HB5295eng 104TH GENERAL ASSEMBLY

HB5295 Engrossed LRB104 20300 BDA 34136 b

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Reproductive Health Records Privacy Act.

Section 5. Definitions. As used in this Act:

"Abortion" has the meaning given to that term in Section 1-10 of the Reproductive Health Act.

"Abortion-related health care services" means all supplies, care, and services of a medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventive, rehabilitative, or supportive nature relating to an abortion.

"Electronic health network" means:

(1) an entity that facilitates the electronic exchange of health information by providing software or services that allow health care providers to maintain medical information electronically and make that information available to other authorized persons, providers, or entities; or

(2) a health information technology developer of certified health information technology that develops or offers health information technology, as that term is defined in 42 U.S.C. 300jj(5).

"Health care provider" has the meaning given to that term in the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as specified in 45 CFR 160.103.

"Patient" means any person who has received or is receiving medical care, treatment, or services from an individual or institution licensed to provide medical care or treatment in this State.

"Protected health information" means the following, unless otherwise defined by rule adopted by the Department of Public Health under this Act:

(1) abortion or abortion-related health care services;

(2) any medical diagnosis codes, Current Procedural Terminology (CPT) codes, Healthcare Common Procedure Coding System (HCPCS) codes, or National Drug Codes associated with any of the following:

(A) complications following induced termination of pregnancy;

(B) failed attempted termination of pregnancy;

(C) continuing pregnancy after selective reduction of one fetus or more;

(D) encounter for elective termination of pregnancy;

(E) induced abortion;

(F) multifetal pregnancy reductions;

(G) mifepristone; or

(H) medically induced abortion by oral ingestion of medication, including all associated services and supplies except drugs or medications; and

(3) any medical diagnosis codes associated with gender dysphoria.

Section 10. Segregation of information.

(a) An electronic health network shall prevent the disclosure of electronic medical information related to protected health information to a provider, business entity, electronic health network, or health information exchange located outside this State unless the disclosure is:

(1) for technical support purposes;

(2) for quality assurance purposes;

(3) for billing or the adjudication of claims; or

(4) to a specific treating provider at the request of and with the consent of:

(A) a patient, for services for which the patient can provide consent under State law; or

(B) a parent or guardian of a patient, for services that the parent or guardian can provide consent under State law.

(b) To comply with subsection (a), an electronic health network shall develop and enable the technological capabilities to:

(1) filter and restrict from disclosure electronic medical information related to protected health information;

(2) parse restricted codes and convey all other information in the health record that is not prohibited by law; and

(3) allow a consumer to request and consent to the exchange of protected health information to a specific treating provider.

(c) An electronic health network shall not notify a provider, business entity, electronic health network, or health information exchange located outside this State that electronic medical information related to protected health information may have been segregated from a patient's electronic medical record.

(d) The Department of Public Health may adopt rules as necessary to administer and implement this Act.

(e) Any fees charged to health care providers to comply with this Section shall be consistent with 45 CFR 171.302.

(f) This Section does not apply to a health care provider.

Section 15. Patient direction to share medical information. A patient may direct electronic medical information related to protected health information to be shared in whole or in part with a specific treating provider outside this State through an electronic health network. A patient may also revoke a prior decision to direct electronic medical information related to protected health information to be shared or not to be shared. The patient shall be provided meaningful information by the electronic health network regarding the patient's right to direct the electronic health network to share the patient's electronic medical information related to protected health information. An electronic health network participant shall not condition the provision of its services upon a patient's decision regarding disclosure of the patient's electronic medical information related to protected health information.

Section 20. Violations. Any person aggrieved by a violation of this Act by an electronic health network may bring an action against that electronic health network. Actual damages, injunctive relief, and reasonable attorney's fees and costs, as well as any other relief which the court deems proper, may be awarded to a successful plaintiff in any action under this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect July 1, 2027.