093_HB2182

                                     LRB093 02057 LCB 11136 b

 1        AN ACT in relation to health.

 2        Be it enacted by the People of  the  State  of  Illinois,
 3    represented in the General Assembly:

 4        Section  1.  Short  title.  This  Act may be cited as the
 5    Medical Information Confidentiality Act.

 6        Section 5.  Definitions. In this Act:
 7        "Authorization" means permission  granted  in  accordance
 8    with   Section  40  or  70  for  the  disclosure  of  medical
 9    information.
10        "Authorized recipient" means any person who is authorized
11    to  receive  medical  information  pursuant  to  Sections  10
12    through 30 or Section 65.
13        "Contractor" means any person or entity that is a medical
14    group,  independent  practice   association,   pharmaceutical
15    benefits  manager, or medical service organization and is not
16    a health care service plan or health care provider.
17        "Enrollee" means a person who is  enrolled  in  a  health
18    care service plan and who is a recipient of services from the
19    plan.
20        "Health  care  provider" means a (i) licensed health care
21    professional, (ii) a person licensed or certified  under  the
22    Emergency  Medical Services (EMS) Systems Act, (iii) a tissue
23    bank as defined in the Hospital  Licensing  Act,  or  (iv)  a
24    facility or entity licensed under the Alternative Health Care
25    Delivery  Act,  the Ambulatory Surgical Treatment Center Act,
26    the Assisted Living and  Shared  Housing  Act,  the  Illinois
27    Clinical  Laboratory and Blood Bank Act, the Community Living
28    Facilities Licensing Act, the Life Care Facilities  Act,  the
29    Nursing  Home Care Act, the Home Health Agency Licensing Act,
30    the Hospice Program Licensing Act, the Supportive  Residences
31    Licensing    Act,    the    Hospital   Licensing   Act,   the
 
                            -2-      LRB093 02057 LCB 11136 b
 1    Community-Integrated  Living   Arrangements   Licensure   and
 2    Certification  Act,  or  the  Child Care Act of 1969. "Health
 3    care provider" does  not  include  a  company  authorized  to
 4    transact business under the Illinois Insurance Code.
 5        "Health care service plan" means either of the following:
 6             (1)  Any  person  who  undertakes to arrange for the
 7        provision of  health  care  services  to  subscribers  or
 8        enrollees,  or to pay for or to reimburse any part of the
 9        cost for those services,  in  return  for  a  prepaid  or
10        periodic  charge  paid by or on behalf of the subscribers
11        or enrollees.
12             (2)  Any person, whether located within  or  outside
13        this  State,  who solicits or contracts with a subscriber
14        or enrollee in this State to pay  for  or  reimburse  any
15        part  of  the  cost  of,  or who undertakes to arrange or
16        arranges for, the provision of health care services  that
17        are to be provided wholly or in part in a foreign country
18        in  return for a prepaid or periodic charge paid by or on
19        behalf of the subscriber or enrollee.
20        "Health care service plan" includes any entity  regulated
21    under  the  Dental  Service  Plan Act, the Health Maintenance
22    Organization Act, the  Limited  Health  Service  Organization
23    Act, or the Voluntary Health Services Plans Act.
24        "Licensed  health  care  professional"  means  any person
25    licensed or certified under the Acupuncture Practice Act, the
26    Clinical Psychologist Licensing Act, the Clinical Social Work
27    and Social Work Practice Act, the  Illinois  Dental  Practice
28    Act,  the  Dietetic  and Nutrition Services Practice Act, the
29    Hearing Instrument Consumer Protection Act, the Marriage  and
30    Family  Therapy  Licensing  Act,  the Medical Practice Act of
31    1987, the Naprapathic Practice Act, the Nursing and  Advanced
32    Practice  Nursing  Act,  the  Illinois  Occupational  Therapy
33    Practice  Act,  the Illinois Optometric Practice Act of 1987,
34    the Pharmacy Practice Act  of  1987,  the  Illinois  Physical
 
                            -3-      LRB093 02057 LCB 11136 b
 1    Therapy  Act,  the  Physician Assistant Practice Act of 1987,
 2    the Podiatric Medical Practice Act of 1987,  the  Respiratory
 3    Care  Practice  Act,  the Professional Counselor and Clinical
 4    Professional   Counselor   Licensing   Act,   the    Illinois
 5    Speech-Language  Pathology  and  Audiology  Practice Act, the
 6    Veterinary Medicine and Surgery Practice Act of 1994, and the
 7    Perfusionist Practice Act.
 8        "Medical information" means any individually identifiable
 9    information, in electronic or physical form, in possession of
10    or derived from a health care provider, health  care  service
11    plan,  or  contractor  regarding a patient's medical history,
12    mental or physical  condition,  or  treatment.  "Individually
13    identifiable"  means that the medical information includes or
14    contains any  element  of  personal  identifying  information
15    sufficient to allow identification of the individual, such as
16    the   patient's   name,  address,  electronic  mail  address,
17    telephone  number,  or  social  security  number,  or   other
18    information that, alone or in combination with other publicly
19    available information, reveals the individual's identity.
20        "Patient"  means any natural person, whether or not still
21    living, who  has  received  or  is  receiving  medical  care,
22    treatment,  or  services  from  a health care provider and to
23    whom medical information pertains.
24        "Subscriber" means the  person  who  is  responsible  for
25    payment  to a health care service plan or whose employment or
26    other status, except for family dependency, is the basis  for
27    eligibility for membership in the plan.

28        Section   10.  No   disclosure   of  information  without
29    authorization. A health care provider,  health  care  service
30    plan,  or  contractor  may  not  disclose medical information
31    regarding a  patient  of  the  health  care  provider  or  an
32    enrollee  or subscriber of a health care service plan without
33    first obtaining  an  authorization,  except  as  provided  in
 
                            -4-      LRB093 02057 LCB 11136 b
 1    Section 15 or 20.

 2        Section   15.  Compelled   disclosure.   A   health  care
 3    provider,  health  care  service  plan,  or  contractor  must
 4    disclose medical information if the disclosure  is  compelled
 5    under any of the following circumstances:
 6             (1)  Disclosure  is compelled by a court pursuant to
 7        an order of that court.
 8             (2)  Disclosure is compelled by a board, commission,
 9        or administrative agency  for  purposes  of  adjudication
10        pursuant to its lawful authority.
11             (3)  Disclosure   is  compelled  by  a  party  to  a
12        proceeding  before  a  court  or  administrative   agency
13        pursuant  to  a  subpoena  or  subpoena duces tecum or in
14        accordance with any provision authorizing discovery in  a
15        proceeding before a court or administrative agency.
16             (4)  Disclosure  is  compelled  by  an arbitrator or
17        arbitration panel, when arbitration is lawfully requested
18        by either party, pursuant to a subpoena duces tecum or in
19        accordance with any other provision authorizing discovery
20        in a  proceeding  before  an  arbitrator  or  arbitration
21        panel.
22             (5)  Disclosure  is  compelled  by  a search warrant
23        lawfully issued to a governmental law enforcement agency.
24             (6)  Disclosure is compelled by the patient  or  the
25        patient's representative pursuant to law.
26             (7)  When otherwise specifically required by law.

