Public Act 098-1046
 
HB5925 EnrolledLRB098 20292 RPM 55726 b

    AN ACT concerning health.
 
    Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
 
    Section 1. The Illinois Health Information Exchange and
Technology Act is amended by changing Section 40 as follows:
 
    (20 ILCS 3860/40)
    (Section scheduled to be repealed on January 1, 2021)
    Sec. 40. Reliance on data. Any health care provider who
relies in good faith upon any information provided through the
ILHIE in his, her, or its treatment of a patient shall be
immune from criminal or civil liability or professional
discipline arising from any damages caused by such good faith
reliance. This immunity does not apply to acts or omissions
constituting gross negligence or reckless, wanton, or
intentional misconduct. Notwithstanding this provision, the
Authority does not waive any immunities provided under State or
federal law.
(Source: P.A. 96-1331, eff. 7-27-10.)
 
    Section 5. The Illinois Clinical Laboratory and Blood Bank
Act is amended by adding Sections 2-134, 2-135, 2-136, and
2-137 and by changing Section 7-102 as follows:
 
    (210 ILCS 25/2-134 new)
    Sec. 2-134. Health care operations. "Health care
operations" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 164.501.
 
    (210 ILCS 25/2-135 new)
    Sec. 2-135. HIPAA. "HIPAA" means the Health Insurance
Portability and Accountability Act of 1996, Public Law 104-191,
as amended by the Health Information and Technology for
Economic and Clinical Health Act of 2009, Public Law 111-05,
and any subsequent amendments thereto and any regulations
promulgated thereunder.
 
    (210 ILCS 25/2-136 new)
    Sec. 2-136. Payment. "Payment" has the meaning ascribed to
it under HIPAA, as specified in 45 CFR 164.501.
 
    (210 ILCS 25/2-137 new)
    Sec. 2-137. Treatment. "Treatment" has the meaning
ascribed to it under HIPAA, as specified in 45 CFR 164.501.
 
    (210 ILCS 25/7-102)  (from Ch. 111 1/2, par. 627-102)
    Sec. 7-102. Reports of test results.
    (a) Clinical laboratory test results may be reported or
transmitted to:
        (1) the licensed physician or other authorized person
    who requested the test, their designee, or both;
        (2) any health care provider who is providing treatment
    to the patient;
        (3) an electronic health information exchange for the
    purposes of transmitting, using, or disclosing clinical
    laboratory test results in any manner required or permitted
    by HIPAA. The result of a test shall be reported directly
    to the licensed physician or other authorized person who
    requested it.
    (b) No interpretation, diagnosis, or prognosis or
suggested treatment shall appear on the laboratory report form,
except that a report made by a physician licensed to practice
medicine in Illinois, a dentist licensed in Illinois, or an
optometrist licensed in Illinois may include such information.
    (c) Nothing in this Act prohibits the sharing of
information as authorized in Section 2.1 of the Department of
Public Health Act.
(Source: P.A. 98-185, eff. 1-1-14.)
 
    Section 7. The Medical Patient Rights Act is amended by
changing Section 3 as follows:
 
    (410 ILCS 50/3)  (from Ch. 111 1/2, par. 5403)
    Sec. 3. The following rights are hereby established:
    (a) The right of each patient to care consistent with sound
nursing and medical practices, to be informed of the name of
the physician responsible for coordinating his or her care, to
receive information concerning his or her condition and
proposed treatment, to refuse any treatment to the extent
permitted by law, and to privacy and confidentiality of records
except as otherwise provided by law.
    (b) The right of each patient, regardless of source of
payment, to examine and receive a reasonable explanation of his
total bill for services rendered by his physician or health
care provider, including the itemized charges for specific
services received. Each physician or health care provider shall
be responsible only for a reasonable explanation of those
specific services provided by such physician or health care
provider.
    (c) In the event an insurance company or health services
corporation cancels or refuses to renew an individual policy or
plan, the insured patient shall be entitled to timely, prior
notice of the termination of such policy or plan.
    An insurance company or health services corporation that
requires any insured patient or applicant for new or continued
insurance or coverage to be tested for infection with human
immunodeficiency virus (HIV) or any other identified causative
agent of acquired immunodeficiency syndrome (AIDS) shall (1)
give the patient or applicant prior written notice of such
requirement, (2) proceed with such testing only upon the
written authorization of the applicant or patient, and (3) keep
the results of such testing confidential. Notice of an adverse
underwriting or coverage decision may be given to any
appropriately interested party, but the insurer may only
disclose the test result itself to a physician designated by
the applicant or patient, and any such disclosure shall be in a
manner that assures confidentiality.
    The Department of Insurance shall enforce the provisions of
this subsection.
    (d) The right of each patient to privacy and
confidentiality in health care. Each physician, health care
provider, health services corporation and insurance company
shall refrain from disclosing the nature or details of services
provided to patients, except that such information may be
disclosed: (1) to the patient, (2) to the party making
treatment decisions if the patient is incapable of making
decisions regarding the health services provided, (3) for those
parties directly involved with providing treatment in
accordance with 45 CFR 164.501 and 164.506, (4) for to the
patient or processing the payment in accordance with 45 CFR
164.501 and 164.506, (5) to for that treatment, those parties
responsible for peer review, utilization review, and quality
assurance, (6) for health care operations in accordance with 45
CFR 164.501 and 164.506, (7) to and those parties required to
be notified under the Abused and Neglected Child Reporting Act
or , the Illinois Sexually Transmissible Disease Control Act, or
(8) as where otherwise permitted, authorized, or required by
State or federal law. This right may be waived in writing by
the patient or the patient's guardian or legal representative,
but a physician or other health care provider may not condition
the provision of services on the patient's, or guardian's, or
legal representative's agreement to sign such a waiver. In the
interest of public health, safety, and welfare, patient
information, including, but not limited to, health
information, demographic information, and information about
the services provided to patients, may be transmitted to or
through a health information exchange, as that term is defined
in Section 2 of the Mental Health and Developmental
Disabilities Confidentiality Act, in accordance with the
disclosures permitted pursuant to this Section. Patients shall
be provided the opportunity to opt out of their health
information being transmitted to or through a health
information exchange in accordance with the regulations,
standards, or contractual obligations adopted by the Illinois
Health Information Exchange Authority in accordance with
Section 9.6 of the Mental Health and Developmental Disabilities
Confidentiality Act, Section 9.6 of the AIDS Confidentiality
Act, or Section 31.8 of the Genetic Information Privacy Act, as
applicable. In the case of a patient choosing to opt out of
having his or her information available on an HIE, nothing in
this Act shall cause the physician or health care provider to
be liable for the release of a patient's health information by
other entities that may possess such information, including,
but not limited to, other health professionals, providers,
laboratories, pharmacies, hospitals, ambulatory surgical
centers, and nursing homes.
(Source: P.A. 86-895; 86-902; 86-1028; 87-334.)
 
    Section 10. The AIDS Confidentiality Act is amended by
changing Sections 2, 3, 9, 10, and 16 and by adding Sections
9.1, 9.2, 9.3, 9.4, 9.4a, 9.6, 9.7, 9.8, 9.9, and 9.10 as
follows:
 
    (410 ILCS 305/2)  (from Ch. 111 1/2, par. 7302)
    Sec. 2. The General Assembly finds that:
    (1) The use of tests designed to reveal a condition
indicative of Human Immunodeficiency Virus (HIV) infection can
be a valuable tool in protecting the public health.
    (2) Despite existing laws, regulations and professional
standards which require or promote the informed, voluntary and
confidential use of tests designed to reveal HIV infection,
many members of the public are deterred from seeking such
testing because they misunderstand the nature of the test or
fear that test results or other health information that reveals
their HIV status will be disclosed without their consent.
    (3) The public health will be served by facilitating
informed, voluntary and confidential use of tests designed to
reveal HIV infection and appropriately protecting the health
information privacy of patients who are HIV-positive.
    (4) The public health will also be served by expanding the
availability of informed, voluntary, and confidential HIV
testing and treatment and making HIV testing a routine part of
general medical care, as recommended by the United States
Centers for Disease Control and Prevention.
    (5) The use of electronic health record systems and the
exchange of electronic patient records, both paper and
electronic, through secure means, including through secure
health information exchanges, should be encouraged to improve
patient health care and care coordination, facilitate public
health reporting, and control health care costs, among other
purposes.
    (6) Limiting the use or disclosure of, and requests for,
protected health information to the minimum necessary to
accomplish an intended purpose, when being transmitted by or on
behalf of a covered entity under HIPAA, is a key component of
health information privacy. The disclosure of HIV-related
information, when allowed by this Act, shall be performed in
accordance with the minimum necessary standard when required
under HIPAA.
(Source: P.A. 95-7, eff. 6-1-08.)
 
