720 ILCS 570/318

(720 ILCS 570/318)

(Text of Section before amendment by P.A. 103-881)

Sec. 318. Confidentiality of information.

(a) Information received by the central repository under Section 316 and former Section 321 is confidential.

(a-1) To ensure the federal Health Insurance Portability and Accountability Act and confidentiality of substance use disorder patient records rules that mandate the privacy of an individual's prescription data reported to the Prescription Monitoring Program received from a retail dispenser under this Act, and in order to execute the duties and responsibilities under Section 316 of this Act and rules for disclosure under this Section, the Clinical Director of the Prescription Monitoring Program or his or her designee shall maintain direct access to all Prescription Monitoring Program data. Any request for Prescription Monitoring Program data from any other department or agency must be approved in writing by the Clinical Director of the Prescription Monitoring Program or his or her designee unless otherwise permitted by law. Prescription Monitoring Program data shall only be disclosed as permitted by law.

(a-2) As an active step to address the current opioid crisis in this State and to prevent and reduce addiction resulting from a sports injury or an accident, the Prescription Monitoring Program and the Department of Public Health shall coordinate a continuous review of the Prescription Monitoring Program and the Department of Public Health data to determine if a patient may be at risk of opioid addiction. Each patient discharged from any medical facility with an International Classification of Disease, 10th edition code related to a sport or accident injury shall be subject to the data review. If the discharged patient is dispensed a controlled substance, the Prescription Monitoring Program shall alert the patient's prescriber as to the addiction risk and urge each to follow the Centers for Disease Control and Prevention guidelines or his or her respective profession's treatment guidelines related to the patient's injury. This subsection (a-2), other than this sentence, is inoperative on or after January 1, 2024.

(b) The Department must carry out a program to protect the confidentiality of the information described in subsection (a). The Department may disclose the information to another person only under subsection (c), (d), or (f) and may charge a fee not to exceed the actual cost of furnishing the information.

(c) The Department may disclose confidential information described in subsection (a) to any person who is engaged in receiving, processing, or storing the information.

(d) The Department may release confidential information described in subsection (a) to the following persons:

(1) A governing body that licenses practitioners and is engaged in an investigation, an adjudication, or a prosecution of a violation under any State or federal law that involves a controlled substance.

(2) An investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General, who is engaged in any of the following activities involving controlled substances:

(A) an investigation;

(B) an adjudication; or

(C) a prosecution of a violation under any State or federal law that involves a controlled substance.

(3) A law enforcement officer who is:

(A) authorized by the Illinois State Police or the office of a county sheriff or State's Attorney or municipal police department of Illinois to receive information of the type requested for the purpose of investigations involving controlled substances; or

(B) approved by the Department to receive information of the type requested for the purpose of investigations involving controlled substances; and

(C) engaged in the investigation or prosecution of a violation under any State or federal law that involves a controlled substance.

(4) Select representatives of the Department of Children and Family Services through the indirect online request process. Access shall be established by an intergovernmental agreement between the Department of Children and Family Services and the Department of Human Services.

(e) Before the Department releases confidential information under subsection (d), the applicant must demonstrate in writing to the Department that:

(1) the applicant has reason to believe that a violation under any State or federal law that involves a controlled substance has occurred; and

(2) the requested information is reasonably related to the investigation, adjudication, or prosecution of the violation described in subdivision (1).

(f) The Department may receive and release prescription record information under Section 316 and former Section 321 to:

(1) a governing body that licenses practitioners;

(2) an investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General;

(3) any Illinois law enforcement officer who is:

(A) authorized to receive the type of information released; and

(B) approved by the Department to receive the type of information released; or

(4) prescription monitoring entities in other states per the provisions outlined in subsection (g) and (h) below;

confidential prescription record information collected under Sections 316 and 321 (now repealed) that identifies vendors or practitioners, or both, who are prescribing or dispensing large quantities of Schedule II, III, IV, or V controlled substances outside the scope of their practice, pharmacy, or business, as determined by the Advisory Committee created by Section 320.

(f-5) In accordance with a confidentiality agreement entered into with the Department, a medical director, or a public health administrator and their delegated analysts, of a county or municipal health department or the Department of Public Health shall have access to data from the system for any of the following purposes:

(1) developing education programs or public health interventions relating to prescribing trends and controlled substance use; or

(2) conducting analyses and publish reports on prescribing trends in their respective jurisdictions.