27        Section 20.  Permitted disclosure.
28        (a)  A health care provider or a health care service plan
29    may disclose medical information as provided in this Section.
30        (b)  A  health  care provider or health care service plan
31    may disclose medical information to  health  care  providers,
32    health  care service plans, contractors, or other health care
 
                            -5-      LRB093 02057 LCB 11136 b
 1    professionals or facilities  for  purposes  of  diagnosis  or
 2    treatment  of  the  patient.  This  includes, in an emergency
 3    situation, the communication of patient information by  radio
 4    transmission   or   other  means  between  emergency  medical
 5    personnel at the scene of an emergency, or  in  an  emergency
 6    medical transport vehicle, and emergency medical personnel at
 7    a health facility licensed in this State.
 8        (c)  A  health  care provider or health care service plan
 9    may disclose medical information  to  an  insurer,  employer,
10    health  care  service  plan,  hospital service plan, employee
11    benefit plan,  governmental  authority,  contractor,  or  any
12    other person or entity responsible for paying for health care
13    services  rendered to the patient, to the extent necessary to
14    allow responsibility for payment to be determined and payment
15    to be made. If (i) the patient is, by reason of a comatose or
16    other disabling medical condition, unable to consent  to  the
17    disclosure   of   medical   information  and  (ii)  no  other
18    arrangements have been  made  to  pay  for  the  health  care
19    services  being  rendered to the patient, the information may
20    be disclosed  to  a  governmental  authority  to  the  extent
21    necessary  to determine the patient's eligibility for, and to
22    obtain, payment under a governmental program for health  care
23    services provided to the patient. The information may also be
24    disclosed  to  another  health  care  provider or health care
25    service plan as necessary to assist  the  other  provider  or
26    plan  in  obtaining payment for health care services rendered
27    by that health care provider or health care service  plan  to
28    the patient.
29        (d)  A  health  care provider or health care service plan
30    may disclose medical information to any person or entity that
31    provides billing, claims management, medical data processing,
32    or other administrative services for health care providers or
33    health care service plans  or  for  any  of  the  persons  or
34    entities  specified  in  subsection  (c).  No  information so
 
                            -6-      LRB093 02057 LCB 11136 b
 1    disclosed may be further disclosed by the  recipient  in  any
 2    way that would violate this Act.
 3        (e)  A  health  care provider or health care service plan
 4    may disclose medical information to organized committees  and
 5    agents  of  professional  societies  or  of medical staffs of
 6    licensed  hospitals,  licensed  health  care  service  plans,
 7    professional  standards  review  organizations,   independent
 8    medical  review  organizations  and their selected reviewers,
 9    utilization and quality control peer review organizations  as
10    established by Congress in Public Law 97-248, contractors, or
11    persons   or  organizations  insuring,  responsible  for,  or
12    defending professional liability that a provider  may  incur,
13    if   the  committees,  agents,  health  care  service  plans,
14    organizations, reviewers, contractors, or persons are engaged
15    in reviewing the competence or qualifications of health  care
16    professionals  or  in  reviewing  health  care  services with
17    respect to medical necessity, level of care, quality of care,
18    or justification of charges.
19        (f)  The information in the possession of any health care
20    provider or health care service plan may be reviewed  by  any
21    private   or   public   body  responsible  for  licensing  or
22    accrediting the provider  or  plan.  No  patient  identifying
23    medical   information  may  be  removed  from  the  premises,
24    however, except as expressly permitted or required  elsewhere
25    by  law,  nor  shall that information be further disclosed by
26    the recipient in any way that would violate this Act.
27        (g)  A health care provider or health care  service  plan
28    may disclose medical information to the county coroner in the
29    course of an investigation by the coroner's office.
30        (h)  A  health  care provider or health care service plan
31    may disclose medical information to public agencies, clinical
32    investigators,     including     investigators     conducting
33    epidemiologic studies, health  care  research  organizations,
34    and  accredited  public  or  private nonprofit educational or
 
                            -7-      LRB093 02057 LCB 11136 b
 1    health care institutions for bona fide research purposes, but
 2    only with the patient's express authorization as provided  in
 3    Section  40.  No  information disclosed under this subsection
 4    may be further disclosed by the recipient  in  any  way  that
 5    would  disclose  the  identity of any patient or violate this
 6    Act.
 7        (i)  A health care provider or health care  service  plan
 8    that   has   created  medical  information  as  a  result  of
 9    employment-related  health  care  services  to  an   employee
10    conducted  at  the specific prior written request and expense
11    of the employer may disclose to the employee's employer  that
12    part of the information that:
13             (1)  is   relevant   in   a   lawsuit,  arbitration,
14        grievance, or other  claim  or  challenge  to  which  the
15        employer  and  the  employee are parties and in which the
16        patient has placed in issue his or her  medical  history,
17        mental or physical condition, or treatment, provided that
18        information  may  only be used or disclosed in connection
19        with that proceeding; and
20             (2)  describes functional limitations of the patient
21        that may entitle the  patient  to  leave  from  work  for
22        medical reasons or limit the patient's fitness to perform
23        his or her present employment, provided that no statement
24        of   medical   cause   is  included  in  the  information
25        disclosed.
26        (j)  Unless the  health  care  provider  or  health  care
27    service  plan  is  notified in writing of an agreement by the
28    sponsor, insurer, or administrator to the contrary, a  health
29    care  provider  or  health  care  service  plan  may disclose
30    medical information to a sponsor, insurer,  or  administrator
31    of  a group or individual insured or uninsured plan or policy
32    that the patient seeks coverage by or benefits from,  if  the
33    information was created by the health care provider or health
34    care  service plan as the result of services conducted at the
 
                            -8-      LRB093 02057 LCB 11136 b
 1    specific prior written request and expense  of  the  sponsor,
 2    insurer,  or  administrator for the purpose of evaluating the
 3    application for coverage or benefits.
 4        (k)  The information may be disclosed to  a  health  care
 5    service  plan by health care providers that contract with the
 6    health care service  plan  and  may  be  transferred  between
 7    health  care  providers  that  contract  with the health care
 8    service plan, for the purpose  of  administering  the  health
 9    care  service  plan. Medical information may not otherwise be
10    disclosed by a health care service plan except in  accordance
11    with this Act.
12        (l)  Nothing  in  this  Act  prevents  the  disclosure of
13    medical information by a health care provider or health  care
14    service  plan  to  an  insurer,  agent,  or insurance-support
15    organization if  the  insurer,  agent,  or  insurance-support
16    organization   has   complied   with   all  requirements  for
17    obtaining the information as provided by  State  and  federal
18    law.
19        (m)  A  health  care provider or health care service plan
20    may disclose medical information relevant  to  the  patient's
21    condition   and   care  and  treatment  to  a  probate  court
22    investigator engaged in determining the need for  an  initial
23    conservatorship    or    continuation    of    an    existent
24    conservatorship,  if  the  patient is unable to give informed
25    consent,  or  to  a  probate  court  investigator,  probation
26    officer,  or  domestic  relations  investigator  engaged   in
27    determining   the   need   for  an  initial  guardianship  or
28    continuation of an existent guardianship.
29        (n)  A health care provider or health care  service  plan
30    may  disclose  medical  information  to  an organ procurement
31    organization or a tissue bank  processing  the  tissue  of  a
32    decedent for transplantation into the body of another person,
33    but  only  with  respect  to  the  donating decedent, for the
34    purpose of aiding the transplant. For  the  purpose  of  this
 
                            -9-      LRB093 02057 LCB 11136 b
 1    subsection,  the  terms  "tissue  bank" and "tissue" have the
 2    same meaning as defined in the Hospital Licensing Act.
 3        (o)  A health care provider or health care  service  plan
 4    may  disclose  basic  information  contained  in  a patient's
 5    medical information, including the patient's  name,  city  of
 6    residence,  age,  sex,  and  general condition, to a State or
 7    federally recognized disaster  relief  organization  for  the
 8    purpose of responding to disaster welfare inquiries.
 9        (p)  A  health  care provider or health care service plan
10    may  disclose  medical  information  to  a  third  party  for
11    purposes of encoding, encrypting,  or  otherwise  anonymizing
12    data. No information so disclosed may be further disclosed by
13    the  recipient  in  any  way  that  would  violate  this Act,
14    however, including the unauthorized manipulation of coded  or
15    encrypted   medical  information  that  reveals  individually
16    identifiable medical information.

