Section 840.30  Availability of Registry Information

a)         All reports issued by the Department that are aggregated or recorded to make it impossible to identify any patient or reporting health care provider or facility, including the annual report, shall be made available to the public pursuant to the Department's Freedom of Information Code and the Freedom of Information Act.

b)         All requests by medical or epidemiologic researchers for confidential Registry data shall be submitted in writing to the Department.  The request shall include a study protocol that contains:  objectives of the research; rationale for the research, including scientific literature justifying the current proposal; overall study methods, including copies of study forms, questionnaires, and consent forms used by researchers to contact facilities, health care providers or study subjects; methods for documenting compliance with 42 CFR 2a.4(a)-(k), 2a.6(a)-(b), and 2a.7(a)-(b)(1); methods for processing data; storage and security measures taken to ensure confidentiality of patient-identifying information; time frame of the study; a description of the funding source of the study (e.g., federal contract); and the curriculum vitae of the principal investigator and collaborators.  In addition, the research request shall include a copy of the current IRB approval from the researcher's institution, signed assurance forms for all parties participating in the project and a completed application for the Department's internal IRB review process.

c)         All requests to conduct research and modifications to approved research proposals involving the use of data that include patient- or facility- identifying information shall be subject to a review by the Department before approval to determine compliance with the following conditions:

1)         The request for patient- or facility-identifying information contains stated goals or objectives.

2)         The request documents the feasibility of the study design in achieving the stated goals and objectives.

3)         The request documents the need for the requested data or interventions to achieve the stated goals and objectives.

4)         The requested data can be provided within the time frame set forth in the request.

5)         The request documents that the researcher has qualifications relevant to the type of research being conducted.

6)         The request includes conditions relevant to the patient's confidentiality rights and the need for the patient- or facility- identifying information.  The Department will release only the patient- or facility-identifying information that is necessary for the research.

7)         Appropriate exemptions, IRB approvals and waivers have been obtained.

8)         The request documents the researcher's commitment to provide updated status reports.

d)         Research Agreements

1)         The Department will enter into research agreements for all approved research requests.  The agreement shall specify the exact information that is being released and how it can be used in accordance with the conditions in subsection (c).  In addition, the researcher shall include an assurance that:

A)        Use of data is restricted to the specifications of the protocol;

B)        Any data that may lead to the identity of any patient, research subject, health care provider, other person or facility are strictly privileged and confidential.  The researcher shall agree to keep this data strictly confidential at all times;

C)        All officers, agents and employees will keep all data strictly confidential; will communicate the requirements of this Section to all officers, agents and employees; will discipline all persons who may violate the requirements of this Section; and will notify the Department in writing within 48 hours after any violation of this Section becomes known to the researcher or officers, agents and employees of the institution, including full details of the violation and corrective actions to be taken;

D)        All data provided by the Department pursuant to the agreement shall be used only for the purposes named in the agreement, and any other or additional use of the data will result in immediate termination of the agreement by the Department and the violation will be reported to federal authorities if HIPAA is applicable;

E)        All data provided by the Department pursuant to the agreement are the sole property of the Department and shall not be copied, reproduced or re-released in any form or manner.  If required by the Department, the researcher shall agree to return all data and all copies and reproductions of the data to the Department upon termination of the agreement.

2)         Any departures from the approved protocol shall be submitted in writing and approved by the Department in accordance with subsection (c) prior to initiation.  A researcher shall not release any patient- or facility-identifying information to a third party.

e)         The Department will disclose individual patient- or facility- information to the reporting facility that originally supplied that information to the Department, upon written request of the facility.

f)         The Department, by signed and reciprocating agreement, will disclose individual patient information concerning residents of another state to the registry in the individual's state of residence only if the recipient of the information is legally required to hold the information in confidence and provides protection from disclosure of patient-identifying information equivalent to the protection afforded by the Illinois law.