    (410 ILCS 305/3)  (from Ch. 111 1/2, par. 7303)
    Sec. 3. When used in this Act:
    (a) "AIDS" means acquired immunodeficiency syndrome.
    (b) "Authority" means the Illinois Health Information
Exchange Authority established pursuant to the Illinois Health
Information Exchange and Technology Act.
    (c) "Business associate" has the meaning ascribed to it
under HIPAA, as specified in 45 CFR 160.103.
    (d) "Covered entity" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103.
    (e) "De-identified information" means health information
that is not individually identifiable as described under HIPAA,
as specified in 45 CFR 164.514(b).
    (f) (a) "Department" means the Illinois Department of
Public Health or its designated agents.
    (g) "Disclosure" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103.
    (h) "Health care operations" has the meaning ascribed to it
under HIPAA, as specified in 45 CFR 164.501.
    (i) "Health care professional" means (i) a licensed
physician, (ii) a physician assistant to whom the physician
assistant's supervising physician has delegated the provision
of AIDS and HIV-related health services, (iii) an advanced
practice registered nurse who has a written collaborative
agreement with a collaborating physician which authorizes the
provision of AIDS and HIV-related health services, (iv) a
licensed dentist, (v) a licensed podiatric physician, or (vi)
an individual certified to provide HIV testing and counseling
by a state or local public health department.
    (j) "Health care provider" has the meaning ascribed to it
under HIPAA, as specified in 45 CFR 160.103.
    (b) "AIDS" means acquired immunodeficiency syndrome.
    (c) "HIV" means the Human Immunodeficiency Virus or any
other identified causative agent of AIDS.
    (d) "Informed consent" means a written or verbal agreement
by the subject of a test or the subject's legally authorized
representative without undue inducement or any element of
force, fraud, deceit, duress or other form of constraint or
coercion, which entails at least the following pre-test
information:
        (1) a fair explanation of the test, including its
    purpose, potential uses, limitations and the meaning of its
    results; and
        (2) a fair explanation of the procedures to be
    followed, including the voluntary nature of the test, the
    right to withdraw consent to the testing process at any
    time, the right to anonymity to the extent provided by law
    with respect to participation in the test and disclosure of
    test results, and the right to confidential treatment of
    information identifying the subject of the test and the
    results of the test, to the extent provided by law.
    Pre-test information may be provided in writing, verbally,
or by video, electronic, or other means. The subject must be
offered an opportunity to ask questions about the HIV test and
decline testing. Nothing in this Act shall prohibit a health
care provider from combining a form used to obtain informed
consent for HIV testing with forms used to obtain written
consent for general medical care or any other medical test or
procedure provided that the forms make it clear that the
subject may consent to general medical care, tests, or medical
procedures without being required to consent to HIV testing and
clearly explain how the subject may opt-out of HIV testing.
    (k) (e) "Health facility" means a hospital, nursing home,
blood bank, blood center, sperm bank, or other health care
institution, including any "health facility" as that term is
defined in the Illinois Finance Authority Act.
    (l) "Health information exchange" or "HIE" means a health
information exchange or health information organization that
oversees and governs the electronic exchange of health
information that (i) is established pursuant to the Illinois
Health Information Exchange and Technology Act, or any
subsequent amendments thereto, and any administrative rules
adopted thereunder; (ii) has established a data sharing
arrangement with the Authority; or (iii) as of August 16, 2013,
was designated by the Authority Board as a member of, or was
represented on, the Authority Board's Regional Health
Information Exchange Workgroup; provided that such designation
shall not require the establishment of a data sharing
arrangement or other participation with the Illinois Health
Information Exchange or the payment of any fee. In certain
circumstances, in accordance with HIPAA, an HIE will be a
business associate.
    (m) "Health oversight agency" has the meaning ascribed to
it under HIPAA, as specified in 45 CFR 164.501.
    (n) "HIPAA" means the Health Insurance Portability and
Accountability Act of 1996, Public Law 104-191, as amended by
the Health Information Technology for Economic and Clinical
Health Act of 2009, Public Law 111-05, and any subsequent
amendments thereto and any regulations promulgated thereunder.
    (o) "HIV" means the human immunodeficiency virus.
    (p) "HIV-related information" means the identity of a
person upon whom an HIV test is performed, the results of an
HIV test, as well as diagnosis, treatment, and prescription
information that reveals a patient is HIV-positive, including
such information contained in a limited data set. "HIV-related
information" does not include information that has been
de-identified in accordance with HIPAA.
    (q) "Informed consent" means a written or verbal agreement
by the subject of a test or the subject's legally authorized
representative without undue inducement or any element of
force, fraud, deceit, duress, or other form of constraint or
coercion, which entails at least the following pre-test
information:
        (1) a fair explanation of the test, including its
    purpose, potential uses, limitations, and the meaning of
    its results;
        (2) a fair explanation of the procedures to be
    followed, including the voluntary nature of the test, the
    right to withdraw consent to the testing process at any
    time, the right to anonymity to the extent provided by law
    with respect to participation in the test and disclosure of
    test results, and the right to confidential treatment of
    information identifying the subject of the test and the
    results of the test, to the extent provided by law; and
        (3) where the person providing informed consent is a
    participant in an HIE, a fair explanation that the results
    of the patient's HIV test will be accessible through an HIE
    and meaningful disclosure of the patient's opt-out right
    under Section 9.6 of this Act.
    Pre-test information may be provided in writing, verbally,
or by video, electronic, or other means. The subject must be
offered an opportunity to ask questions about the HIV test and
decline testing. Nothing in this Act shall prohibit a health
care provider or health care professional from combining a form
used to obtain informed consent for HIV testing with forms used
to obtain written consent for general medical care or any other
medical test or procedure provided that the forms make it clear
that the subject may consent to general medical care, tests, or
medical procedures without being required to consent to HIV
testing and clearly explain how the subject may opt out of HIV
testing.
    (r) "Limited data set" has the meaning ascribed to it under
HIPAA, as described in 45 CFR 164.514(e)(2).
    (s) "Minimum necessary" means the HIPAA standard for using,
disclosing, and requesting protected health information found
in 45 CFR 164.502(b) and 164.514(d).
    (t) "Organized health care arrangement" has the meaning
ascribed to it under HIPAA, as specified in 45 CFR 160.103.
    (u) "Patient safety activities" has the meaning ascribed to
it under 42 CFR 3.20.
    (v) "Payment" has the meaning ascribed to it under HIPAA,
as specified in 45 CFR 164.501.
    (w) "Person" includes any natural person, partnership,
association, joint venture, trust, governmental entity, public
or private corporation, health facility, or other legal entity.
    (x) "Protected health information" has the meaning
ascribed to it under HIPAA, as specified in 45 CFR 160.103.
    (y) "Research" has the meaning ascribed to it under HIPAA,
as specified in 45 CFR 164.501.
    (z) "State agency" means an instrumentality of the State of
Illinois and any instrumentality of another state that,
pursuant to applicable law or a written undertaking with an
instrumentality of the State of Illinois, is bound to protect
the privacy of HIV-related information of Illinois persons.
    (f) "Health care provider" means any health care
professional, nurse, paramedic, psychologist or other person
providing medical, nursing, psychological, or other health
care services of any kind.
    (f-5) "Health care professional" means (i) a licensed
physician, (ii) a physician assistant to whom the physician
assistant's supervising physician has delegated the provision
of AIDS and HIV-related health services, (iii) an advanced
practice registered nurse who has a written collaborative
agreement with a collaborating physician which authorizes the
provision of AIDS and HIV-related health services, (iv) a
licensed dentist, (v) a licensed podiatric physician, or (vi)
an individual certified to provide HIV testing and counseling
by a state or local public health department.
    (aa) (g) "Test" or "HIV test" means a test to determine the
presence of the antibody or antigen to HIV, or of HIV
infection.
    (bb) "Treatment" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 164.501.
    (cc) "Use" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 160.103, where context dictates.
    (h) "Person" includes any natural person, partnership,
association, joint venture, trust, governmental entity, public
or private corporation, health facility or other legal entity.
(Source: P.A. 98-214, eff. 8-9-13.)
 