17        Section 25.  No disclosure unless  necessary  to  provide
18    health   care   services.  Except  to  the  extent  expressly
19    authorized by the patient or enrollee  or  subscriber  or  as
20    provided  by Section 15 or 20, a health care provider, health
21    care  service  plan,  contractor,  or  corporation  and   its
22    subsidiaries  and  affiliates  may  not  intentionally share,
23    sell, or  otherwise  use  any  medical  information  for  any
24    purpose  not necessary to provide health care services to the
25    patient.

26        Section 30.  Further disclosure by contractor restricted.
27    Except to the extent expressly authorized by the  patient  or
28    enrollee  or subscriber or as provided by Section 15 or 20, a
29    contractor or corporation and its subsidiaries and affiliates
30    may not further  disclose  medical  information  regarding  a
31    patient   of  a  health  care  provider  or  an  enrollee  or
32    subscriber of a  health  care  service  plan  or  insurer  or
 
                            -10-     LRB093 02057 LCB 11136 b
 1    self-insured  employer  received under Section 10, 15, 20, or
 2    25 to any person or entity that is not engaged  in  providing
 3    direct  health  care  services  to  the patient or his or her
 4    health care provider or health care service plan  or  insurer
 5    or self-insured employer.

 6        Section  35.  Disposal  of  medical records. Every health
 7    care provider, health care service plan,  or  contractor  who
 8    creates, maintains, preserves, stores, abandons, destroys, or
 9    disposes  of  medical  records  must  do  so in a manner that
10    preserves the confidentiality of the information contained in
11    those records. A health care provider,  health  care  service
12    plan,  or  contractor  who  negligently  creates,  maintains,
13    preserves, stores, abandons, destroys, or disposes of medical
14    records  is  subject  to  the remedies and penalties provided
15    under Sections 135 and 140.

16        Section 40.  Authorization for release of information.
17        (a)  A person or entity that  wishes  to  obtain  medical
18    information  under  Section 10, other than a person or entity
19    authorized to receive medical information under Section 15 or
20    20, must obtain a valid authorization for the release of  the
21    information.
22        (b)  An   authorization   for   the  release  of  medical
23    information by a health care provider,  health  care  service
24    plan,  or  contractor  is  valid  if  it satisfies all of the
25    following criteria:
26             (1)  The authorization is handwritten by the  person
27        who  signs  it  or is in typeface no smaller than 8-point
28        type.
29             (2)  The authorization is clearly separate from  any
30        other  language  present on the same page and is executed
31        by a signature that  serves  no  other  purpose  than  to
32        execute the authorization.
 
                            -11-     LRB093 02057 LCB 11136 b
 1             (3)  The authorization is signed and dated by one of
 2        the following:
 3                  (A)  The  patient. A patient who is a minor may
 4             sign  an  authorization  only  for  the  release  of
 5             medical  information  obtained  by  a  health   care
 6             provider, health care service plan, or contractor in
 7             the course of furnishing services to which the minor
 8             could  lawfully have consented under the law of this
 9             State.
10                  (B)  The legal representative of  the  patient,
11             if  the  patient  is  a  minor  or  an  incompetent.
12             Authorization may not be given under this paragraph,
13             however,  for  the disclosure of medical information
14             obtained by the health care provider, a health  care
15             service  plan,  or  a  contractor  in  the course of
16             furnishing services to which a minor  patient  could
17             lawfully have consented under the law of this State.
18                  (C)  The  spouse  of  the patient or the person
19             financially responsible for the patient, if (i)  the
20             medical  information  is  being  sought for the sole
21             purpose of  processing  an  application  for  health
22             insurance  or for enrollment in a nonprofit hospital
23             plan, a health care service  plan,  or  an  employee
24             benefit  plan  and  (ii)  the  patient  is  to be an
25             enrolled spouse or dependent  under  the  policy  or
26             plan.
27                  (D)  The beneficiary or personal representative
28             of a deceased patient.
29             (4)  The  authorization  states  the limitations, if
30        any, on the types of medical information to be disclosed.
31             (5)  The authorization states the name or  functions
32        of the health care provider, health care service plan, or
33        contractor that may disclose the medical information.
34             (6)  The  authorization states the name or functions
 
                            -12-     LRB093 02057 LCB 11136 b
 1        of the persons or  entities  authorized  to  receive  the
 2        medical information.
 3             (7)  The  authorization states the specific uses and
 4        limitations on the use of the medical information by  the
 5        persons  or  entities  authorized  to receive the medical
 6        information.
 7             (8)  The authorization states a specific date  after
 8        which  the  provider  of health care, health care service
 9        plan, or contractor is no longer authorized  to  disclose
10        the medical information.
11             (9)  The  authorization  advises  the person signing
12        the authorization of the right to receive a copy  of  the
13        authorization.

14        Section   45.  Furnishing  copy  of  authorization.  Upon
15    demand  by  the  patient  or  the  person   who   signed   an
16    authorization,  a  health  care provider, health care service
17    plan, or contractor possessing the authorization must furnish
18    a true copy of the authorization.

19        Section 50.  Further disclosure upon new authorization. A
20    recipient of medical information pursuant to an authorization
21    as provided by Section 20 or otherwise according to this  Act
22    may  not  further disclose that medical information except in
23    accordance  with  a  new   authorization   that   meets   the
24    requirements  of  Section  40  or as specifically required or
25    permitted by other provisions of this Act or by law.

26        Section 55.  Limitations in authorization to disclose.  A
27    health care provider, health care service plan, or contractor
28    that   discloses   medical   information   pursuant   to   an
29    authorization  required  by  this Act must communicate to the
30    person  or  entity  to  which  it   discloses   the   medical
31    information  any  limitations  in the authorization regarding
 
                            -13-     LRB093 02057 LCB 11136 b
 1    the use of the medical information. A health  care  provider,
 2    health care service plan, or contractor that has attempted in
 3    good  faith to comply with this Section is not liable for any
 4    unauthorized use of the medical information by the person  or
 5    entity  to  which the provider, plan, or contractor disclosed
 6    the medical information.

 7        Section 60.  Canceling  or  modifying  an  authorization.
 8    Nothing  in  this  Act shall be construed to prevent a person
 9    who could sign an authorization under subdivision  (b)(3)  of
10    Section  40 from canceling or modifying an authorization. The
11    cancellation or  modification  is  effective,  however,  only
12    after  the health care provider, health care service plan, or
13    contractor  actually   receives   written   notice   of   the
14    cancellation or modification.

