Section 697.220  Release of HIV/AIDS Registry Information

a)         The Department may not release information gathered pursuant to the AIDS Registry Act unless:

1)         It is in statistical form that does not identify the reporting entity, physician or patient in any way, including by address;

2)         The release or transfer is to an Illinois Local Public Health Department or to a registry or health department of another state, and is of information concerning a person who is residing in that jurisdiction. The Department shall disclose individual patient information concerning residents of another state to the Registry in the individual's state of residence if the recipient of reported information about HIV/AIDS is legally required to hold reported information about HIV/AIDS in confidence and provides protection from disclosure of patient identifying information equivalent to the protection afforded by the Illinois law. (Section 7(a) of the AIDS Registry Act)

b)         All data obtained directly from medical records of individual patients shall be for the confidential use of the Department and those entities authorized by the Department to view such records in order to carry out the purposes of the Registry Act.  (Section 7(b) of the AIDS Registry Act)

c)         The identity of any person whose condition or treatment has been studied, or any facts which are likely to reveal the identity of such person, shall be confidential and shall not be revealed in any report or any other matter prepared, released or published.  Researchers may, however, use the names of persons when requesting additional information for research studies approved by the Department; provided however, that when a request for additional information is to be made, the Department shall first obtain authorization from the patient or the patient's legally authorized representative after ascertaining that a test subject's physical and psychological condition is suitable for such a request in the opinion of the test subject's physician.  (Section  7(c) of the AIDS Registry Act)

1)         All requests by medical or epidemiologic researchers for confidential Registry data must be submitted in writing to the Registry.  The request must include a study protocol which contains:  objectives of the research; rationale for the research including scientific literature justifying current proposal; overall study methods, including copies of forms, questionnaires, and consent forms  used to contact facilities, physicians or study subjects including methods for documenting compliance with 42 CFR 2a.4(a)-(j), 2a.6(a)-(b), and 2a. 7(a)-(b)(1); methods for the processing of data; storage and security measures taken to insure confidentiality of patient identifying information; time frame of the study; a description of the funding source of the study (e.g., federal contract); the curriculum vitae of the principal investigator and a list of collaborators.  In addition, the research request must specify what patient or facility identifying information is needed and how the information will be used.

2)         All requests to conduct research and modifications to approved research proposals involving the use of data which includes patient or facility identifying information shall be subject to a review to determine compliance with the following conditions.  The Department will enter into contracts for research which require the release of patient or facility identifying information when requests meet the following conditions:

A)        The request for patient or facility identifying information contains stated goals or objectives;

B)        The request documents the feasibility of the study design in achieving the stated goals and objectives;

C)        The request documents the need for the requested data to achieve the stated goals and objectives;

D)        The requested data can be provided within the time frame set forth in the request;

E)         The request documents that the researcher has qualifications relevant to the type of research being conducted;

F)         The research will not duplicate other research already underway using the same Registry data; and

G)        The request documents other such conditions relevant to the need for the patient or facility identifying information and the patient's confidentiality rights, because the Department will only release the patient or facility identifying information which is necessary for the research.

3)         The Department will enter into research contracts for all approved research requests.  These contracts shall specify exactly what information is being released and how it can be used.  In addition, the researcher shall include assurances that:

A)        The researcher understands that use of data is restricted to the specifications of the protocol;

B)        The researcher understands that any and all data which may lead to the identity of any patient, research subject, physician, other person, or hospital are strictly privileged and confidential and agrees to keep all such data strictly confidential at all times;

C)        The researcher understands that all officers, agents and employees are to keep all such data strictly confidential;

D)        The researcher agrees to communicate the requirements of this Section to all officers, agents, and employees, to discipline all persons who may violate the requirements of this Section, and to notify the Department in writing within 48 hours after any violation of this Section, including full details of the violation and corrective actions to be taken;

E)         The researcher understands that all data provided by the Department pursuant to this contract may only be used for the purposes named in this contract and that any other or additional use of the data shall result in immediate termination of this contract by the Department; and

F)         The researcher understands that all data provided by the Department pursuant to this contract is the sole property of the Department and may not be copied or reproduced in any form or manner and agrees to return all data and all copies and reproduction of the data to the Department upon termination of the contract.

4)         Any departures from the approved protocol must be submitted in writing and approved by the Director in accordance with subsection (c)(2) of this Section prior to initiation.  No patient or facility identifying information may be released by a researcher to a third party.

5)         The Department shall disclose individual patient or facility information to the reporting facility which originally supplied that information to the Department, upon written request of the facility.

d)         HIV/AIDS information may be disclosed in accordance with the provisions of Sections 697.140 and 697.400 of this Part.

e)         No liability shall attach to any hospital, physician or other facility submitting information pursuant to this Act based upon a claim that such hospital, physician or facility reported information which may be confidential.  (Section 7(d) of the AIDS Registry Act)

(Source:  Amended at 22 Ill. Reg. 21994, effective December 9, 1998)