At a minimum, the confidentiality agreement entered into with the Department shall:

(i) prohibit analysis and reports produced under subparagraph (2) from including information that identifies, by name, license, or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance; and

(ii) specify the appropriate technical and physical safeguards that the county or municipal health department must implement to ensure the privacy and security of data obtained from the system. The data from the system shall not be admissible as evidence, nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person. The disclosure of any such information or data, whether proper or improper, shall not waive or have any effect upon its confidentiality, non-discoverability, or non-admissibility.

(g) The information described in subsection (f) may not be released until it has been reviewed by an employee of the Department who is licensed as a prescriber or a dispenser and until that employee has certified that further investigation is warranted. However, failure to comply with this subsection (g) does not invalidate the use of any evidence that is otherwise admissible in a proceeding described in subsection (h).

(h) An investigator or a law enforcement officer receiving confidential information under subsection (c), (d), or (f) may disclose the information to a law enforcement officer or an attorney for the office of the Attorney General for use as evidence in the following:

(1) A proceeding under any State or federal law that involves a controlled substance.

(2) A criminal proceeding or a proceeding in juvenile court that involves a controlled substance.

(i) The Department may compile statistical reports from the information described in subsection (a). The reports must not include information that identifies, by name, license or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance.

(j) Based upon federal, initial and maintenance funding, a prescriber and dispenser inquiry system shall be developed to assist the health care community in its goal of effective clinical practice and to prevent patients from diverting or abusing medications.

(1) An inquirer shall have read-only access to a stand-alone database which shall contain records for the previous 12 months.

(2) Dispensers may, upon positive and secure identification, make an inquiry on a patient or customer solely for a medical purpose as delineated within the federal HIPAA law.

(3) The Department shall provide a one-to-one secure link and encrypted software necessary to establish the link between an inquirer and the Department. Technical assistance shall also be provided.

(4) Written inquiries are acceptable but must include the fee and the requester's Drug Enforcement Administration license number and submitted upon the requester's business stationery.

(5) As directed by the Prescription Monitoring Program Advisory Committee and the Clinical Director for the Prescription Monitoring Program, aggregate data that does not indicate any prescriber, practitioner, dispenser, or patient may be used for clinical studies.

(6) Tracking analysis shall be established and used per administrative rule.

(7) Nothing in this Act or Illinois law shall be construed to require a prescriber or dispenser to make use of this inquiry system.

(8) If there is an adverse outcome because of a prescriber or dispenser making an inquiry, which is initiated in good faith, the prescriber or dispenser shall be held harmless from any civil liability.

(k) The Department shall establish, by rule, the process by which to evaluate possible erroneous association of prescriptions to any licensed prescriber or end user of the Illinois Prescription Information Library (PIL).

(l) The Prescription Monitoring Program Advisory Committee is authorized to evaluate the need for and method of establishing a patient specific identifier.

(m) Patients who identify prescriptions attributed to them that were not obtained by them shall be given access to their personal prescription history pursuant to the validation process as set forth by administrative rule.

(n) The Prescription Monitoring Program is authorized to develop operational push reports to entities with compatible electronic medical records. The process shall be covered within administrative rule established by the Department.

(o) Hospital emergency departments and freestanding healthcare facilities providing healthcare to walk-in patients may obtain, for the purpose of improving patient care, a unique identifier for each shift to utilize the PIL system.

(p) The Prescription Monitoring Program shall automatically create a log-in to the inquiry system when a prescriber or dispenser obtains or renews his or her controlled substance license. The Department of Financial and Professional Regulation must provide the Prescription Monitoring Program with electronic access to the license information of a prescriber or dispenser to facilitate the creation of this profile. The Prescription Monitoring Program shall send the prescriber or dispenser information regarding the inquiry system, including instructions on how to log into the system, instructions on how to use the system to promote effective clinical practice, and opportunities for continuing education for the prescribing of controlled substances. The Prescription Monitoring Program shall also send to all enrolled prescribers, dispensers, and designees information regarding the unsolicited reports produced pursuant to Section 314.5 of this Act.