15        Section 65.  Employers.
16        (a)  Each  employer who receives medical information must
17    establish    appropriate    procedures    to    ensure    the
18    confidentiality and  protection  from  unauthorized  use  and
19    disclosure of that information. These procedures may include,
20    but  are  not  limited  to,  (i) instruction of employees and
21    agents  handling   files   containing   medical   information
22    regarding   confidentiality   and   (ii)   security   systems
23    restricting access to files containing medical information.
24        (b)  An  employee  may  not  be  discriminated against in
25    terms or conditions of  employment  due  to  that  employee's
26    refusal  to  sign an authorization under this Act. Nothing in
27    this Section, however,  prohibits  an  employer  from  taking
28    action   that   is   necessary  in  the  absence  of  medical
29    information  due  to  an  employee's  refusal  to   sign   an
30    authorization under this Act.
31        (c)  An  employer  may  not use or disclose, or knowingly
32    permit its employees or agents to use  or  disclose,  medical
 
                            -14-     LRB093 02057 LCB 11136 b
 1    information  that  the  employer  possesses pertaining to its
 2    employees  without  the  patient  having  first   signed   an
 3    authorization  under Section 40 or Section 70 permitting that
 4    use or disclosure, except as follows:
 5             (1)  The  information  may  be  disclosed   if   the
 6        disclosure  is  compelled  by  judicial or administrative
 7        process or by any other specific provision of law.
 8             (2)  That part of the information that  is  relevant
 9        in  a  lawsuit, arbitration, grievance, or other claim or
10        challenge to which the employer and employee are  parties
11        and  in  which the patient has placed in issue his or her
12        medical  history,  mental  or  physical   condition,   or
13        treatment  may  be  used  or disclosed in connection with
14        that proceeding.
15             (3)  The  information  may  be  used  only  for  the
16        purpose of administering and maintaining employee benefit
17        plans, including health care plans  and  plans  providing
18        short-term  and  long-term  disability income or workers'
19        compensation and for determining eligibility for paid and
20        unpaid leave from work for medical reasons.
21             (4)  The information may be disclosed  to  a  health
22        care  provider  or  other  health  care  professional  or
23        facility  to  aid  the  diagnosis  or  treatment  of  the
24        patient,  if  the  patient  or  other person specified in
25        paragraph (3) of Section 70 is unable  to  authorize  the
26        disclosure.
27        (d)  If an employer agrees in writing with one or more of
28    its  employees  or  maintains  a written policy that provides
29    that particular types of medical information may not be  used
30    or disclosed by the employer in particular ways, the employer
31    must  obtain  an  authorization for those uses or disclosures
32    even if an authorization  would  not  otherwise  be  required
33    under subsection (c).
 
                            -15-     LRB093 02057 LCB 11136 b
 1        Section   70.  Authorization  for  employer  to  disclose
 2    information. An authorization for  an  employer  to  disclose
 3    medical  information  is  valid  if  it  satisfies all of the
 4    following criteria:
 5             (1)  The authorization is handwritten by the  person
 6        who  signs  it  or is in typeface no smaller than 8-point
 7        type.
 8             (2)  The authorization is clearly separate from  any
 9        other  language  present on the same page and is executed
10        by a signature that  serves  no  purpose  other  than  to
11        execute the authorization.
12             (3)  The authorization is signed and dated by one of
13        the following:
14                  (A)  The  patient, except that a patient who is
15             a minor may  sign  an  authorization  only  for  the
16             disclosure  of  medical  information  obtained  by a
17             health care provider in  the  course  of  furnishing
18             services  to  which  the  minor  could lawfully have
19             consented under the law of this State.
20                  (B)  The legal representative of  the  patient,
21             if   the   patient   is   a  minor  or  incompetent.
22             Authorization may not be given under this  paragraph
23             (B)  for  the disclosure of medical information that
24             pertains to a competent minor and that  was  created
25             by  a  provider  of  health  care  in  the course of
26             furnishing services to which a minor  patient  could
27             lawfully have consented under the law of this State.
28                  (C)  The beneficiary or personal representative
29             of a deceased patient.
30             (4)  The  authorization  states  the limitations, if
31        any, on the types of medical information to be disclosed.
32             (5)  The authorization states the name or  functions
33        of  the  employer  or  person  authorized to disclose the
34        medical information.
 
                            -16-     LRB093 02057 LCB 11136 b
 1             (6)  The authorization states the names or functions
 2        of the persons or  entities  authorized  to  receive  the
 3        medical information.
 4             (7)  The  authorization  states  the limitations, if
 5        any, on the use of the medical information by the persons
 6        or   entities   authorized   to   receive   the   medical
 7        information.
 8             (8)  The authorization states a specific date  after
 9        which  the  employer  is no longer authorized to disclose
10        the medical information.
11             (9)  The authorization advises  the  person  signing
12        the  authorization  of the right to receive a copy of the
13        authorization.

14        Section 75.  Employer furnishing copy  of  authorization.
15    Upon  demand  by  the  patient  or  the  person who signed an
16    authorization, an employer possessing the authorization  must
17    furnish a true copy of it.

18        Section  80.  Employer;  limitations in authorization. An
19    employer who discloses medical  information  pursuant  to  an
20    authorization required under this Act must communicate to the
21    person   or   entity   to  which  it  discloses  the  medical
22    information any limitations in  the  authorization  regarding
23    the  use  of  the  medical  information.  An employer who has
24    attempted in good faith to comply with this  Section  is  not
25    liable for any unauthorized use of the medical information by
26    the  person  or  entity  to  which the employer disclosed the
27    medical information.

28        Section  85.  Employer;   canceling   or   modifying   an
29    authorization.   Nothing  in  this  Act shall be construed to
30    prevent a  person  who  could  sign  an  authorization  under
31    paragraph  (3)  of  Section 70 from canceling or modifying an
 
                            -17-     LRB093 02057 LCB 11136 b
 1    authorization. The cancellation or modification is effective,
 2    however, only after the employer  actually  receives  written
 3    notice of the cancellation or modification.

 4        Section  90.  Further  disclosure. A recipient of medical
 5    information pursuant to an authorization under this  Act  may
 6    not  further  disclose  that  medical  information  unless in
 7    accordance  with  a  new   authorization   that   meets   the
 8    requirements  of  Section  70, or as specifically required or
 9    permitted by other provisions of this Act or by law.

10        Section 95.  Employer's actions deemed not a violation.
11        (a)  An employer who is a health care provider shall  not
12    be  deemed  to  have  violated  Section  65 by disclosing, in
13    accordance with Sections 10 through 60,  medical  information
14    possessed  in  connection with providing health care services
15    to the provider's patients.
16        (b)  An employer shall not be  deemed  to  have  violated
17    Section 65 because a health care provider that is an employee
18    or  agent  of  the  employer uses or discloses, in accordance
19    with Sections 10 through 60, medical information possessed by
20    the  provider  in  connection  with  providing  health   care
21    services to the provider's patients.
22        (c)  A health care provider that is an employer shall not
23    be  deemed  to have violated Section 10, 15, 20, 25, or 30 by
24    disclosing,  in  accordance  with  Sections  65  through  90,
25    medical information possessed in  connection  with  employing
26    the  provider's employees. Information maintained by a health
27    care provider in connection  with  employing  the  provider's
28    employees  shall  not be deemed to be medical information for
29    purposes of Sections 65 through 90, unless it would be deemed
30    medical information if received or maintained by an  employer
31    who is not a health care provider.
 