    (410 ILCS 305/9)  (from Ch. 111 1/2, par. 7309)
    Sec. 9. (1) No person may disclose or be compelled to
disclose HIV-related information the identity of any person
upon whom a test is performed, or the results of such a test in
a manner which permits identification of the subject of the
test, except to the following persons:
    (a) The subject of an HIV the test or the subject's legally
authorized representative. A physician may notify the spouse of
the test subject, if the test result is positive and has been
confirmed pursuant to rules adopted by the Department, provided
that the physician has first sought unsuccessfully to persuade
the patient to notify the spouse or that, a reasonable time
after the patient has agreed to make the notification, the
physician has reason to believe that the patient has not
provided the notification. This paragraph shall not create a
duty or obligation under which a physician must notify the
spouse of the test results, nor shall such duty or obligation
be implied. No civil liability or criminal sanction under this
Act shall be imposed for any disclosure or non-disclosure of a
test result to a spouse by a physician acting in good faith
under this paragraph. For the purpose of any proceedings, civil
or criminal, the good faith of any physician acting under this
paragraph shall be presumed.
    (b) Any person designated in a legally effective
authorization for release of the HIV-related information test
results executed by the subject of the HIV-related information
test or the subject's legally authorized representative.
    (c) An authorized agent or employee of a health facility or
health care provider if the health facility or health care
provider itself is authorized to obtain the test results, the
agent or employee provides patient care or handles or processes
specimens of body fluids or tissues, and the agent or employee
has a need to know such information.
    (d) The Department and local health authorities serving a
population of over 1,000,000 residents or other local health
authorities as designated by the Department, in accordance with
rules for reporting, preventing, and controlling the spread of
disease and the conduct of public health surveillance, public
health investigations, and public health interventions, as
otherwise provided by State law. The Department, local health
authorities, and authorized representatives shall not disclose
HIV test results and HIV-related information and records held
by them relating to known or suspected cases of AIDS or HIV
infection, publicly or in any action of any kind in any court
or before any tribunal, board, or agency. HIV test results and
HIV-related information AIDS and HIV infection data shall be
protected from disclosure in accordance with the provisions of
Sections 8-2101 through 8-2105 of the Code of Civil Procedure.
    (e) A health facility, or health care provider, or health
care professional which procures, processes, distributes or
uses: (i) a human body part from a deceased person with respect
to medical information regarding that person; or (ii) semen
provided prior to the effective date of this Act for the
purpose of artificial insemination.
    (f) Health facility staff committees for the purposes of
conducting program monitoring, program evaluation or service
reviews.
    (f-5) A court in accordance with the provisions of Section
12-5.01 of the Criminal Code of 2012.
    (g) (Blank).
    (h) Any health care provider, health care professional, or
employee of a health facility, and any firefighter or EMT-A,
EMT-P, or EMT-I, involved in an accidental direct skin or
mucous membrane contact with the blood or bodily fluids of an
individual which is of a nature that may transmit HIV, as
determined by a physician in his medical judgment.
    (i) Any law enforcement officer, as defined in subsection
(c) of Section 7, involved in the line of duty in a direct skin
or mucous membrane contact with the blood or bodily fluids of
an individual which is of a nature that may transmit HIV, as
determined by a physician in his medical judgment.
    (j) A temporary caretaker of a child taken into temporary
protective custody by the Department of Children and Family
Services pursuant to Section 5 of the Abused and Neglected
Child Reporting Act, as now or hereafter amended.
    (k) In the case of a minor under 18 years of age whose test
result is positive and has been confirmed pursuant to rules
adopted by the Department, the health care professional
provider who ordered the test shall make a reasonable effort to
notify the minor's parent or legal guardian if, in the
professional judgment of the health care professional
provider, notification would be in the best interest of the
child and the health care professional provider has first
sought unsuccessfully to persuade the minor to notify the
parent or legal guardian or a reasonable time after the minor
has agreed to notify the parent or legal guardian, the health
care professional provider has reason to believe that the minor
has not made the notification. This subsection shall not create
a duty or obligation under which a health care professional
provider must notify the minor's parent or legal guardian of
the test results, nor shall a duty or obligation be implied. No
civil liability or criminal sanction under this Act shall be
imposed for any notification or non-notification of a minor's
test result by a health care professional provider acting in
good faith under this subsection. For the purpose of any
proceeding, civil or criminal, the good faith of any health
care professional provider acting under this subsection shall
be presumed.
    (2) All information and records held by a State agency,
local health authority, or health oversight agency pertaining
to HIV-related information shall be strictly confidential and
exempt from copying and inspection under the Freedom of
Information Act. The information and records shall not be
released or made public by the State agency, local health
authority, or health oversight agency, shall not be admissible
as evidence nor discoverable in any action of any kind in any
court or before any tribunal, board, agency, or person, and
shall be treated in the same manner as the information and
those records subject to the provisions of Part 21 of Article
VIII of the Code of Civil Procedure, except under the following
circumstances:
        (A) when made with the written consent of all persons
    to whom the information pertains; or
        (B) when authorized by Section 5-4-3 of the Unified
    Code of Corrections.
    Disclosure shall be limited to those who have a need to
know the information, and no additional disclosures may be
made.
(Source: P.A. 96-328, eff. 8-11-09; 97-1046, eff. 8-21-12;
97-1150, eff. 1-25-13.)
 
    (410 ILCS 305/9.1 new)
    Sec. 9.1. Uses and disclosures for treatment, payment, and
health care operations. Notwithstanding Sections 9 and 10 of
this Act, a covered entity may, without a patient's consent:
        (1) use or disclose HIV-related information for its own
    treatment, payment, or health care operations;
        (2) disclose HIV-related information for treatment
    activities of a health care provider or health care
    professional;
        (3) disclose HIV-related information to another
    covered entity or health care provider or health care
    professional for the payment activities of the entity that
    receives the information;
        (4) disclose HIV-related information to another
    covered entity for health care operations activities of the
    entity that receives the information, if each entity has or
    had a relationship with the individual who is the subject
    of the HIV-related information being requested, the
    HIV-related information pertains to such relationship, and
    the disclosure is for the purpose of (A) conducting quality
    assessment and improvement activities, including outcomes
    evaluation and development of clinical guidelines,
    provided that the obtaining of generalizable knowledge is
    not the primary purpose of any studies resulting from such
    activities; patient safety activities; population-based
    activities relating to improving health or reducing health
    care costs, protocol development, case management, and
    care coordination, contacting of health care providers and
    patients with information about treatment alternatives;
    and related functions that do not include treatment; (B)
    reviewing the competence or qualifications of health care
    professionals or health care providers, evaluating
    practitioner and provider performance, health plan
    performance, conducting training programs in which
    students, trainees, or practitioners in areas of health
    care learn under supervision to practice or improve their
    skills as health care providers, training of non-health
    care professionals, accreditation, certification,
    licensing, or credentialing activities; or (C) health care
    fraud and abuse detection or compliance; and
        (5) disclose HIV-related information to other
    participants in an organized health care arrangement in
    which the covered entity is also a participant for any
    health care operations activities of the organized health
    care arrangement.
 
    (410 ILCS 305/9.2 new)
    Sec. 9.2. Uses and disclosures for health oversight
activities.
    (a) Notwithstanding Sections 9 and 10 of this Act, a
covered entity may disclose HIV-related information, without a
patient's consent, to a health oversight agency for health
oversight activities authorized by law, including audits,
civil, administrative, or criminal investigations;
inspections; licensure or disciplinary actions; civil
administrative or criminal proceedings or actions; or other
activities necessary for appropriate oversight of (i) the
health care system; (ii) government benefit programs for which
health information is relevant to beneficiary eligibility;
(iii) entities subject to government regulatory programs for
which health information is necessary for determining
compliance with program standards; or (iv) entities subject to
civil rights laws for which health information is necessary for
determining compliance.
    (b) For purposes of the disclosures permitted by this
Section, a health oversight activity does not include an
investigation or other activity in which the individual is the
subject of the investigation or activity and such investigation
or other activity does not arise out of and is not directly
related to (i) the receipt of health care; (ii) a claim for
public benefits related to health; or (iii) qualification for,
or receipt of, public benefits or services when a patient's
health is integral to the claim for public benefits or
services, except that, if a health oversight activity or
investigation is conducted in conjunction with an oversight
activity or investigation relating to a claim for public
benefits not related to health, the joint activity or
investigation is considered a health oversight activity for
purposes of this Section.
    (c) If a covered entity is also a health oversight agency,
the covered entity may use HIV-related information for health
oversight activities permitted by this Section.
 
    (410 ILCS 305/9.3 new)
    Sec. 9.3. Business associates.
    (a) Notwithstanding Sections 9 and 10 of this Act, a
covered entity may, without a patient's consent, disclose a
patient's HIV-related information to a business associate and
may allow a business associate to create, receive, maintain, or
transmit protected health information on its behalf, if the
covered entity obtains, through a written contract or other
written agreement or arrangement that meets the applicable
requirements of 45 CFR 164.504(e), satisfactory assurance that
the business associate will appropriately safeguard the
information. A covered entity is not required to obtain such
satisfactory assurances from a business associate that is a
subcontractor.
    (b) A business associate may disclose protected health
information to a business associate that is a subcontractor and
may allow the subcontractor to create, receive, maintain, or
transmit protected health information on its behalf, if the
business associate obtains satisfactory assurances, in
accordance with 45 CFR 164.504(e)(1)(i), that the
subcontractor will appropriately safeguard the information.
 
    (410 ILCS 305/9.4 new)
    Sec. 9.4. Use and disclosure of information to an HIE.
Notwithstanding the provisions of Sections 9 and 10 of this
Act, a covered entity may, without a patient's consent,
disclose the identity of any patient upon whom a test is
performed and such patient's HIV-related information from a
patient's record to an HIE if the disclosure is a required or
permitted disclosure to a business associate or is a disclosure
otherwise required or permitted under this Act. An HIE may,
without a patient's consent, use or disclose such information
to the extent it is allowed to use or disclose such information
as a business associate in compliance with 45 CFR 164.502(e) or
for such other purposes as are specifically allowed under this
Act.
 
    (410 ILCS 305/9.4a new)
    Sec. 9.4a. Other disclosures. Nothing in this Act shall be
construed (1) to limit the use of an HIE to facilitate
disclosures permitted by this Act or (2) to allow for the
disclosure of information from a patient's record to law
enforcement or for law enforcement purposes.
 
