all Prescription Monitoring Program data. Any request for Prescription Monitoring Program data from any other department or agency must be approved in writing by the Clinical Director of the Prescription Monitoring Program or his or her designee unless otherwise permitted by law. Prescription Monitoring Program data shall only be disclosed as permitted by law.

(a-2) As an active step to address the current opioid crisis in this State and to prevent and reduce addiction resulting from a sports injury or an accident, the Prescription Monitoring Program and the Department of Public Health shall coordinate a continuous review of the Prescription Monitoring Program and the Department of Public Health data to determine if a patient may be at risk of opioid addiction. Each patient discharged from any medical facility with an International Classification of Disease, 10th edition code related to a sport or accident injury shall be subject to the data review. If the discharged patient is dispensed a controlled substance, the Prescription Monitoring Program shall alert the patient's prescriber as to the addiction risk and urge each to follow the Centers for Disease Control and Prevention guidelines or his or her respective profession's treatment guidelines related to the patient's injury. This subsection (a-2), other than this sentence, is inoperative on or after January 1, 2024.

(b) The Department must carry out a program to protect the confidentiality of the information described in subsection (a). The Department may disclose the information to another person only under subsection (c), (d), or (f) and may charge a fee not to exceed the actual cost of furnishing the information.

(c) The Department may disclose confidential information described in subsection (a) to any person who is engaged in receiving, processing, or storing the information.

(d) The Department may release confidential information described in subsection (a) to the following persons:

(1) A governing body that licenses practitioners and is engaged in an investigation, an adjudication, or a prosecution of a violation under any State or federal law that involves a controlled substance.

(2) An investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General, who is engaged in any of the following activities involving controlled substances:

(A) an investigation;

(B) an adjudication; or

(C) a prosecution of a violation under any State or federal law that involves a controlled substance.

(3) A law enforcement officer who is:

(A) authorized by the Illinois State Police or the office of a county sheriff or State's Attorney or municipal police department of Illinois to receive information of the type requested for the purpose of investigations involving controlled substances; or

(B) approved by the Department to receive information of the type requested for the purpose of investigations involving controlled substances; and

(C) engaged in the investigation or prosecution of a violation under any State or federal law that involves a controlled substance.

(4) Select representatives of the Department of Children and Family Services through the indirect online request process. Access shall be established by an intergovernmental agreement between the Department of Children and Family Services and the Department of Human Services.

(e) Before the Department releases confidential information under subsection (d), the applicant must demonstrate in writing to the Department that:

(1) the applicant has reason to believe that a violation under any State or federal law that involves a controlled substance has occurred; and

(2) the requested information is reasonably related to the investigation, adjudication, or prosecution of the violation described in subdivision (1).

(f) The Department may receive and release prescription record information under Section 316 and former Section 321 to:

(1) a governing body that licenses practitioners;

(2) an investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General;

(3) any Illinois law enforcement officer who is:

(A) authorized to receive the type of information released; and

(B) approved by the Department to receive the type of information released; or

(4) prescription monitoring entities in other states per the provisions outlined in subsection (g) and (h) below; confidential prescription record information collected under Sections 316 and 321 (now repealed) that identifies vendors or practitioners, or both, who are prescribing or dispensing large quantities of Schedule II, III, IV, or V controlled substances outside the scope of their practice, pharmacy, or business, as determined by the Advisory Committee created by Section 320.

(f-5) In accordance with a confidentiality agreement entered into with the Department, a medical director, or a public health administrator and their delegated analysts, of a county or municipal health department or the Department of Public Health shall have access to data from the system for any of the following purposes:

(1) developing education programs or public health interventions relating to prescribing trends and controlled substance use; or

(2) conducting analyses and publish reports on prescribing trends in their respective jurisdictions.

At a minimum, the confidentiality agreement entered into with the Department shall:

(i) prohibit analysis and reports produced under subparagraph (2) from including information that identifies, by name, license, or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance; and

(ii) specify the appropriate technical and physical safeguards that the county or municipal health department must implement to ensure the privacy and security of data obtained from the system. The data from the system shall not be admissible as evidence, nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person. The disclosure of any such information or data, whether proper or improper, shall not waive or have any effect upon its confidentiality, non-discoverability, or non-admissibility.

(g) The information described in subsection (f) may not be released until it has been reviewed by an employee of the Department who is licensed as a prescriber or a dispenser and until that employee has certified that further investigation is warranted. However, failure to comply with this subsection (g) does not invalidate the use of any evidence that is otherwise admissible in a proceeding described in subsection (h).

(h) An investigator or a law enforcement officer receiving confidential information under subsection (c), (d), or (f) may disclose the information to a law enforcement officer or an attorney for the office of the Attorney General for use as evidence in the following:

(1) A proceeding under any State or federal law that involves a controlled substance.

(2) A criminal proceeding or a proceeding in juvenile court that involves a controlled substance.

(i) The Department may compile statistical reports from the information described in subsection (a). The reports must not include information that identifies, by name, license or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance.

(j) Based upon federal, initial and maintenance funding, a prescriber and dispenser inquiry system shall be developed to assist the health care community in its goal of effective clinical practice and to prevent patients from diverting or abusing medications.

(1) An inquirer shall have read-only access to a stand-alone database which shall contain records for the previous 12 months.