(q) A prescriber or dispenser may authorize a designee to consult the inquiry system established by the Department under this subsection on his or her behalf, provided that all the following conditions are met:

(1) the designee so authorized is employed by the same hospital or health care system; is employed by the same professional practice; or is under contract with such practice, hospital, or health care system;

(2) the prescriber or dispenser takes reasonable steps to ensure that such designee is sufficiently competent in the use of the inquiry system;

(3) the prescriber or dispenser remains responsible for ensuring that access to the inquiry system by the designee is limited to authorized purposes and occurs in a manner that protects the confidentiality of the information obtained from the inquiry system, and remains responsible for any breach of confidentiality; and

(4) the ultimate decision as to whether or not to prescribe or dispense a controlled substance remains with the prescriber or dispenser.

The Prescription Monitoring Program shall send to registered designees information regarding the inquiry system, including instructions on how to log onto the system.

(r) The Prescription Monitoring Program shall maintain an Internet website in conjunction with its prescriber and dispenser inquiry system. This website shall include, at a minimum, the following information:

(1) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other controlled substances as determined by the Advisory Committee;

(2) accredited continuing education programs related to prescribing of controlled substances;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding the prescription of controlled substances; and

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events.

The content of the Internet website shall be periodically reviewed by the Prescription Monitoring Program Advisory Committee as set forth in Section 320 and updated in accordance with the recommendation of the advisory committee.

(s) The Prescription Monitoring Program shall regularly send electronic updates to the registered users of the Program. The Prescription Monitoring Program Advisory Committee shall review any communications sent to registered users and also make recommendations for communications as set forth in Section 320. These updates shall include the following information:

(1) opportunities for accredited continuing education programs related to prescribing of controlled substances;

(2) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other drugs as determined by the Advisory Committee;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding prescribing of controlled substances;

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events; and

(8) reminders that the Prescription Monitoring Program is a useful clinical tool.

(t) Notwithstanding any other provision of this Act, neither the Prescription Monitoring Program nor any other person shall disclose any information in violation of the restrictions and requirements of paragraph (3.5) of subsection (a) of Section 316 as implemented under Public Act 102-527.

(Source: P.A. 102-751, eff. 1-1-23.)

(Text of Section after amendment by P.A. 103-881)

Sec. 318. Confidentiality of information.

(a) Information received by the central repository under Section 316 and former Section 321 is confidential.

(a-1) To ensure the federal Health Insurance Portability and Accountability Act and confidentiality of substance use disorder patient records rules that mandate the privacy of an individual's prescription data reported to the Prescription Monitoring Program received from a retail dispenser under this Act, and in order to execute the duties and responsibilities under Section 316 of this Act and rules for disclosure under this Section, the Clinical Director of the Prescription Monitoring Program or his or her designee shall maintain direct access to all Prescription Monitoring Program data. Any request for Prescription Monitoring Program data from any other department or agency must be approved in writing by the Clinical Director of the Prescription Monitoring Program or his or her designee unless otherwise permitted by law. Prescription Monitoring Program data shall only be disclosed as permitted by law.

(a-2) As an active step to address the current opioid crisis in this State and to prevent and reduce substance use disorders resulting from a sports injury or an accident, the Prescription Monitoring Program and the Department of Public Health shall coordinate a continuous review of the Prescription Monitoring Program and the Department of Public Health data to determine if a patient may be at risk of opioid use disorder. Each patient discharged from any medical facility with an International Classification of Disease, 10th edition code related to a sport or accident injury shall be subject to the data review. If the discharged patient is dispensed a controlled substance, the Prescription Monitoring Program shall alert the patient's prescriber as to the risk of developing a substance use disorder and urge each to follow the Centers for Disease Control and Prevention guidelines or his or her respective profession's treatment guidelines related to the patient's injury. This subsection (a-2), other than this sentence, is inoperative on or after January 1, 2024.

(b) The Department must carry out a program to protect the confidentiality of the information described in subsection (a). The Department may disclose the information to another person only under subsection (c), (d), or (f) and may charge a fee not to exceed the actual cost of furnishing the information.

(c) The Department may disclose confidential information described in subsection (a) to any person who is engaged in receiving, processing, or storing the information.

(d) The Department may release confidential information described in subsection (a) to the following persons:

(1) A governing body that licenses practitioners and is engaged in an investigation, an adjudication, or a prosecution of a violation under any State or federal law that involves a controlled substance.

(2) An investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General, who is engaged in any of the following activities involving controlled substances:

(A) an investigation;

(B) an adjudication; or

(C) a prosecution of a violation under any State or federal law that involves a controlled substance.