                            -18-     LRB093 02057 LCB 11136 b
 1        Section  100.  Administrative services in connection with
 2    payment for health care services.
 3        (a)  A person  or  entity  engaged  in  the  business  of
 4    furnishing  administrative  services to programs that provide
 5    payment for health care services may  not  knowingly  use  or
 6    disclose,  or  permit  its  employees  or  agents  to  use or
 7    disclose, medical information possessed  in  connection  with
 8    performing  administrative  functions  for  such  a  program,
 9    except   as  reasonably  necessary  in  connection  with  the
10    administration or maintenance of the program, or as  required
11    by law, or with an authorization.
12        (b)  An authorization required by this Section must be in
13    the  same form as described in Section 70, except that "third
14    party administrator"  shall  be  substituted  for  "employer"
15    wherever it appears in Section 70.
16        (c)  This  Section does not apply to any person or entity
17    that is subject to Article XL of the Illinois Insurance  Code
18    or to Sections 10 through 90 of this Act.

19        Section   105.  Underwriters   or   sellers   of  annuity
20    contracts. A person  or  entity  that  underwrites  or  sells
21    annuity  contracts  or  contracts  insuring, guaranteeing, or
22    indemnifying against loss, harm, damage, illness, disability,
23    or death, and any affiliate of that person or entity, may not
24    disclose individually identifiable information concerning the
25    health of, or the medical or genetic history of,  a  customer
26    to  any affiliated or nonaffiliated depository institution or
27    to any other affiliated or nonaffiliated third party for  use
28    with regard to the granting of credit.

29        Section  110.  Existing  laws concerning patients' rights
30    of access. Nothing in this Act  shall  be  deemed  to  affect
31    existing  laws relating to a patient's right of access to his
32    or her own medical information.
 
                            -19-     LRB093 02057 LCB 11136 b
 1        Section 115.  Types of information not subject to Act.
 2        (a)  The disclosure and  use  of  the  following  medical
 3    information is not subject to the limitations of this Act:
 4             (1)  Information  and records obtained in the course
 5        of  providing  services  under  the  Mental  Health   and
 6        Developmental Disabilities Code, the Mental Treatment for
 7        Incarcerated  Persons  Act,  the  Community Mental Health
 8        Act, the Specialized Living Centers  Act,  the  Community
 9        Services  Act,  the  Community  Support  Systems Act, the
10        Developmental Disability and Mental  Disability  Services
11        Act, or the Home Environment Living Program Act.
12             (2)  Information  and  records  maintained under the
13        Communicable Disease Prevention Act.
14             (3)  Information and records  maintained  under  the
15        Vital  Records Act or under subdivision (c)(2) of Section
16        4.1 or Section 18.4 or 18.4a of the Adoption Act.
17             (4)  Information and records acquired and maintained
18        or disclosed under the Health and Safety Act.
19             (5)  Information and records  acquired,  maintained,
20        or  disclosed  under the Workers' Compensation Act or the
21        Workers' Occupational Diseases Act.
22             (6)  Information and records subject to the  federal
23        alcohol  and  drug  abuse regulations (Part 2 (commencing
24        with Section 2.1) of subchapter A of Chapter 1  of  Title
25        42 of the Code of Federal Regulations).
26             (7)  Medical  information  and records disclosed to,
27        and their use by, the  Department  of  Insurance  or  the
28        Industrial Commission.
29        (b)  Nothing  in  this  Act  shall be construed to limit,
30    expand, or otherwise affect the  authority  of  the  Illinois
31    Department  of  Public  Health  to  collect  information from
32    health facilities in order to perform its  duties  under  the
33    Illinois Health Finance Reform Act.
 
                            -20-     LRB093 02057 LCB 11136 b
 1        Section  120.  Workers;  HIV information. Notwithstanding
 2    any other provision of law, nothing in subdivision (a)(6)  of
 3    Section   115  permits  the  disclosure  or  use  of  medical
 4    information regarding whether a patient is infected  with  or
 5    exposed to the human immunodeficiency virus without the prior
 6    authorization  from  the  patient,  unless  the patient is an
 7    injured worker claiming to be infected with or exposed to the
 8    human immunodeficiency virus  through  an  exposure  incident
 9    arising out of and in the course of employment.

10        Section  125.  Violation;  patient's recovery of damages.
11    In addition to any other remedies available at law, a patient
12    whose medical information  has  been  used  or  disclosed  in
13    violation of Section 10, 15, 20, 25, 30, or 65, or subsection
14    (a)  of  Section  100, and who has sustained economic loss or
15    personal injury therefrom may recover  compensatory  damages,
16    punitive damages not to exceed $3,000, attorney's fees not to
17    exceed $1,000, and the costs of litigation.

18        Section 130.  Violation; criminal penalty. A violation of
19    this  Act that results in economic loss or personal injury to
20    a patient is punishable as a Class C misdemeanor.

21        Section 135.  Violation;  private  right  of  action.  In
22    addition to any other remedies provided by law, an individual
23    may  bring  an  action  against any person or entity that has
24    negligently  released  confidential  information  or  records
25    concerning him or her in violation of this Act, for either or
26    both of the following:
27             (1)  Nominal damages of $1,000. In order to  recover
28        under  this  paragraph  (1), it is not necessary that the
29        plaintiff suffered or was threatened with actual damages.
30             (2)  The amount of actual damages, if any, sustained
31        by the patient.
 
                            -21-     LRB093 02057 LCB 11136 b
 1        Section 140.  Violation; civil penalty.
 2        (a)  In addition to any other remedies provided by law, a
 3    person  or  entity   that   negligently   discloses   medical
 4    information  in violation of this Act is liable, irrespective
 5    of the amount of damages suffered by the patient as a  result
 6    of  that  violation, for a civil penalty not to exceed $2,500
 7    per violation.
 8        (b)  A person or entity, other  than  a  licensed  health
 9    care  professional,  who  knowingly  and  willfully  obtains,
10    discloses,  or  uses medical information in violation of this
11    Act is liable for a civil penalty not to exceed  $25,000  per
12    violation.
13        (c)  A  licensed  health  care professional who knowingly
14    and willfully obtains, discloses, or uses medical information
15    in violation of this Act is liable, on a first violation, for
16    a civil penalty not to exceed $2,500; on a  second  violation
17    for  a civil penalty not to exceed $10,000; and on a third or
18    subsequent violation  for  a  civil  penalty  not  to  exceed
19    $25,000  per  violation.  Nothing  in  this  Section shall be
20    construed to limit the liability of  a  health  care  service
21    plan,  a  contractor, or a health care provider that is not a
22    licensed health care professional for any violation  of  this
23    Act.
24        (d)  A  person  or  entity,  other than a licensed health
25    care professional, who knowingly or willfully obtains or uses
26    medical information in violation of this Act for the  purpose
27    of financial gain is liable for a civil penalty not to exceed
28    $250,000 per violation and is also subject to disgorgement of
29    any  proceeds  or other consideration obtained as a result of
30    the violation.
31        (e)  A licensed health care  professional  who  knowingly
32    and willfully obtains, discloses, or uses medical information
33    in  violation  of this Act for financial gain is liable, on a
34    first violation, for a civil penalty not to exceed $5,000; on
 