    (410 ILCS 305/9.6 new)
    Sec. 9.6. HIE opt out. Section 9.6 of the Mental Health and
Developmental Disabilities Confidentiality Act is incorporated
herein by reference. In addition to the requirements set out in
Section 9.6 of the Mental Health and Developmental Disabilities
Confidentiality Act, at the time of a patient's first encounter
for HIV-related care with a health care provider, health care
professional, or health facility that participates in an HIE,
or, in the event of a medical emergency that makes it
impossible, as soon thereafter as is practicable, the patient
shall receive meaningful disclosure regarding the HIE in which
the health care provider, health care professional, or health
facility participates and shall be afforded an opportunity to
opt out of disclosure of the patient's health information
through the HIE.
 
    (410 ILCS 305/9.7 new)
    Sec. 9.7. Record locator service to support HIE. Section
9.9 of the Mental Health and Developmental Disabilities and
Confidentiality Act is herein incorporated by reference.
 
    (410 ILCS 305/9.8 new)
    Sec. 9.8. Disclosure of limited data sets and de-identified
information. Notwithstanding the provisions of Sections 9 and
10 of this Act:
        (1) a covered entity may, without a patient's consent,
    create, use, and disclose a limited data set using
    HIV-related information from a patient's record or
    disclose HIV-related information from a patient's record
    to a business associate for the purpose of establishing a
    limited data set; the creation, use, and disclosure of such
    a limited data set must comply with the requirements set
    forth under HIPAA;
        (2) a covered entity may, without a patient's consent,
    create, use, and disclose de-identified information using
    information from a patient's record that is subject to this
    Act or disclose HIV-related information from a patient's
    record to a business associate for the purpose of
    de-identifying the information; the creation, use, and
    disclosure of such de-identified data must comply with the
    requirements set forth under HIPAA. A covered entity or a
    business associate may disclose information that is
    de-identified; and
        (3) the recipient of de-identified information shall
    not re-identify de-identified information using any public
    or private data source.
 
    (410 ILCS 305/9.9 new)
    Sec. 9.9. Research. HIV-related information may be
disclosed for research in accordance with the requirements set
forth under HIPAA.
 
    (410 ILCS 305/9.10 new)
    Sec. 9.10. Minimum necessary. When using and disclosing
HIV-related information under this Act, a covered entity shall
do so in accordance with the minimum necessary standard under
HIPAA.
 
    (410 ILCS 305/10)  (from Ch. 111 1/2, par. 7310)
    Sec. 10. No person to whom the results of a test have been
disclosed may disclose the test results to another person
except as authorized under this Act by Section 9.
(Source: P.A. 85-677; 85-679.)
 
    (410 ILCS 305/16)  (from Ch. 111 1/2, par. 7316)
    Sec. 16. The Department shall promulgate rules and
regulations concerning implementation and enforcement of this
Act, except to the extent that this Act delegates to the
Authority the promulgation or adoption of any rules,
regulations, standards, or contractual obligations. The rules
and regulations promulgated by the Department pursuant to this
Act may include procedures for taking appropriate action with
regard to health care facilities or health care providers which
violate this Act or the regulations promulgated hereunder. The
provisions of The Illinois Administrative Procedure Act shall
apply to all administrative rules and procedures of the
Department pursuant to this Act, except that in case of
conflict between The Illinois Administrative Procedure Act and
this Act, the provisions of this Act shall control. The
Department shall conduct training, technical assistance, and
outreach activities, as needed, to implement routine HIV
testing in healthcare medical settings.
(Source: P.A. 95-7, eff. 6-1-08.)
 
    Section 15. The Genetic Information Privacy Act is amended
by changing Sections 5, 10, 20, 25, 30, 35, and 40 and by
adding Sections 31, 31.1, 31.2, 31.3, 31.4, 31.5, 31.6, 31.7,
31.8, 31.9, and 31.10 as follows:
 
    (410 ILCS 513/5)
    Sec. 5. Legislative findings; intent. The General Assembly
finds that:
        (1) The use of genetic testing can be valuable to an
    individual.
        (2) Despite existing laws, regulations, and
    professional standards which require or promote voluntary
    and confidential use of genetic testing information, many
    members of the public are deterred from seeking genetic
    testing because of fear that test results will be disclosed
    without consent in a manner not permitted by law or will be
    used in a discriminatory manner.
        (3) The public health will be served by facilitating
    voluntary and confidential nondiscriminatory use of
    genetic testing information.
        (4) The use of electronic health record systems and the
    exchange of patient records, both paper and electronic,
    through secure means, including through secure health
    information exchanges, should be encouraged to improve
    patient health care and care coordination, facilitate
    public health reporting, and control health care costs,
    among other purposes.
        (5) Limiting the use or disclosure of, and requests
    for, protected health information to the minimum necessary
    to accomplish an intended purpose, when being transmitted
    by or on behalf of a covered entity under HIPAA, is a key
    component of health information privacy. The disclosure of
    genetic information, when allowed by this Act, shall be
    performed in accordance with the minimum necessary
    standard when required under HIPAA.
(Source: P.A. 90-25, eff. 1-1-98.)
 
    (410 ILCS 513/10)
    Sec. 10. Definitions. As used in this Act:
    "Authority" means the Illinois Health Information Exchange
Authority established pursuant to the Illinois Health
Information Exchange and Technology Act.
    "Business associate" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103.
    "Covered entity" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103.
    "De-identified information" means health information that
is not individually identifiable as described under HIPAA, as
specified in 45 CFR 164.514(b).
    "Disclosure" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 160.103.
    "Employer" means the State of Illinois, any unit of local
government, and any board, commission, department,
institution, or school district, any party to a public
contract, any joint apprenticeship or training committee
within the State, and every other person employing employees
within the State.
    "Employment agency" means both public and private
employment agencies and any person, labor organization, or
labor union having a hiring hall or hiring office regularly
undertaking, with or without compensation, to procure
opportunities to work, or to procure, recruit, refer, or place
employees.
    "Family member" means, with respect to an individual, (i)
the spouse of the individual; (ii) a dependent child of the
individual, including a child who is born to or placed for
adoption with the individual; (iii) any other person qualifying
as a covered dependent under a managed care plan; and (iv) all
other individuals related by blood or law to the individual or
the spouse or child described in subsections (i) through (iii)
of this definition.
    "Genetic information" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103. means, with respect to
any individual, information about (i) the individual's genetic
tests; (ii) the genetic tests of a family member of the
individual; and (iii) the manifestation or possible
manifestation of a disease or disorder in a family member of
the individual. Genetic information does not include
information about the sex or age of any individual.
    "Genetic monitoring" means the periodic examination of
employees to evaluate acquired modifications to their genetic
material, such as chromosomal damage or evidence of increased
occurrence of mutations that may have developed in the course
of employment due to exposure to toxic substances in the
workplace in order to identify, evaluate, and respond to
effects of or control adverse environmental exposures in the
workplace.
    "Genetic services" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103 means a genetic test,
genetic counseling, including obtaining, interpreting, or
assessing genetic information, or genetic education.
    "Genetic testing" and "genetic test" have the meaning
ascribed to "genetic test" under HIPAA, as specified in 45 CFR
160.103. mean a test or analysis of human genes, gene products,
DNA, RNA, chromosomes, proteins, or metabolites that detect
genotypes, mutations, chromosomal changes, abnormalities, or
deficiencies, including carrier status, that (i) are linked to
physical or mental disorders or impairments, (ii) indicate a
susceptibility to illness, disease, impairment, or other
disorders, whether physical or mental, or (iii) demonstrate
genetic or chromosomal damage due to environmental factors.
Genetic testing and genetic tests do not include routine
physical measurements; chemical, blood and urine analyses that
are widely accepted and in use in clinical practice; tests for
use of drugs; tests for the presence of the human
immunodeficiency virus; analyses of proteins or metabolites
that do not detect genotypes, mutations, chromosomal changes,
abnormalities, or deficiencies; or analyses of proteins or
metabolites that are directly related to a manifested disease,
disorder, or pathological condition that could reasonably be
detected by a health care professional with appropriate
training and expertise in the field of medicine involved.
    "Health care operations" has the meaning ascribed to it
under HIPAA, as specified in 45 CFR 164.501.
    "Health care professional" means (i) a licensed physician,
(ii) a physician assistant to whom the physician assistant's
supervising physician has delegated the provision of genetic
testing or genetic counseling-related services, (iii) an
advanced practice registered nurse who has a written
collaborative agreement with a collaborating physician which
authorizes the provision of genetic testing or genetic
counseling-related health services, (iv) a licensed dentist,
(v) a licensed podiatrist, (vi) a licensed genetic counselor,
or (vii) an individual certified to provide genetic testing by
a state or local public health department.
    "Health care provider" has the meaning ascribed to it under
HIPAA, as specified in 45 CFR 160.103.
    "Health facility" means a hospital, blood bank, blood
center, sperm bank, or other health care institution, including
any "health facility" as that term is defined in the Illinois
Finance Authority Act.
    "Health information exchange" or "HIE" means a health
information exchange or health information organization that
exchanges health information electronically that (i) is
established pursuant to the Illinois Health Information
Exchange and Technology Act, or any subsequent amendments
thereto, and any administrative rules promulgated thereunder;
(ii) has established a data sharing arrangement with the
Authority; or (iii) as of August 16, 2013, was designated by
the Authority Board as a member of, or was represented on, the
Authority Board's Regional Health Information Exchange
Workgroup; provided that such designation shall not require the
establishment of a data sharing arrangement or other
participation with the Illinois Health Information Exchange or
the payment of any fee. In certain circumstances, in accordance
with HIPAA, an HIE will be a business associate.
    "Health oversight agency" has the meaning ascribed to it
under HIPAA, as specified in 45 CFR 164.501.
    "HIPAA" means the Health Insurance Portability and
Accountability Act of 1996, Public Law 104-191, as amended by
the Health Information Technology for Economic and Clinical
Health Act of 2009, Public Law 111-05, and any subsequent
amendments thereto and any regulations promulgated thereunder.
    "Insurer" means (i) an entity that is subject to the
jurisdiction of the Director of Insurance transacts an
insurance business and (ii) a managed care plan.
    "Labor organization" includes any organization, labor
union, craft union, or any voluntary unincorporated
association designed to further the cause of the rights of
union labor that is constituted for the purpose, in whole or in
part, of collective bargaining or of dealing with employers
concerning grievances, terms or conditions of employment, or
apprenticeships or applications for apprenticeships, or of
other mutual aid or protection in connection with employment,
including apprenticeships or applications for apprenticeships.
    "Licensing agency" means a board, commission, committee,
council, department, or officers, except a judicial officer, in
this State or any political subdivision authorized to grant,
deny, renew, revoke, suspend, annul, withdraw, or amend a
license or certificate of registration.
    "Limited data set" has the meaning ascribed to it under
HIPAA, as described in 45 CFR 164.514(e)(2).
    "Labor organization" includes any organization, labor
union, craft union, or any voluntary unincorporated
association designed to further the cause of the rights of
union labor that is constituted for the purpose, in whole or in
part, of collective bargaining or of dealing with employers
concerning grievances, terms or conditions of employment, or
apprenticeships or applications for apprenticeships, or of
other mutual aid or protection in connection with employment,
including apprenticeships or applications for apprenticeships.
    "Managed care plan" means a plan that establishes,
operates, or maintains a network of health care providers that
have entered into agreements with the plan to provide health
care services to enrollees where the plan has the ultimate and
direct contractual obligation to the enrollee to arrange for
the provision of or pay for services through:
        (1) organizational arrangements for ongoing quality
    assurance, utilization review programs, or dispute
    resolution; or
        (2) financial incentives for persons enrolled in the
    plan to use the participating providers and procedures
    covered by the plan.
    A managed care plan may be established or operated by any
entity including a licensed insurance company, hospital or
medical service plan, health maintenance organization, limited
health service organization, preferred provider organization,
third party administrator, or an employer or employee
organization.
    "Minimum necessary" means HIPAA's standard for using,
disclosing, and requesting protected health information found
in 45 CFR 164.502(b) and 164.514(d).
    "Nontherapeutic purpose" means a purpose that is not
intended to improve or preserve the life or health of the
individual whom the information concerns.
    "Organized health care arrangement" has the meaning
ascribed to it under HIPAA, as specified in 45 CFR 160.103.
    "Patient safety activities" has the meaning ascribed to it
under 42 CFR 3.20.
    "Payment" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 164.501.
    "Person" includes any natural person, partnership,
association, joint venture, trust, governmental entity, public
or private corporation, health facility, or other legal entity.
    "Protected health information" has the meaning ascribed to
it under HIPAA, as specified in 45 CFR 164.103.
    "Research" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 164.501.
    "State agency" means an instrumentality of the State of
Illinois and any instrumentality of another state which
pursuant to applicable law or a written undertaking with an
instrumentality of the State of Illinois is bound to protect
the privacy of genetic information of Illinois persons.
    "Treatment" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 164.501.
    "Use" has the meaning ascribed to it under HIPAA, as
specified in 45 CFR 160.103, where context dictates.
(Source: P.A. 95-927, eff. 1-1-09.)
 