(3) A law enforcement officer who is:

(A) authorized by the Illinois State Police or the office of a county sheriff or State's Attorney or municipal police department of Illinois to receive information of the type requested for the purpose of investigations involving controlled substances; or

(B) approved by the Department to receive information of the type requested for the purpose of investigations involving controlled substances; and

(C) engaged in the investigation or prosecution of a violation under any State or federal law that involves a controlled substance.

(4) Select representatives of the Department of Children and Family Services through the indirect online request process. Access shall be established by an intergovernmental agreement between the Department of Children and Family Services and the Department of Human Services.

(e) Before the Department releases confidential information under subsection (d), the applicant must demonstrate in writing to the Department that:

(1) the applicant has reason to believe that a violation under any State or federal law that involves a controlled substance has occurred; and

(2) the requested information is reasonably related to the investigation, adjudication, or prosecution of the violation described in subdivision (1).

(f) The Department may receive and release prescription record information under Section 316 and former Section 321 to:

(1) a governing body that licenses practitioners;

(2) an investigator for the Consumer Protection Division of the office of the Attorney General, a prosecuting attorney, the Attorney General, a deputy Attorney General, or an investigator from the office of the Attorney General;

(3) any Illinois law enforcement officer who is:

(A) authorized to receive the type of information released; and

(B) approved by the Department to receive the type of information released; or

(4) prescription monitoring entities in other states per the provisions outlined in subsection (g) and (h) below;

confidential prescription record information collected under Sections 316 and 321 (now repealed) that identifies vendors or practitioners, or both, who are prescribing or dispensing large quantities of Schedule II, III, IV, or V controlled substances outside the scope of their practice, pharmacy, or business, as determined by the Advisory Committee created by Section 320.

(f-5) In accordance with a confidentiality agreement entered into with the Department, a medical director, or a public health administrator and their delegated analysts, of a county or municipal health department or the Department of Public Health shall have access to data from the system for any of the following purposes:

(1) developing education programs or public health interventions relating to prescribing trends and controlled substance use; or

(2) conducting analyses and publish reports on prescribing trends in their respective jurisdictions.

At a minimum, the confidentiality agreement entered into with the Department shall:

(i) prohibit analysis and reports produced under subparagraph (2) from including information that identifies, by name, license, or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance; and

(ii) specify the appropriate technical and physical safeguards that the county or municipal health department must implement to ensure the privacy and security of data obtained from the system. The data from the system shall not be admissible as evidence, nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person. The disclosure of any such information or data, whether proper or improper, shall not waive or have any effect upon its confidentiality, non-discoverability, or non-admissibility.

(g) The information described in subsection (f) may not be released until it has been reviewed by an employee of the Department who is licensed as a prescriber or a dispenser and until that employee has certified that further investigation is warranted. However, failure to comply with this subsection (g) does not invalidate the use of any evidence that is otherwise admissible in a proceeding described in subsection (h).

(h) An investigator or a law enforcement officer receiving confidential information under subsection (c), (d), or (f) may disclose the information to a law enforcement officer or an attorney for the office of the Attorney General for use as evidence in the following:

(1) A proceeding under any State or federal law that involves a controlled substance.

(2) A criminal proceeding or a proceeding in juvenile court that involves a controlled substance.

(i) The Department may compile statistical reports from the information described in subsection (a). The reports must not include information that identifies, by name, license or address, any practitioner, dispenser, ultimate user, or other person administering a controlled substance.

(j) Based upon federal, initial and maintenance funding, a prescriber and dispenser inquiry system shall be developed to assist the health care community in its goal of effective clinical practice and to prevent patients from diverting or abusing medications.

(1) An inquirer shall have read-only access to a stand-alone database which shall contain records for the previous 12 months.

(2) Dispensers may, upon positive and secure identification, make an inquiry on a patient or customer solely for a medical purpose as delineated within the federal HIPAA law.

(3) The Department shall provide a one-to-one secure link and encrypted software necessary to establish the link between an inquirer and the Department. Technical assistance shall also be provided.

(4) Written inquiries are acceptable but must include the fee and the requester's Drug Enforcement Administration license number and submitted upon the requester's business stationery.

(5) As directed by the Prescription Monitoring Program Advisory Committee and the Clinical Director for the Prescription Monitoring Program, aggregate data that does not indicate any prescriber, practitioner, dispenser, or patient may be used for clinical studies.

(6) Tracking analysis shall be established and used per administrative rule.

(7) Nothing in this Act or Illinois law shall be construed to require a prescriber or dispenser to make use of this inquiry system.

