HB1274 95TH GENERAL ASSEMBLY

LRB095 10982 LCT 31288 b

95TH GENERAL ASSEMBLY
State of Illinois
2007 and 2008
HB1274

Introduced 2/15/2007, by Rep. Sara Feigenholtz

SYNOPSIS AS INTRODUCED:

815 ILCS 530/35 new

Amends the Personal Information Protection Act. Prohibits a person or entity, not including a State or local agency, from: (i) publicly posting or publicly displaying in any manner an individual's social security number; (ii) printing an individual's social security number on any card required for the individual to access products or services provided by the person or entity; (iii) requiring an individual to transmit his or her social security number over the Internet unless the connection is secure or the social security number is encrypted; (iv) requiring an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Web site; or (v) printing an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed. Makes an exception for applications and forms sent by mail to include social security numbers. Provides that a person or entity, not including a State or local agency, that has used, prior to the effective date of this amendatory Act, an individual's social security number in a manner inconsistent with the listed provisions, may continue using that individual's social security number in that manner if all of the listed conditions are met. Provides that the use of a social security number is not prohibited for the collection, use, or release of a social security number as required by State or federal law or the use of a social security number for internal verification or administrative purposes. Effective January 1, 2008.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Personal Information Protection Act is amended by adding Section 35 as follows:

(815 ILCS 530/35 new)

Sec. 35. Social security numbers.

(a) Except as provided in subsection (b) of this Section, a person or entity, not including a State or local agency, shall not do any of the following:

(1) Publicly post or publicly display in any manner an individual's social security number.

(2) Print an individual's social security number on any card required for the individual to access products or services provided by the person or entity.

(3) Require an individual to transmit his or her social security number over the Internet unless the connection is secure or the social security number is encrypted.

(4) Require an individual to use his or her social security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the website.

(5) Print an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed. Notwithstanding this provision, applications and forms sent by mail may include social security numbers.

(b) Except as provided in subsection (e) of this Section, a person or entity, not including a State or local agency, that has used, prior to the effective date of this amendatory Act, an individual's social security number in a manner inconsistent with subsection (a), may continue using that individual's social security number in that manner if all of the following conditions are met:

(1) The use of the social security number is continuous. If the use is stopped for any reason, subsection (a) shall apply.

(2) The individual is provided an annual disclosure, commencing in the year 2008, that informs the individual that he or she has the right to stop the use of his or her social security number in a manner prohibited by subsection (a).

A written request by an individual to stop the use of his or her social security number in a manner prohibited by subsection (a) shall be implemented within 30 days of the receipt of the request. There shall be no fee or charge for implementing the request.

A person or entity, not including a State or local agency, shall not deny services to an individual because the individual makes a written request pursuant to this subsection (b).

(c) This Section does not prevent the collection, use, or release of a social security number as required by State or federal law or the use of a social security number for internal verification or administrative purposes.

(d) This Section does not apply to records that are required by statute, case law, or the Illinois Supreme Court to be made available to the public.

(e) The Director of Public Health or the Secretary of Financial and Professional Regulation, upon a determination of good cause, may grant extensions not to exceed 6 months for compliance by health care service plans and insurers with the requirements of this Section when requested by the health care service plan provider or insurer. Any extension granted shall apply to the health care service plan provider or insurer's affected providers, pharmacy benefits manager, and contractors.

(f) If a federal law takes effect requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program, a health care provider, a health care service plan provider, a licensed health care professional, or a contractor representing an insurer or health care provider, that complies with the federal law shall be deemed in compliance with this Section.

(g) As used in this Section:

"Contractor" means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan provider or a health care provider.

"Health care provider" means any physician, hospital facility, or other person licensed or otherwise authorized to deliver care services.

"Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

Section 99. Effective date. This Act takes effect January 1, 2008.