g)         The patient-identifying information submitted to the Department by those entities required to submit information under the Act and this Part will be used in the course of medical study under Article 8 Part 21 of the Code of Civil Procedure. Therefore, this information is privileged from disclosure by Article 8 Part 21 of the Code of Civil Procedure.

h)         The identity, or any group of facts that tends to lead to the identity, of any facility or of any person whose condition or treatment is submitted to the Illinois Health and Hazardous Substances Registry, or the parent or guardian of any individual, is confidential and shall not be open to public inspection or dissemination and is exempt from disclosure under Section 7 of the Freedom of Information Act.  The following data elements, alone or in combination, are confidential, shall not be open to public inspection or dissemination, and  are exempt from disclosure under Section 7 of the Freedom of Information Act:  name, social security number, street address, email address, telephone number, fax number, medical record number, certificate/license number, reporting source (unless permitted by the reporting facility), age (unless aggregated for 5 or more years), ZIP code (unless aggregated for 5 or more years), and diagnosis date (unless aggregated for one or more years for the entire State or for 3 or more years for a single county).  Data defined by geographic areas that are smaller than ZIP code, such as census tract or census block groups, are considered confidential, and the information shall not be available for disclosure, inspection or copying under the Freedom of Information Act or the State Records Act.  Information for specific research purposes may be released in accordance with procedures established by the Department in this Section.  (Section 4(d) of the Act)

i)          Hospitals, laboratories, other facilities or physicians shall not be held liable for the release of information or confidential data in accordance with the Act.  The Department shall protect any information made confidential or privileged under law.  (Section 4(e) of the Act)

j)          Every reporting facility shall provide the Department or entities authorized to represent the Department with access to information from all medical, pathological, and other pertinent records and logs related to reportable Registry information in order for the Department to conduct rapid case ascertainment; death certificate clearance; patient follow-up; or any other review that is required to ensure data completeness, quality, and timeliness.  The mode of access and the time during which this access will be provided shall be by mutual agreement between the facility and the Department (see Section 10 of the Act).

k)         Every reporting facility shall provide access to diagnostic, treatment, follow-up and survival information for patients with specific medical conditions identified through Department-approved research studies involving rapid case ascertainment.  The mode of access and the time during which this access will be provided shall be by mutual agreement between the facility and the Department (see Section 10 of the Act).

l)          The Department will release individual patient or facility APORS information obtained from each Regional Perinatal Network facility to the Regional Perinatal Network's Administrative Perinatal Center, upon written request of that Administrative Perinatal Center's Clinical Director.  The patient-and facility-identifying information released to the Perinatal Center by the Department as required under this Part shall be used in the course of medical study under Article 8 Part 21 of the Code of Civil Procedure and is privileged from further disclosure.  The Administrative Perinatal Center's request for APORS data shall clearly indicate the purpose for which the data will be used.  The Department will release data only for internal quality control or medical study for the purpose of reducing morbidity or mortality, or for improving patient care.  The Department will provide a copy of the original request and the data that are released to the hospital that originally reported the data.

m)        The Department will release APORS summary and statistical reports containing information that identifies individual patients or individual hospitals to the hospital that reported the patient, to the Administrative Perinatal Center with which the hospital is affiliated, and to the local health agency designated by the Illinois Department of Human Services to provide follow-up services to patients. The reports may contain information provided by the referring hospital and information provided by the follow-up agency.  Data provided under this Section that are specific to the patient and reporting facility are confidential and shall not be otherwise disclosed.

n)         The Department will release ODR data for fatal and non-fatal occupational injuries in aggregate form, with a minimum of three incidents, that have been approved by the United States Department of Labor's Bureau of Labor Statistics (BLS).  Data provided under this subsection that are specific to a patient or employer are confidential and shall not be disclosed unless requested by BLS.  ODR will release an annual report that will include the aggregate data collected for that year on the Department's website.

(Source:  Amended at 46 Ill. Reg. 2971, effective February 1, 2022)