                            -22-     LRB093 02057 LCB 11136 b
 1    a second violation for a civil penalty not to exceed $25,000;
 2    and on a third or subsequent violation for  a  civil  penalty
 3    not  to  exceed $250,000 per violation and is also subject to
 4    disgorgement of any proceeds or other consideration  obtained
 5    as  a  result of the violation. Nothing in this Section shall
 6    be construed to limit the liability of a health care  service
 7    plan,  a  contractor, or a health care provider that is not a
 8    licensed health care professional for any violation  of  this
 9    Act.
10        (f)  Nothing  in  this  Section  shall  be  construed  as
11    authorizing  a  civil  penalty under both subsections (b) and
12    (d) or (c) and (e) for the same violation.
13        (g)  A person or entity who is not permitted  to  receive
14    medical  information  under  this  Act  and who knowingly and
15    willfully obtains, discloses,  or  uses  medical  information
16    without  written authorization from the patient is liable for
17    a civil penalty not to exceed $250,000 per violation.
18        (h)  For  purposes  of  this  Section,  "knowingly"   and
19    "willfully"  have the same meaning as in the Criminal Code of
20    1961.

21        Section 145.  Assessment of civil penalty.  In  assessing
22    the  amount  of  a civil penalty under Section 140, the court
23    shall consider any one or more of the relevant  circumstances
24    presented  by  any of the parties to the case, including, but
25    not limited to, the following:
26             (1)  Whether the defendant has  made  a  reasonable,
27        good faith attempt to comply with this Act.
28             (2)  The nature and seriousness of the misconduct.
29             (3)  The   harm   to   the   patient,  enrollee,  or
30        subscriber.
31             (4)  The number of violations.
32             (5)  The persistence of the misconduct.
33             (6)  The length of time over  which  the  misconduct
 
                            -23-     LRB093 02057 LCB 11136 b
 1        occurred.
 2             (7)  The willfulness of the defendant's misconduct.
 3             (8)  The  defendant's  assets,  liabilities, and net
 4        worth.

 5        Section 150.  Recovery of civil penalty.
 6        (a)  A civil penalty under Section 140 shall be  assessed
 7    and  recovered  in  a civil action brought in the name of the
 8    people of the State of Illinois in  any  court  of  competent
 9    jurisdiction by any of the following:
10             (1)  The Attorney General.
11             (2)  A State's Attorney.
12             (3)  The attorney for a municipality.
13        (b)  If  the  action  is brought by the Attorney General,
14    50% of the penalty collected shall be paid to  the  treasurer
15    of  the  county  in  which  the judgment was entered, and 50%
16    shall be paid to the General Revenue Fund. If the  action  is
17    brought by a State's Attorney, the penalty collected shall be
18    paid to the treasurer of the county in which the judgment was
19    entered.  If  the  action  is  brought  by the attorney for a
20    municipality, 50% of the penalty collected shall be  paid  to
21    the  treasurer  of the municipality in which the judgment was
22    entered and 50% shall be paid to the treasurer of the  county
23    in which the judgment was entered.

24        Section  155.  Other sanctions or remedies. Imposition of
25    a civil penalty under  Section  140  does  not  preclude  the
26    imposition of any other sanction or remedy authorized by law.

27        Section   160.   Immunity  from  penalty.  A  person  who
28    discloses protected medical information  in  accordance  with
29    this  Act  is  not  subject to the penalty provisions of this
30    Act.
 
                            -24-     LRB093 02057 LCB 11136 b
 1        Section 165. Waiver prohibited.
 2        (a) A health care provider, health care service plan,  or
 3    contractor  may  not  require  a  patient,  as a condition of
 4    receiving health care services,  to  sign  an  authorization,
 5    release,  consent, or waiver that would permit the disclosure
 6    of medical information that otherwise may  not  be  disclosed
 7    under  Section  10,  15,  20,  25,  or  30 or under any other
 8    provision of law. A health care service  plan  or  disability
 9    insurer may, however, require relevant enrollee or subscriber
10    medical   information   as   a   condition   of  the  medical
11    underwriting process.
12        (b)  Any waiver by a patient of the  provisions  of  this
13    Act,  except  as authorized by Section 40 or 70 or subsection
14    (b) of Section 100, is deemed contrary to public  policy  and
15    is unenforceable.

16        Section  900.   The  Children  and Family Services Act is
17    amended by changing Section 35.1 as follows:

18        (20 ILCS 505/35.1) (from Ch. 23, par. 5035.1)
19        Sec. 35.1.  The case and clinical records of patients  in
20    Department  supervised  facilities,  wards of the Department,
21    children receiving or applying for  child  welfare  services,
22    persons  receiving  or  applying  for  other  services of the
23    Department, and Department reports  of  injury  or  abuse  to
24    children  shall not be open to the general public.  Such case
25    and clinical records and reports or the information contained
26    therein shall be disclosed by the Director of the  Department
27    to  juvenile  authorities when necessary for the discharge of
28    their official duties who request information concerning  the
29    minor  and  who  certify in writing that the information will
30    not be disclosed to any other party except as provided  under
31    law  or  order  of  court.   For  purposes  of  this Section,
32    "juvenile authorities" means: (i)  a  judge  of  the  circuit
 
                            -25-     LRB093 02057 LCB 11136 b
 1    court and members of the staff of the court designated by the
 2    judge;  (ii)  parties  to  the proceedings under the Juvenile
 3    Court Act  of  1987  and  their  attorneys;  (iii)  probation
 4    officers  and  court  appointed  advocates  for  the juvenile
 5    authorized  by  the  judge  hearing  the  case;    (iv)   any
 6    individual,  public  or  private agency having custody of the
 7    child pursuant to court order; (v) any individual, public  or
 8    private  agency providing education, medical or mental health
 9    service to the child when the requested information is needed
10    to determine the appropriate service  or  treatment  for  the
11    minor;  (vi)  any  potential  placement  provider  when  such
12    release is authorized by the court for the limited purpose of
13    determining  the  appropriateness of the potential placement;
14    (vii) law enforcement officers and prosecutors; (viii)  adult
15    and juvenile prisoner review boards; (ix) authorized military
16    personnel;  (x)  individuals  authorized  by  court; (xi) the
17    Illinois General Assembly  or  any  committee  or  commission
18    thereof.   This  Section  does  not apply to the Department's
19    fiscal records, other  records  of  a  purely  administrative
20    nature,  or any forms, documents or other records required of
21    facilities subject to licensure by the Department  except  as
22    may otherwise be provided under the Child Care Act of 1969.
23        Nothing  contained  in  this  Act prevents the sharing or
24    disclosure of information or records relating  or  pertaining
25    to  juveniles  subject  to  the  provisions  of  the  Serious
26    Habitual  Offender  Comprehensive  Action  Program  when that
27    information is used to assist in the early identification and
28    treatment of habitual juvenile offenders.
29        Nothing contained in this Act  prevents  the  sharing  or
30    disclosure  of  information or records relating or pertaining
31    to the death of a  minor  under  the  care  of  or  receiving
32    services  from  the  Department and under the jurisdiction of
33    the juvenile court  with  the  juvenile  court,  the  State's
34    Attorney, and the minor's attorney.
 