    (410 ILCS 513/20)
    Sec. 20. Use of genetic testing information for insurance
purposes.
    (a) An insurer may not seek information derived from
genetic testing for use in connection with a policy of accident
and health insurance. Except as provided in subsection (c) (b),
an insurer that receives information derived from genetic
testing, regardless of the source of that information, may not
use the information for a nontherapeutic purpose as it relates
to a policy of accident and health insurance.
    (b) An insurer shall not use or disclose protected health
information that is genetic information for underwriting
purposes. For purposes of this Section, "underwriting
purposes" means, with respect to an insurer:
        (1) rules for, or determination of, eligibility
    (including enrollment and continued eligibility) for, or
    determination of, benefits under the plan, coverage, or
    policy (including changes in deductibles or other
    cost-sharing mechanisms in return for activities such as
    completing a health risk assessment or participating in a
    wellness program);
        (2) the computation of premium or contribution amounts
    under the plan, coverage, or policy (including discounts,
    rebates, payments in kind, or other premium differential
    mechanisms in return for activities, such as completing a
    health risk assessment or participating in a wellness
    program);
        (3) the application of any pre-existing condition
    exclusion under the plan, coverage, or policy; and
        (4) other activities related to the creation, renewal,
    or replacement of a contract of health insurance or health
    benefits.
    "Underwriting purposes" does not include determinations of
medical appropriateness where an individual seeks a benefit
under the plan, coverage, or policy.
    This subsection (b) does not apply to insurers that are
issuing a long-term care policy, excluding a nursing home fixed
indemnity plan.
    (c) (b) An insurer may consider the results of genetic
testing in connection with a policy of accident and health
insurance if the individual voluntarily submits the results and
the results are favorable to the individual.
    (d) (c) An insurer that possesses information derived from
genetic testing may not release the information to a third
party, except as specified in this Act Section 30.
(Source: P.A. 92-430, eff. 8-17-01.)
 
    (410 ILCS 513/25)
    Sec. 25. Use of genetic testing information by employers.
    (a) An employer, employment agency, labor organization,
and licensing agency shall treat genetic testing and genetic
information in such a manner that is consistent with the
requirements of federal law, including but not limited to the
Genetic Information Nondiscrimination Act of 2008, the
Americans with Disabilities Act, Title VII of the Civil Rights
Act of 1964, the Family and Medical Leave Act of 1993, the
Occupational Safety and Health Act of 1970, the Federal Mine
Safety and Health Act of 1977, or the Atomic Energy Act of
1954.
    (b) An employer may release genetic testing information
only in accordance with Sections 15 and 30 of this Act.
    (c) An employer, employment agency, labor organization,
and licensing agency shall not directly or indirectly do any of
the following:
        (1) solicit, request, require or purchase genetic
    testing or genetic information of a person or a family
    member of the person, or administer a genetic test to a
    person or a family member of the person as a condition of
    employment, preemployment application, labor organization
    membership, or licensure;
        (2) affect the terms, conditions, or privileges of
    employment, preemployment application, labor organization
    membership, or licensure, or terminate the employment,
    labor organization membership, or licensure of any person
    because of genetic testing or genetic information with
    respect to the employee or family member, or information
    about a request for or the receipt of genetic testing by
    such employee or family member of such employee;
        (3) limit, segregate, or classify employees in any way
    that would deprive or tend to deprive any employee of
    employment opportunities or otherwise adversely affect the
    status of the employee as an employee because of genetic
    testing or genetic information with respect to the employee
    or a family member, or information about a request for or
    the receipt of genetic testing or genetic information by
    such employee or family member of such employee; and
        (4) retaliate through discharge or in any other manner
    against any person alleging a violation of this Act or
    participating in any manner in a proceeding under this Act.
    (d) An agreement between a person and an employer,
prospective employer, employment agency, labor organization,
or licensing agency, or its employees, agents, or members
offering the person employment, labor organization membership,
licensure, or any pay or benefit in return for taking a genetic
test is prohibited.
    (e) An employer shall not use genetic information or
genetic testing in furtherance of a workplace wellness program
benefiting employees unless (1) health or genetic services are
offered by the employer, (2) the employee provides written
authorization and informed consent in accordance with Section
30 of this Act, (3) only the employee or family member if the
family member is receiving genetic services and the licensed
health care professional or licensed genetic counselor
involved in providing such services receive individually
identifiable information concerning the results of such
services, and (4) any individually identifiable information is
only available for purposes of such services and shall not be
disclosed to the employer except in aggregate terms that do not
disclose the identity of specific employees.
    (f) Nothing in this Act shall be construed to prohibit
genetic testing of an employee who requests a genetic test and
who provides written authorization and informed consent, in
accordance with Section 30 of this Act, from taking a genetic
test for the purpose of initiating a workers' compensation
claim under the Workers' Compensation Act.
    (g) A purchase of commercially and publicly available
documents, including newspapers, magazines, periodicals, and
books but not including medical databases or court records or
inadvertently requesting family medical history by an
employer, employment agency, labor organization, and licensing
agency does not violate this Act.
    (h) Nothing in this Act shall be construed to prohibit an
employer that conducts DNA analysis for law enforcement
purposes as a forensic laboratory and that includes such
analysis in the Combined DNA Index System pursuant to the
federal Violent Crime Control and Law Enforcement Act of 1994
from requesting or requiring genetic testing or genetic
information of such employer's employees, but only to the
extent that such genetic testing or genetic information is used
for analysis of DNA identification markers for quality control
to detect sample contamination.
    (i) Nothing in this Act shall be construed to prohibit an
employer from requesting or requiring genetic information to be
used for genetic monitoring of the biological effects of toxic
substances in the workplace, but only if (1) the employer
provides written notice of the genetic monitoring to the
employee; (2) the employee provides written authorization and
informed consent under Section 30 of this Act or the genetic
monitoring is required by federal or State law; (3) the
employee is informed of individual monitoring results; (4) the
monitoring is in compliance with any federal genetic monitoring
regulations or State genetic monitoring regulations under the
authority of the federal Occupational Safety and Health Act of
1970; and (5) the employer, excluding any health care provider,
licensed health care professional, or health facility licensed
genetic counselor that is involved in the genetic monitoring
program, receives the results of the monitoring only in
aggregate terms that do not disclose the identity of specific
employees.
    (j) Despite lawful acquisition of genetic testing or
genetic information under subsections (e) through (i) of this
Section, an employer, employment agency, labor organization,
and licensing agency still may not use or disclose the genetic
test or genetic information in violation of this Act.
    (k) Except as provided in subsections (e), (f), (h), and
(i) of this Section, a person shall not knowingly sell to or
interpret for an employer, employment agency, labor
organization, or licensing agency, or its employees, agents, or
members, a genetic test of an employee, labor organization
member, or license holder, or of a prospective employee,
member, or license holder.
(Source: P.A. 95-927, eff. 1-1-09.)
 