(2) Dispensers may, upon positive and secure identification, make an inquiry on a patient or customer solely for a medical purpose as delineated within the federal HIPAA law.

(3) The Department shall provide a one-to-one secure link and encrypted software necessary to establish the link between an inquirer and the Department. Technical assistance shall also be provided. "One-to-one secure link" only means connecting a provider and the Illinois Prescription Monitoring Program through an electronic health record or a pharmacy management system by issuing unique credentials for each connecting system that can be individually approved or denied by the Illinois Prescription Monitoring Program. "One-to-one secure link" refers only to the access controls and approval of credentials, not the routing path of the transaction. "One-to-one secure link" or "one-to-one connection" does not mean that the integrating service will provide a direct connection between the Electronic health Records System or pharmacy management system and the Illinois Prescription Monitoring Program.

(4) Written inquiries are acceptable but must include the fee and the requester's Drug Enforcement Administration license number and submitted upon the requester's business stationery.

(5) As directed by the Prescription Monitoring Program Advisory Committee and the Clinical Director for the Prescription Monitoring Program, aggregate data that does not indicate any prescriber, practitioner, dispenser, or patient may be used for clinical studies.

(6) Tracking analysis shall be established and used per administrative rule.

(7) Nothing in this Act or Illinois law shall be construed to require a prescriber or dispenser to make use of this inquiry system.

(8) If there is an adverse outcome because of a prescriber or dispenser making an inquiry, which is initiated in good faith, the prescriber or dispenser shall be held harmless from any civil liability.

(k) The Department shall establish, by rule, the process by which to evaluate possible erroneous association of prescriptions to any licensed prescriber or end user of the Illinois Prescription Information Library (PIL).

(l) The Prescription Monitoring Program Advisory Committee is authorized to evaluate the need for and method of establishing a patient specific identifier.

(m) Patients who identify prescriptions attributed to them that were not obtained by them shall be given access to their personal prescription history pursuant to the validation process as set forth by administrative rule.

(n) The Prescription Monitoring Program is authorized to develop operational push reports to entities with compatible electronic medical records. The process shall be covered within administrative rule established by the Department.

(o) Hospital emergency departments and freestanding healthcare facilities providing healthcare to walk-in patients may obtain, for the purpose of improving patient care, a unique identifier for each shift to utilize the PIL system.

(p) The Prescription Monitoring Program shall automatically create a log-in to the inquiry system when a prescriber or dispenser obtains or renews his or her controlled substance license. The Department of Financial and Professional Regulation must provide the Prescription Monitoring Program with electronic access to the license information of a prescriber or dispenser to facilitate the creation of this profile. The Prescription Monitoring Program shall send the prescriber or dispenser information regarding the inquiry system, including instructions on how to log into the system, instructions on how to use the system to promote effective clinical practice, and opportunities for continuing education for the prescribing of controlled substances. The Prescription Monitoring Program shall also send to all enrolled prescribers, dispensers, and designees information regarding the unsolicited reports produced pursuant to Section 314.5 of this Act.

(q) A prescriber or dispenser may authorize a designee to consult the inquiry system established by the Department under this subsection on his or her behalf, provided that all the following conditions are met:

(1) the designee so authorized is employed by the same hospital or health care system; is employed by the same professional practice; or is under contract with such practice, hospital, or health care system;

(2) the prescriber or dispenser takes reasonable steps to ensure that such designee is sufficiently competent in the use of the inquiry system;

(3) the prescriber or dispenser remains responsible for ensuring that access to the inquiry system by the designee is limited to authorized purposes and occurs in a manner that protects the confidentiality of the information obtained from the inquiry system, and remains responsible for any breach of confidentiality; and

(4) the ultimate decision as to whether or not to prescribe or dispense a controlled substance remains with the prescriber or dispenser.

The Prescription Monitoring Program shall send to registered designees information regarding the inquiry system, including instructions on how to log onto the system.

(r) The Prescription Monitoring Program shall maintain an Internet website in conjunction with its prescriber and dispenser inquiry system. This website shall include, at a minimum, the following information:

(1) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other controlled substances as determined by the Advisory Committee;

(2) accredited continuing education programs related to prescribing of controlled substances;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding the prescription of controlled substances; and

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events.

The content of the Internet website shall be periodically reviewed by the Prescription Monitoring Program Advisory Committee as set forth in Section 320 and updated in accordance with the recommendation of the advisory committee.

(s) The Prescription Monitoring Program shall regularly send electronic updates to the registered users of the Program. The Prescription Monitoring Program Advisory Committee shall review any communications sent to registered users and also make recommendations for communications as set forth in Section 320. These updates shall include the following information:

(1) opportunities for accredited continuing education programs related to prescribing of controlled substances;

(2) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other drugs as determined by the Advisory Committee;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding prescribing of controlled substances;

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events; and

(8) reminders that the Prescription Monitoring Program is a useful clinical tool.

(t) Notwithstanding any other provision of this Act, neither the Prescription Monitoring Program nor any other person shall disclose any information in violation of the restrictions and requirements of paragraph (3.5) of subsection (a) of Section 316 as implemented under Public Act 102-527.

(Source: P.A. 102-751, eff. 1-1-23.)