                            -26-     LRB093 02057 LCB 11136 b
 1        Nothing  contained  in this Section prohibits or prevents
 2    any individual dealing with or providing services to a  minor
 3    from sharing information with another individual dealing with
 4    or   providing  services  to  a  minor  for  the  purpose  of
 5    coordinating efforts on behalf of the minor.  The sharing  of
 6    such information is only for the purpose stated herein and is
 7    to   be  consistent  with  the  intent  and  purpose  of  the
 8    confidentiality provisions of the Juvenile Court Act of 1987.
 9    This provision does not abrogate  any  recognized  privilege.
10    Sharing  information  does  not  include  copying of records,
11    reports or case files unless authorized herein.
12        Nothing  in  this  Section  prohibits  or  prevents   the
13    re-disclosure  of records, reports, or other information that
14    reveals  malfeasance  or  nonfeasance  on  the  part  of  the
15    Department, its employees, or its agents.   Nothing  in  this
16    Section  prohibits or prevents the Department or a party in a
17    proceeding under the Juvenile Court Act of 1987 from  copying
18    records,  reports,  or  case files for the purpose of sharing
19    those documents with other parties to the litigation.
20        In the case of a conflict between  this  Section  or  any
21    other  provision  of  this  Act  and  the Medical Information
22    Confidentiality Act, this Section or the other  provision  of
23    this Act controls.
24    (Source: P.A.  90-15,  eff.  6-13-97;  90-590,  eff.  1-1-00;
25    91-812, eff. 6-13-00.)

26        Section   905.  The  Abused and Neglected Child Reporting
27    Act is  amended  by  changing  Sections  11.1a  and  11.2  as
28    follows:

29        (325 ILCS 5/11.1a)
30        Sec. 11.1a.  Disclosure of information.
31        (a)  The  Director  or  a person designated in writing by
32    the  Director  for  this  purpose  may  disclose  information
 
                            -27-     LRB093 02057 LCB 11136 b
 1    regarding the abuse or neglect of a child  as  set  forth  in
 2    this  Section,  the  investigation  thereof, and any services
 3    related thereto, if he or she determines that such disclosure
 4    is not contrary to the  best  interests  of  the  child,  the
 5    child's siblings, or other children in the household, and one
 6    of the following factors are present:
 7             (1)  The  subject  of the report has been criminally
 8        charged with committing a  crime  related  to  the  child
 9        abuse or neglect report; or
10             (2)  A law enforcement agency or official, a State's
11        Attorney,  or  a  judge  of  the  State  court system has
12        publicly disclosed in a report as  part  of  his  or  her
13        official duty, information regarding the investigation of
14        a  report or the provision of services by the Department;
15        or
16             (3)  An adult subject of the  report  has  knowingly
17        and  voluntarily  made  a  public disclosure concerning a
18        Child Abuse and Neglect Tracking System report; or
19             (4)  The  child  named  in  the  report   has   been
20        critically injured or died.
21        (b)  Information   may  be  disclosed  pursuant  to  this
22    Section as follows:
23             (1)  The name of the  alleged  abused  or  neglected
24        child.
25             (2)  The   current   status  of  the  investigation,
26        including whether a determination  of  credible  evidence
27        has been made.
28             (3)  Identification  of  child  protective  or other
29        services provided or actions taken  regarding  the  child
30        named  in the report and his or her family as a result of
31        this report.
32             (4)  Whether there have been past reports  of  child
33        abuse or neglect involving this child or family, or both.
34        Any  such  reports  shall  be clearly identified as being
 
                            -28-     LRB093 02057 LCB 11136 b
 1        "Indicated", "Unfounded", or "Pending".
 2             (5)  Whether the Department has a  current  or  past
 3        open  service case with the family, and a history of what
 4        types of services have been, or are being, provided.
 5             (6)  Any  extraordinary  or  pertinent   information
 6        concerning  the  circumstances  of  the  report,  if  the
 7        Director  determines  such  disclosure is consistent with
 8        the public interest.
 9        (c)  Any  disclosure  of  information  pursuant  to  this
10    Section shall not identify the name of or provide identifying
11    information regarding the source of the report.
12        (d)  In determining pursuant to subsection  (a)  of  this
13    Section,  whether  disclosure  will  be  contrary to the best
14    interests of  the  child,  the  child's  siblings,  or  other
15    children  in  the  household, the Director shall consider the
16    interest in privacy of the child and the child's  family  and
17    the  effects  which disclosure may have on efforts to reunite
18    and provide services to the family.
19        (e)  Except as it applies directly to the  cause  of  the
20    abuse  or neglect of the child, nothing in this Section shall
21    be deemed to authorize  the  release  or  disclosure  of  the
22    substance  or  content  of  any  psychological,  psychiatric,
23    therapeutic,  clinical,  or  medical reports, evaluations, or
24    like materials pertaining to the child or the child's family.
25    Prior to the release  or  disclosure  of  any  psychological,
26    psychiatric,   or   therapeutic   reports  pursuant  to  this
27    subsection, the Deputy Director of  Clinical  Services  shall
28    review  such materials and make recommendations regarding its
29    release.  Any disclosure  of  information  pursuant  to  this
30    Section  shall  not identify the health care provider, health
31    care facility or other maker of the report or source  of  any
32    psychological, psychiatric, therapeutic, clinical, or medical
33    reports, evaluations, or like materials.
34        (f)  Regarding child abuse or neglect reports which occur
 
                            -29-     LRB093 02057 LCB 11136 b
 1    at  a  facility  licensed  by  the Department of Children and
 2    Family  Services,  only  the  following  information  may  be
 3    disclosed or released:
 4             (1)  The name of the facility.
 5             (2)  The nature  of  the  allegations  of  abuse  or
 6        neglect.
 7             (3)  The  number and ages of child victims involved,
 8        and their relationship to the perpetrator.
 9             (4)  Actions the Department has taken to ensure  the
10        safety  of  the  children  during  and  subsequent to the
11        investigation.
12             (5)  The final finding status of the investigation.
13        (g)  In the case of a conflict between  this  Section  or
14    any  other  provision of this Act and the Medical Information
15    Confidentiality Act, this Section or the other  provision  of
16    this Act controls.
17    (Source: P.A. 90-75, eff. 1-1-98.)

18        (325 ILCS 5/11.2) (from Ch. 23, par. 2061.2)
19        Sec.  11.2.  Disclosure  to  mandated reporting source. A
20    mandated reporting source as provided in Section  4  of  this
21    Act  may  receive  appropriate information about the findings
22    and actions taken by the Child  Protective  Service  Unit  in
23    response  to  its  report.  The information shall include the
24    actions taken by the Child Protective Service Unit to  ensure
25    a child's safety.
26        In  the  case  of  a conflict between this Section or any
27    other provision of  this  Act  and  the  Medical  Information
28    Confidentiality  Act,  this Section or the other provision of
29    this Act controls.
30    (Source: P.A. 92-319, eff. 1-1-02.)