(8) If there is an adverse outcome because of a prescriber or dispenser making an inquiry, which is initiated in good faith, the prescriber or dispenser shall be held harmless from any civil liability.

(k) The Department shall establish, by rule, the process by which to evaluate possible erroneous association of prescriptions to any licensed prescriber or end user of the Illinois Prescription Information Library (PIL).

(l) The Prescription Monitoring Program Advisory Committee is authorized to evaluate the need for and method of establishing a patient specific identifier.

(m) Patients who identify prescriptions attributed to them that were not obtained by them shall be given access to their personal prescription history pursuant to the validation process as set forth by administrative rule.

(n) The Prescription Monitoring Program is authorized to develop operational push reports to entities with compatible electronic medical records. The process shall be covered within administrative rule established by the Department.

(o) Hospital emergency departments and freestanding healthcare facilities providing healthcare to walk-in patients may obtain, for the purpose of improving patient care, a unique identifier for each shift to utilize the PIL system.

(p) The Prescription Monitoring Program shall automatically create a log-in to the inquiry system when a prescriber or dispenser obtains or renews his or her controlled substance license. The Department of Financial and Professional Regulation must provide the Prescription Monitoring Program with electronic access to the license information of a prescriber or dispenser to facilitate the creation of this profile. The Prescription Monitoring Program shall send the prescriber or dispenser information regarding the inquiry system, including instructions on how to log into the system, instructions on how to use the system to promote effective clinical practice, and opportunities for continuing education for the prescribing of controlled substances. The Prescription Monitoring Program shall also send to all enrolled prescribers, dispensers, and designees information regarding the unsolicited reports produced pursuant to Section 314.5 of this Act.

(q) A prescriber or dispenser may authorize a designee to consult the inquiry system established by the Department under this subsection on his or her behalf, provided that all the following conditions are met:

(1) the designee so authorized is employed by the same hospital or health care system; is employed by the same professional practice; or is under contract with such practice, hospital, or health care system;

(2) the prescriber or dispenser takes reasonable steps to ensure that such designee is sufficiently competent in the use of the inquiry system;

(3) the prescriber or dispenser remains responsible for ensuring that access to the inquiry system by the designee is limited to authorized purposes and occurs in a manner that protects the confidentiality of the information obtained from the inquiry system, and remains responsible for any breach of confidentiality; and

(4) the ultimate decision as to whether or not to prescribe or dispense a controlled substance remains with the prescriber or dispenser.

The Prescription Monitoring Program shall send to registered designees information regarding the inquiry system, including instructions on how to log onto the system.

(r) The Prescription Monitoring Program shall maintain an Internet website in conjunction with its prescriber and dispenser inquiry system. This website shall include, at a minimum, the following information:

(1) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other controlled substances as determined by the Advisory Committee;

(2) accredited continuing education programs related to prescribing of controlled substances;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding the prescription of controlled substances; and

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events.

The content of the Internet website shall be periodically reviewed by the Prescription Monitoring Program Advisory Committee as set forth in Section 320 and updated in accordance with the recommendation of the advisory committee.

(s) The Prescription Monitoring Program shall regularly send electronic updates to the registered users of the Program. The Prescription Monitoring Program Advisory Committee shall review any communications sent to registered users and also make recommendations for communications as set forth in Section 320. These updates shall include the following information:

(1) opportunities for accredited continuing education programs related to prescribing of controlled substances;

(2) current clinical guidelines developed by health care professional organizations on the prescribing of opioids or other drugs as determined by the Advisory Committee;

(3) programs or information developed by health care professionals that may be used to assess patients or help ensure compliance with prescriptions;

(4) updates from the Food and Drug Administration, the Centers for Disease Control and Prevention, and other public and private organizations which are relevant to prescribing;

(5) relevant medical studies related to prescribing;

(6) other information regarding prescribing of controlled substances;

(7) information regarding prescription drug disposal events, including take-back programs or other disposal options or events; and

(8) reminders that the Prescription Monitoring Program is a useful clinical tool.

(t) Notwithstanding any other provision of this Act, neither the Prescription Monitoring Program nor any other person shall disclose any information in violation of the restrictions and requirements of paragraph (3.5) of subsection (a) of Section 316 as implemented under Public Act 102-527.

(Source: P.A. 102-751, eff. 1-1-23; 103-881, eff. 1-1-25.)