    (410 ILCS 513/30)
    Sec. 30. Disclosure of person tested and test results.
    (a) No person may disclose or be compelled to disclose the
identity of any person upon whom a genetic test is performed or
the results of a genetic test in a manner that permits
identification of the subject of the test, except to the
following persons:
        (1) The subject of the test or the subject's legally
    authorized representative. This paragraph does not create
    a duty or obligation under which a health care provider
    must notify the subject's spouse or legal guardian of the
    test results, and no such duty or obligation shall be
    implied. No civil liability or criminal sanction under this
    Act shall be imposed for any disclosure or nondisclosure of
    a test result to a spouse by a physician acting in good
    faith under this paragraph. For the purpose of any
    proceedings, civil or criminal, the good faith of any
    physician acting under this paragraph shall be presumed.
        (2) Any person designated in a specific written legally
    effective authorization for release release of the test
    results executed by the subject of the test or the
    subject's legally authorized representative.
        (3) An authorized agent or employee of a health
    facility or health care provider if the health facility or
    health care provider itself is authorized to obtain the
    test results, the agent or employee provides patient care,
    and the agent or employee has a need to know the
    information in order to conduct the tests or provide care
    or treatment.
        (4) A health facility, or health care provider, or
    health care professional that procures, processes,
    distributes, or uses:
            (A) a human body part from a deceased person with
        respect to medical information regarding that person;
        or
            (B) semen provided prior to the effective date of
        this Act for the purpose of artificial insemination.
        (5) Health facility staff committees for the purposes
    of conducting program monitoring, program evaluation, or
    service reviews.
        (6) In the case of a minor under 18 years of age, the
    health care provider, health care professional, or health
    facility who ordered the test shall make a reasonable
    effort to notify the minor's parent or legal guardian if,
    in the professional judgment of the health care provider,
    health care professional, or health facility, notification
    would be in the best interest of the minor and the health
    care provider, health care professional, or health
    facility has first sought unsuccessfully to persuade the
    minor to notify the parent or legal guardian or after a
    reasonable time after the minor has agreed to notify the
    parent or legal guardian, the health care provider, health
    care professional, or health facility has reason to believe
    that the minor has not made the notification. This
    paragraph shall not create a duty or obligation under which
    a health care provider, health care professional, or health
    facility must notify the minor's parent or legal guardian
    of the test results, nor shall a duty or obligation be
    implied. No civil liability or criminal sanction under this
    Act shall be imposed for any notification or
    non-notification of a minor's test result by a health care
    provider, health care professional, or health facility
    acting in good faith under this paragraph. For the purpose
    of any proceeding, civil or criminal, the good faith of any
    health care provider, health care professional, or health
    facility acting under this paragraph shall be presumed.
    (b) (7) All information and records held by a State agency,
or local health authority, or health oversight agency
pertaining to genetic information shall be strictly
confidential and exempt from copying and inspection under the
Freedom of Information Act. The information and records shall
not be released or made public by the State agency, or local
health authority, or health oversight agency and shall not be
admissible as evidence nor discoverable in any action of any
kind in any court or before any tribunal, board, agency, or
person and shall be treated in the same manner as the
information and those records subject to the provisions of Part
21 of Article VIII of the Code of Civil Procedure except under
the following circumstances:
            (A) when made with the written consent of all
        persons to whom the information pertains;
            (B) when authorized by Section 5-4-3 of the Unified
        Code of Corrections;
            (C) when made for the sole purpose of implementing
        the Newborn Metabolic Screening Act and rules; or
            (D) when made under the authorization of the
        Illinois Parentage Act of 1984.
    Disclosure shall be limited to those who have a need to
know the information, and no additional disclosures may be
made.
    (c) (b) Disclosure by an insurer in accordance with the
requirements of the Article XL of the Illinois Insurance Code
shall be deemed compliance with this Section.
(Source: P.A. 96-328, eff. 8-11-09.)
 
    (410 ILCS 513/31 new)
    Sec. 31. Uses and disclosures for treatment, payment, and
health care operations. Notwithstanding Sections 30 and 35 of
this Act, a covered entity may, without a patient's consent:
    (1) use or disclose genetic information for its own
treatment, payment, or health care operations;
    (2) disclose genetic information for treatment activities
of a health care provider;
    (3) disclose genetic information to another covered entity
or health care provider for the payment activities of the
entity that receives the information;
    (4) disclose genetic information to another covered entity
for health care operations activities of the entity that
receives the information, if each entity has or had a
relationship with the individual who is the subject of the
genetic information being requested, the genetic information
pertains to such relationship, and the disclosure is for the
purpose of (A) conducting quality assessment and improvement
activities, including outcomes evaluation and development of
clinical guidelines, provided that the obtaining of
generalizable knowledge is not the primary purpose of any
studies resulting from such activities; patient safety
activities; population-based activities relating to improving
health or reducing health care costs, protocol development,
case management, and care coordination, contacting of health
care providers and patients with information about treatment
alternatives; and related functions that do not include
treatment; (B) reviewing the competence or qualifications of
health care professionals or health care providers, evaluating
practitioner and provider performance, health plan
performance, conducting training programs in which students,
trainees, or practitioners in areas of health care learn under
supervision to practice or improve their skills as health care
providers, training of non-health care professionals,
accreditation, certification, licensing, or credentialing
activities; or (C) health care fraud and abuse detection or
compliance; and
    (5) disclose genetic information to other participants in
an organized health care arrangement in which the covered
entity is also a participant for any health care operations
activities of the organized health care arrangement.
 
    (410 ILCS 513/31.1 new)
    Sec. 31.1. Uses and disclosures for health oversight
activities.
    (a) Notwithstanding Sections 30 and 35 of this Act, a
covered entity may disclose genetic information, without a
patient's consent, to a health oversight agency for health
oversight activities authorized by law, including audits,
civil, administrative, or criminal investigations;
inspections; licensure or disciplinary actions; civil
administrative or criminal proceedings or actions; or other
activities necessary for appropriate oversight of (i) the
health care system; (ii) government benefit programs for which
health information is relevant to beneficiary eligibility;
(iii) entities subject to government regulatory programs for
which health information is necessary for determining
compliance with program standards; or (iv) entities subject to
civil rights laws for which health information is necessary for
determining compliance.
    (b) For purposes of the disclosures permitted by this
Section, a health oversight activity does not include an
investigation or other activity in which the individual is the
subject of the investigation or activity and such investigation
or other activity does not arise out of and is not directly
related to (i) the receipt of health care; (ii) a claim for
public benefits related to health; or (iii) qualification for,
or receipt of, public benefits or services when a patient's
health is integral to the claim for public benefits or
services, except that, if a health oversight activity or
investigation is conducted in conjunction with an oversight
activity or investigation relating to a claim for public
benefits not related to health, the joint activity or
investigation is considered a health oversight activity for
purposes of this Section.
    (c) If a covered entity is also a health oversight agency,
the covered entity may use genetic information for health
oversight activities permitted by this Section.
 
    (410 ILCS 513/31.2 new)
    Sec. 31.2. Uses and disclosures for public health
activities. Notwithstanding Sections 30 and 35 of this Act,
genetic information may be disclosed without a patient's
consent for public health activities and purposes to the
Department, when the Department is authorized by law to collect
or receive such information for the purpose of preventing or
controlling disease, injury, or disability, including, but not
limited to, the reporting of disease, injury, vital events such
as birth or death, and the conduct of public health
surveillance, public health investigations, and public health
interventions.
 
