HB5295 104TH GENERAL ASSEMBLY

LRB104 20300 BDA 34136 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB5295

Introduced 2/10/2026, by Rep. Mary Beth Canty

SYNOPSIS AS INTRODUCED:

New Act
410 ILCS 50/3	from Ch. 111 1/2, par. 5403

Creates the Reproductive Health Records Privacy Act. Requires health information exchanges to implement policies and technical capabilities by July 1, 2027, to segregate medical information related to abortion care, restrict access by out-of-state entities, and limit disclosure. Provides enforcement through private actions and civil actions by the Attorney General, including injunctive relief and civil penalties. Defines terms. Amends the Medical Patient Rights Act to clarify patient privacy rights and allow segregation of abortion-related information in health information exchanges. Provides for severability.

A BILL FOR

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Reproductive Health Records Privacy Act.

Section 5. Definitions. As used in this Act:

"Abortion" has the meaning given to that term in Section 1-10 of the Reproductive Health Act.

"Health care provider" has the meaning given to that term in the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as specified in 45 CFR 160.103.

"Health information exchange" means an entity that facilitates the electronic exchange of health information by operating a health information exchange or by providing software or services that allow health care providers to maintain medical information electronically and make that information available to other authorized persons or providers for purposes of diagnosis, treatment, or care management.

"Patient" means any person who has received or is receiving medical care, treatment or services from an individual or institution licensed to provide medical care or treatment in this State.

Section 10. Segregation of information.

(a) By July 1, 2027, a health information exchange shall develop capabilities, policies, and procedures to enable and shall enable features to do the following:

(1) limit user access privileges to information systems that contain medical information related to the provision of abortion care;

(2) prevent the disclosure, access, transfer, transmission, or processing of medical information related to the provision of abortion care to persons and entities outside of the State;

(3) segregate medical information related to the provision of abortion care from the rest of the patient's record; and

(4) provide the ability to automatically disable access to segregated medical information related to the provision of abortion care by individuals and entities outside of the State.

(b) Any fees charged to health care providers to comply with this Section shall be consistent with 45 CFR 171.302.

(c) This Section does not apply to a health care provider.

Section 15. Violations.

(a) Any person aggrieved by a violation of this Act may sue for damages, an injunction, or other appropriate relief. Reasonable attorney's fees and costs may be awarded to the successful plaintiff in any action under this Act.

(b) The Attorney General may bring a civil action for injunctive or other equitable relief to enforce this Section. In an action brought by the Attorney General under this Section, the court may also award a civil penalty not exceeding $50,000, taking into consideration:

(1) whether the defendant has made a good faith attempt to comply;

(2) the harm to patients;

(3) the number of violations and magnitude of the violation;

(4) the length of time over which the violations occurred; and

(5) the defendant's assets, liabilities, and net worth.

Section 80. The Medical Patient Rights Act is amended by changing Section 3 as follows:

(410 ILCS 50/3) (from Ch. 111 1/2, par. 5403)

Sec. 3. The following rights are hereby established:

(a) The right of each patient to care consistent with sound nursing and medical practices, to be informed of the name of the physician responsible for coordinating his or her care, to receive information concerning his or her condition and proposed treatment, to refuse any treatment to the extent permitted by law, and to privacy and confidentiality of records except as otherwise provided by law.

(b) The right of each patient, regardless of source of payment, to examine and receive a reasonable explanation of his total bill for services rendered by his physician or health care provider, including the itemized charges for specific services received. Each physician or health care provider shall be responsible only for a reasonable explanation of those specific services provided by such physician or health care provider.

(c) In the event an insurance company or health services corporation cancels or refuses to renew an individual policy or plan, the insured patient shall be entitled to timely, prior notice of the termination of such policy or plan.

An insurance company or health services corporation that requires any insured patient or applicant for new or continued insurance or coverage to be tested for infection with human immunodeficiency virus (HIV) or any other identified causative agent of acquired immunodeficiency syndrome (AIDS) shall (1) give the patient or applicant prior written notice of such requirement, (2) proceed with such testing only upon the written authorization of the applicant or patient, and (3) keep the results of such testing confidential. Notice of an adverse underwriting or coverage decision may be given to any appropriately interested party, but the insurer may only disclose the test result itself to a physician designated by the applicant or patient, and any such disclosure shall be in a manner that assures confidentiality.

The Department of Insurance shall enforce the provisions of this subsection.

(d) The right of each patient to privacy and confidentiality in health care. Each physician, health care provider, health services corporation and insurance company shall refrain from disclosing the nature or details of services provided to patients, except that such information may be disclosed: (1) to the patient, (2) to the party making treatment decisions if the patient is incapable of making decisions regarding the health services provided, (3) for treatment in accordance with 45 CFR 164.501 and 164.506, (4) for payment in accordance with 45 CFR 164.501 and 164.506, (5) to those parties responsible for peer review, utilization review, and quality assurance, (6) for health care operations in accordance with 45 CFR 164.501 and 164.506, (7) to those parties required to be notified under the Abused and Neglected Child Reporting Act or the Illinois Sexually Transmitted Infection Control Act, or (8) as otherwise permitted, authorized, or required by State or federal law. This right may be waived in writing by the patient or the patient's guardian or legal representative, but a physician or other health care provider may not condition the provision of services on the patient's, guardian's, or legal representative's agreement to sign such a waiver. In the interest of public health, safety, and welfare, patient information, including, but not limited to, health information, demographic information, and information about the services provided to patients, may be transmitted to or through a health information exchange, as that term is defined in Section 2 of the Mental Health and Developmental Disabilities Confidentiality Act, in accordance with the disclosures permitted pursuant to this Section. Patients shall be provided the opportunity to opt out of their health information being transmitted to or through a health information exchange in accordance with Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, Section 9.6 of the AIDS Confidentiality Act, or Section 31.8 of the Genetic Information Privacy Act, as applicable. Medical information related to the provision of abortion care in a health information exchange may be segregated and access to such information may be limited in accordance with the Reproductive Health Records Privacy Act. In the case of a patient choosing to opt out of having his or her information available on an HIE, nothing in this Act shall cause the physician or health care provider to be liable for the release of a patient's health information by other entities that may possess such information, including, but not limited to, other health professionals, providers, laboratories, pharmacies, hospitals, ambulatory surgical centers, and nursing homes.

(Source: P.A. 103-508, eff. 8-4-23; 103-1049, eff. 8-9-24.)

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.