    (410 ILCS 513/31.3 new)
    Sec. 31.3. Business associates.
    (a) Notwithstanding Sections 30 and 35 of this Act, a
covered entity may, without a patient's consent, disclose a
patient's genetic information to a business associate and may
allow a business associate to create, receive, maintain, or
transmit protected health information on its behalf, if the
covered entity obtains, through a written contract or other
written agreement or arrangement that meets the applicable
requirements of 45 CFR 164.504(e), satisfactory assurance that
the business associate will appropriately safeguard the
information. A covered entity is not required to obtain such
satisfactory assurances from a business associate that is a
subcontractor.
    (b) A business associate may disclose protected health
information to a business associate that is a subcontractor and
may allow the subcontractor to create, receive, maintain, or
transmit protected health information on its behalf, if the
business associate obtains satisfactory assurances, in
accordance with 45 CFR 164.504(e)(1)(i), that the
subcontractor will appropriately safeguard the information.
 
    (410 ILCS 513/31.4 new)
    Sec. 31.4. Record locator service to support HIE. Section
9.9 of the Mental Health and Developmental Disabilities
Confidentiality Act is herein incorporated by reference.
 
    (410 ILCS 513/31.5 new)
    Sec. 31.5. Use and disclosure of information to an HIE.
Notwithstanding the provisions of Section 30 and 35 of this
Act, a covered entity may, without a patient's consent,
disclose the identity of any patient upon whom a test is
performed and such patient's genetic information from a
patient's record to a HIE if the disclosure is a required or
permitted disclosure to a business associate or is a disclosure
otherwise required or permitted under this Act. An HIE may,
without a patient's consent, use or disclose such information
to the extent it is allowed to use or disclose such information
as a business associate in compliance with 45 CFR 164.502(e) or
for such other purposes as are specifically allowed under this
Act.
 
    (410 ILCS 513/31.6 new)
    Sec. 31.6. Other disclosures. Nothing in this Act shall be
construed (1) to limit the use of an HIE to facilitate
disclosures permitted by this Act or (2) to allow for the
disclosure of information from a patient's record to law
enforcement or for law enforcement purposes.
 
    (410 ILCS 513/31.7 new)
    Sec. 31.7. Establishment and disclosure of limited data
sets and de-identified information.
    (a) A covered entity may, without a genetic information
test subject's consent, create, use, and disclose a limited
data set using information subject to this Act or disclose
information subject to this Act to a business associate for the
purpose of establishing a limited data set. The creation, use,
and disclosure of such a limited data set must comply with the
requirements set forth under HIPAA.
    (b) A covered entity may, without a genetic information
test subject's consent, create, use, and disclose
de-identified information using information subject to this
Act or disclose information subject to this Act to a business
associate for the purpose of de-identifying the information.
The creation, use, and disclosure of such de-identified
information must comply with the requirements set forth under
HIPAA. A covered entity or a business associate may disclose
information that is de-identified in accordance with HIPAA.
    (c) The recipient of de-identified information shall not
re-identify de-identified information using any public or
private data source.
 
    (410 ILCS 513/31.8 new)
    Sec. 31.8. HIE opt out. Section 9.6 of the Mental Health
and Developmental Disabilities Confidentiality Act is
incorporated herein by reference. In addition to the
requirements set out in Section 9.6 of the Mental Health and
Developmental Disabilities Confidentiality Act, at the time of
a patient's first encounter for genetic testing with a health
care provider, health care professional, or health facility
that participates in an HIE, or, in the event of a medical
emergency that makes it impossible, as soon thereafter as is
practicable, the patient shall receive meaningful disclosure
regarding the HIE in which the health care provider, health
care professional, or health facility participates and shall be
afforded an opportunity to opt out of disclosure of the
patient's health information through the HIE.
 
    (410 ILCS 513/31.9 new)
    Sec. 31.9. Research. Genetic information may be disclosed
for research, in accordance with the requirements set forth
under HIPAA.
 
    (410 ILCS 513/31.10 new)
    Sec. 31.10. Minimum necessary. When using or disclosing
genetic-related information under this Act, a covered entity
shall do so in accordance with the minimum necessary standard
under HIPAA.
 
    (410 ILCS 513/35)
    Sec. 35. Disclosure by person to whom results have been
disclosed. No person to whom the results of a test have been
disclosed may disclose the test results to another person
except as authorized under this Act by Section 30.
(Source: P.A. 90-25, eff. 1-1-98.)
 
    (410 ILCS 513/40)
    Sec. 40. Right of action.
    (a) Any person aggrieved by a violation of this Act shall
have a right of action in a State circuit court or as a
supplemental claim in a federal district court against an
offending party. A prevailing party may recover for each
violation:
        (1) Against any party who negligently violates a
    provision of this Act, liquidated damages of $2,500 or
    actual damages, whichever is greater.
        (2) Against any party who intentionally or recklessly
    violates a provision of this Act, liquidated damages of
    $15,000 or actual damages, whichever is greater.
        (3) Reasonable attorney's fees and costs, including
    expert witness fees and other litigation expenses.
        (4) Such other relief, including an injunction, as the
    State or federal court may deem appropriate.
    (b) Article XL of the Illinois Insurance Code shall provide
the exclusive remedy for violations of Section 30 by insurers.
    (c) Notwithstanding any provisions of the law to the
contrary, any person alleging a violation of subsection (a) of
Section 15, subsection (b) of Section 25, Section 30, Section
31, or Section 35 of this Act shall have a right of action in a
State circuit court or as a supplemental claim in a federal
district court to seek a preliminary injunction preventing the
release or disclosure of genetic testing or genetic information
pending the final resolution of any action under this Act.
(Source: P.A. 95-927, eff. 1-1-09.)
 
    Section 20. The Unified Code of Corrections is amended by
changing Sections 3-8-2 and 3-10-2 as follows:
 
    (730 ILCS 5/3-8-2)  (from Ch. 38, par. 1003-8-2)
    Sec. 3-8-2. Social Evaluation; physical examination;
HIV/AIDS.
    (a) A social evaluation shall be made of a committed
person's medical, psychological, educational and vocational
condition and history, including the use of alcohol and other
drugs, the circumstances of his offense, and such other
information as the Department may determine. The committed
person shall be assigned to an institution or facility in so
far as practicable in accordance with the social evaluation.
Recommendations shall be made for medical, dental,
psychiatric, psychological and social service treatment.
    (b) A record of the social evaluation shall be entered in
the committed person's master record file and shall be
forwarded to the institution or facility to which the person is
assigned.
    (c) Upon admission to a correctional institution each
committed person shall be given a physical examination. If he
is suspected of having a communicable disease that in the
judgment of the Department medical personnel requires medical
isolation, the committed person shall remain in medical
isolation until it is no longer deemed medically necessary.
    (d) Upon arrival at a reception and classification center
or an inmate's final destination, the Department must provide
the committed person with appropriate information in writing,
verbally, by video or other electronic means concerning HIV and
AIDS. The Department shall develop the informational materials
in consultation with the Department of Public Health. At the
same time, the Department also must offer the committed person
the option of being tested, with no copayment, for infection
with human immunodeficiency virus (HIV). Pre-test information
shall be provided to the committed person and informed consent
obtained as required in subsection (q) (d) of Section 3 and
Section 5 of the AIDS Confidentiality Act. The Department may
conduct opt-out HIV testing as defined in Section 4 of the AIDS
Confidentiality Act. If the Department conducts opt-out HIV
testing, the Department shall place signs in English, Spanish
and other languages as needed in multiple, highly visible
locations in the area where HIV testing is conducted informing
inmates that they will be tested for HIV unless they refuse,
and refusal or acceptance of testing shall be documented in the
inmate's medical record. The Department shall follow
procedures established by the Department of Public Health to
conduct HIV testing and testing to confirm positive HIV test
results. All testing must be conducted by medical personnel,
but pre-test and other information may be provided by committed
persons who have received appropriate training. The
Department, in conjunction with the Department of Public
Health, shall develop a plan that complies with the AIDS
Confidentiality Act to deliver confidentially all positive or
negative HIV test results to inmates or former inmates. Nothing
in this Section shall require the Department to offer HIV
testing to an inmate who is known to be infected with HIV, or
who has been tested for HIV within the previous 180 days and
whose documented HIV test result is available to the Department
electronically. The testing provided under this subsection (d)
shall consist of a test approved by the Illinois Department of
Public Health to determine the presence of HIV infection, based
upon recommendations of the United States Centers for Disease
Control and Prevention. If the test result is positive, a
reliable supplemental test based upon recommendations of the
United States Centers for Disease Control and Prevention shall
be administered.
(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11;
97-813, eff. 7-13-12.)
 
    (730 ILCS 5/3-10-2)  (from Ch. 38, par. 1003-10-2)
    Sec. 3-10-2. Examination of Persons Committed to the
Department of Juvenile Justice.
    (a) A person committed to the Department of Juvenile
Justice shall be examined in regard to his medical,
psychological, social, educational and vocational condition
and history, including the use of alcohol and other drugs, the
circumstances of his offense and any other information as the
Department of Juvenile Justice may determine.
    (a-5) Upon admission of a person committed to the
Department of Juvenile Justice, the Department of Juvenile
Justice must provide the person with appropriate information
concerning HIV and AIDS in writing, verbally, or by video or
other electronic means. The Department of Juvenile Justice
shall develop the informational materials in consultation with
the Department of Public Health. At the same time, the
Department of Juvenile Justice also must offer the person the
option of being tested, at no charge to the person, for
infection with human immunodeficiency virus (HIV). Pre-test
information shall be provided to the committed person and
informed consent obtained as required in subsection (q) (d) of
Section 3 and Section 5 of the AIDS Confidentiality Act. The
Department of Juvenile Justice may conduct opt-out HIV testing
as defined in Section 4 of the AIDS Confidentiality Act. If the
Department conducts opt-out HIV testing, the Department shall
place signs in English, Spanish and other languages as needed
in multiple, highly visible locations in the area where HIV
testing is conducted informing inmates that they will be tested
for HIV unless they refuse, and refusal or acceptance of
testing shall be documented in the inmate's medical record. The
Department shall follow procedures established by the
Department of Public Health to conduct HIV testing and testing
to confirm positive HIV test results. All testing must be
conducted by medical personnel, but pre-test and other
information may be provided by committed persons who have
received appropriate training. The Department, in conjunction
with the Department of Public Health, shall develop a plan that
complies with the AIDS Confidentiality Act to deliver
confidentially all positive or negative HIV test results to
inmates or former inmates. Nothing in this Section shall
require the Department to offer HIV testing to an inmate who is
known to be infected with HIV, or who has been tested for HIV
within the previous 180 days and whose documented HIV test
result is available to the Department electronically. The
testing provided under this subsection (a-5) shall consist of a
test approved by the Illinois Department of Public Health to
determine the presence of HIV infection, based upon
recommendations of the United States Centers for Disease
Control and Prevention. If the test result is positive, a
reliable supplemental test based upon recommendations of the
United States Centers for Disease Control and Prevention shall
be administered.
    Also upon admission of a person committed to the Department
of Juvenile Justice, the Department of Juvenile Justice must
inform the person of the Department's obligation to provide the
person with medical care.
    (b) Based on its examination, the Department of Juvenile
Justice may exercise the following powers in developing a
treatment program of any person committed to the Department of
Juvenile Justice:
        (1) Require participation by him in vocational,
    physical, educational and corrective training and
    activities to return him to the community.
        (2) Place him in any institution or facility of the
    Department of Juvenile Justice.
        (3) Order replacement or referral to the Parole and
    Pardon Board as often as it deems desirable. The Department
    of Juvenile Justice shall refer the person to the Parole
    and Pardon Board as required under Section 3-3-4.
        (4) Enter into agreements with the Secretary of Human
    Services and the Director of Children and Family Services,
    with courts having probation officers, and with private
    agencies or institutions for separate care or special
    treatment of persons subject to the control of the
    Department of Juvenile Justice.
    (c) The Department of Juvenile Justice shall make periodic
reexamination of all persons under the control of the
Department of Juvenile Justice to determine whether existing
orders in individual cases should be modified or continued.
This examination shall be made with respect to every person at
least once annually.
    (d) A record of the treatment decision including any
modification thereof and the reason therefor, shall be part of
the committed person's master record file.
    (e) The Department of Juvenile Justice shall by certified
mail, return receipt requested, notify the parent, guardian or
nearest relative of any person committed to the Department of
Juvenile Justice of his physical location and any change
thereof.
(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11;
97-813, eff. 7-13-12.)
 
    Section 25. The County Jail Act is amended by changing
Section 17.10 as follows:
 
    (730 ILCS 125/17.10)
    Sec. 17.10. Requirements in connection with HIV/AIDS.
    (a) In each county other than Cook, during the medical
admissions exam, the warden of the jail, a correctional officer
at the jail, or a member of the jail medical staff must provide
the prisoner with appropriate written information concerning
human immunodeficiency virus (HIV) and acquired
immunodeficiency syndrome (AIDS). The Department of Public
Health and community-based organizations certified to provide
HIV/AIDS testing must provide these informational materials to
the warden at no cost to the county. The warden, a correctional
officer, or a member of the jail medical staff must inform the
prisoner of the option of being tested for infection with HIV
by a certified local community-based agency or other available
medical provider at no charge to the prisoner.
    (b) In Cook County, during the medical admissions exam, an
employee of the Cook County Health & Hospitals System must
provide the prisoner with appropriate information in writing,
verbally or by video or other electronic means concerning human
immunodeficiency virus (HIV) and acquired immunodeficiency
syndrome (AIDS) and must also provide the prisoner with option
of testing for infection with HIV or any other identified
causative agent of AIDS, as well as counseling in connection
with such testing. The Cook County Health & Hospitals System
may provide the inmate with opt-out human immunodeficiency
virus (HIV) testing, as defined in Section 4 of the AIDS
Confidentiality Act, unless the inmate refuses. If opt-out HIV
testing is conducted, the Cook County Health & Hospitals System
shall place signs in English, Spanish, and other languages as
needed in multiple, highly visible locations in the area where
HIV testing is conducted informing inmates that they will be
tested for HIV unless they refuse, and refusal or acceptance of
testing shall be documented in the inmate's medical record.
Pre-test information shall be provided to the inmate and
informed consent obtained from the inmate as required in
subsection (q) (d) of Section 3 and Section 5 of the AIDS
Confidentiality Act. The Cook County Health & Hospitals System
shall follow procedures established by the Department of Public
Health to conduct HIV testing and testing to confirm positive
HIV test results. All aspects of HIV testing shall comply with
the requirements of the AIDS Confidentiality Act, including
delivery of test results, as determined by the Cook County
Health & Hospitals System in consultation with the Illinois
Department of Public Health. Nothing in this Section shall
require the Cook County Health & Hospitals System to offer HIV
testing to inmates who are known to be infected with HIV. The
Department of Public Health and community-based organizations
certified to provide HIV/AIDS testing may provide these
informational materials to the Bureau at no cost to the county.
The testing provided under this subsection (b) shall consist of
a test approved by the Illinois Department of Public Health to
determine the presence of HIV infection, based upon
recommendations of the United States Centers for Disease
Control and Prevention. If the test result is positive, a
reliable supplemental test based upon recommendations of the
United States Centers for Disease Control and Prevention shall
be administered.
    (c) In each county, the warden of the jail must make
appropriate written information concerning HIV/AIDS available
to every visitor to the jail. This information must include
information concerning persons or entities to contact for local
counseling and testing. The Department of Public Health and
community-based organizations certified to provide HIV/AIDS
testing must provide these informational materials to the
warden at no cost to the office of the county sheriff.
    (d) Implementation of this Section is subject to
appropriation.
(Source: P.A. 97-244, eff. 8-4-11; 97-323, eff. 8-12-11;
97-813, eff. 7-13-12.)
 
    Section 30. The Code of Civil Procedure is amended by
changing Section 8-802 as follows:
 
    (735 ILCS 5/8-802)  (from Ch. 110, par. 8-802)
    Sec. 8-802. Physician and patient. No physician or surgeon
shall be permitted to disclose any information he or she may
have acquired in attending any patient in a professional
character, necessary to enable him or her professionally to
serve the patient, except only (1) in trials for homicide when
the disclosure relates directly to the fact or immediate
circumstances of the homicide, (2) in actions, civil or
criminal, against the physician for malpractice, (3) with the
expressed consent of the patient, or in case of his or her
death or disability, of his or her personal representative or
other person authorized to sue for personal injury or of the
beneficiary of an insurance policy on his or her life, health,
or physical condition, or as authorized by Section 8-2001.5,
(4) in all actions brought by or against the patient, his or
her personal representative, a beneficiary under a policy of
insurance, or the executor or administrator of his or her
estate wherein the patient's physical or mental condition is an
issue, (5) upon an issue as to the validity of a document as a
will of the patient, (6) in any criminal action where the
charge is either first degree murder by abortion, attempted
abortion or abortion, (7) in actions, civil or criminal,
arising from the filing of a report in compliance with the
Abused and Neglected Child Reporting Act, (8) to any
department, agency, institution or facility which has custody
of the patient pursuant to State statute or any court order of
commitment, (9) in prosecutions where written results of blood
alcohol tests are admissible pursuant to Section 11-501.4 of
the Illinois Vehicle Code, (10) in prosecutions where written
results of blood alcohol tests are admissible under Section
5-11a of the Boat Registration and Safety Act, (11) in criminal
actions arising from the filing of a report of suspected
terrorist offense in compliance with Section 29D-10(p)(7) of
the Criminal Code of 2012, or (12) upon the issuance of a
subpoena pursuant to Section 38 of the Medical Practice Act of
1987; the issuance of a subpoena pursuant to Section 25.1 of
the Illinois Dental Practice Act; the issuance of a subpoena
pursuant to Section 22 of the Nursing Home Administrators
Licensing and Disciplinary Act; or the issuance of a subpoena
pursuant to Section 25.5 of the Workers' Compensation Act, or
(13) to or through a health information exchange, as that term
is defined in Section 2 of the Mental Health and Developmental
Disabilities Confidentiality Act, in accordance with State or
federal law.
    In the event of a conflict between the application of this
Section and the Mental Health and Developmental Disabilities
Confidentiality Act to a specific situation, the provisions of
the Mental Health and Developmental Disabilities
Confidentiality Act shall control.
(Source: P.A. 97-18, eff. 6-28-11; 97-623, eff. 11-23-11;
97-813, eff. 7-13-12; 97-1150, eff. 1-25-13.)