31        Section 910.  The Medical Patient Rights Act  is  amended
32    by changing Section 3 as follows:
 
                            -30-     LRB093 02057 LCB 11136 b
 1        (410 ILCS 50/3) (from Ch. 111 1/2, par. 5403)
 2        Sec. 3. The following rights are hereby established:
 3        (a)  The  right  of  each patient to care consistent with
 4    sound nursing and medical practices, to be  informed  of  the
 5    name of the physician responsible for coordinating his or her
 6    care,  to receive information concerning his or her condition
 7    and proposed treatment, to refuse any treatment to the extent
 8    permitted by law,  and  to  privacy  and  confidentiality  of
 9    records except as otherwise provided by law.
10        (b)  The  right  of each patient, regardless of source of
11    payment, to examine and receive a reasonable  explanation  of
12    his  total  bill  for  services  rendered by his physician or
13    health care provider,  including  the  itemized  charges  for
14    specific  services  received.   Each physician or health care
15    provider  shall  be  responsible  only   for   a   reasonable
16    explanation  of  those  specific  services  provided  by such
17    physician or health care provider.
18        (c)  In the event an insurance company or health services
19    corporation cancels or refuses to renew an individual  policy
20    or  plan,  the  insured  patient shall be entitled to timely,
21    prior notice of the termination of such policy or plan.
22        An insurance company or health services corporation  that
23    requires   any  insured  patient  or  applicant  for  new  or
24    continued insurance or coverage to be  tested  for  infection
25    with   human   immunodeficiency  virus  (HIV)  or  any  other
26    identified  causative  agent  of  acquired   immunodeficiency
27    syndrome (AIDS) shall (1) give the patient or applicant prior
28    written  notice  of  such  requirement, (2) proceed with such
29    testing only upon the written authorization of the  applicant
30    or  patient,  and  (3)  keep  the  results  of  such  testing
31    confidential.   Notice of an adverse underwriting or coverage
32    decision may be given to any appropriately interested  party,
33    but the insurer may only disclose the test result itself to a
34    physician  designated  by  the  applicant or patient, and any
 
                            -31-     LRB093 02057 LCB 11136 b
 1    such  disclosure  shall  be  in   a   manner   that   assures
 2    confidentiality.
 3        The  Department of Insurance shall enforce the provisions
 4    of this subsection.
 5        (d)  The  right  of   each   patient   to   privacy   and
 6    confidentiality  in  health  care  as provided in the Medical
 7    Information Confidentiality Act. Each physician, health  care
 8    provider,  health  services corporation and insurance company
 9    shall refrain  from  disclosing  the  nature  or  details  of
10    services  provided  to patients, except that such information
11    may be disclosed to the patient, the party  making  treatment
12    decisions  if  the  patient  is incapable of making decisions
13    regarding  the  health  services  provided,   those   parties
14    directly  involved with providing treatment to the patient or
15    processing the payment  for  that  treatment,  those  parties
16    responsible  for  peer review, utilization review and quality
17    assurance, and those parties required to  be  notified  under
18    the  Abused  and  Neglected Child Reporting Act, the Illinois
19    Sexually Transmissible Disease Control Act or where otherwise
20    authorized or required by law.  This right may be  waived  in
21    writing  by  the  patient  or  the  patient's guardian, but a
22    physician or other health care provider may not condition the
23    provision  of  services  on  the  patient's   or   guardian's
24    agreement to sign such a waiver.
25    (Source: P.A. 86-895; 86-902; 86-1028; 87-334.)

26        Section  915.  The AIDS Confidentiality Act is amended by
27    changing Section 15 as follows:

28        (410 ILCS 305/15) (from Ch. 111 1/2, par. 7315)
29        Sec. 15.  Nothing in  this  Act  shall  be  construed  to
30    impose civil liability or criminal sanction for disclosure of
31    a test result in accordance with any reporting requirement of
32    the Department for a diagnosed case of HIV infection, AIDS or
 
                            -32-     LRB093 02057 LCB 11136 b
 1    a related condition.
 2        Nothing  in  this  Act shall be construed to impose civil
 3    liability or criminal sanction for performing a test  without
 4    written  informed  consent  pursuant  to  the  provisions  of
 5    subsection (b) or (c) of Section 7 of this Act.
 6        In  the  case  of  a conflict between this Section or any
 7    other provision of  this  Act  and  the  Medical  Information
 8    Confidentiality  Act,  this Section or the other provision of
 9    this Act controls.
10    (Source: P.A. 86-887.)

11        Section  920.  The  Mental   Health   and   Developmental
12    Disabilities  Confidentiality  Act  is  amended  by  changing
13    Section 5 as follows:

14        (740 ILCS 110/5) (from Ch. 91 1/2, par. 805)
15        Sec. 5.  Disclosure; consent.
16        (a)  Except  as  provided  in  Sections 6 through 12.2 of
17    this Act, records and  communications  may  be  disclosed  to
18    someone  other than those persons listed in Section 4 of this
19    Act only with the written consent of those  persons  who  are
20    entitled to inspect and copy a recipient's record pursuant to
21    Section 4 of this Act.
22        (b)  Every  consent  form  shall  be in writing and shall
23    specify the following:
24             (1)  the person or agency to whom disclosure  is  to
25        be made;
26             (2)  the purpose for which disclosure is to be made;
27             (3)  the nature of the information to be disclosed;
28             (4)  the  right  to inspect and copy the information
29        to be disclosed;
30        (5)  the consequences of a refusal to  consent,  if  any;
31    and
32             (6)  the calendar date on which the consent expires,
 
                            -33-     LRB093 02057 LCB 11136 b
 1        provided  that if no calendar date is stated, information
 2        may be released only on  the  day  the  consent  form  is
 3        received by the therapist; and
 4             (7)  the right to revoke the consent at any time.
 5        The  consent  form shall be signed by the person entitled
 6    to give consent and the signature shall  be  witnessed  by  a
 7    person  who  can  attest  to  the  identity  of the person so
 8    entitled.  A copy of the consent and a  notation  as  to  any
 9    action  taken  thereon  shall  be  entered in the recipient's
10    record. Any revocation of consent shall be in writing, signed
11    by the person who gave the consent and the signature shall be
12    witnessed by a person who can attest to the identity  of  the
13    person  so  entitled.  No written revocation of consent shall
14    be  effective  to   prevent   disclosure   of   records   and
15    communications  until  it is received by the person otherwise
16    authorized to disclose records and communications.
17        (c)  Only information relevant to the purpose  for  which
18    disclosure  is  sought  may be disclosed.  Blanket consent to
19    the disclosure of unspecified information shall not be valid.
20    Advance consent may be  valid  only  if  the  nature  of  the
21    information  to  be  disclosed is specified in detail and the
22    duration of the consent is indicated.  Consent may be revoked
23    in writing at any time; any such  revocation  shall  have  no
24    effect on disclosures made prior thereto.
25        (d)  No  person  or  agency  to  whom  any information is
26    disclosed under this Section may redisclose such  information
27    unless   the   person   who   consented   to  the  disclosure
28    specifically consents to such redisclosure.
29        (e)  Except as otherwise provided in  this  Act,  records
30    and  communications shall remain confidential after the death
31    of  a  recipient  and  shall  not  be  disclosed  unless  the
32    recipient's representative, as defined in the Probate Act  of
33    1975  and  the therapist consent to such disclosure or unless
34    disclosure is authorized  by  court  order  after  in  camera
 
                            -34-     LRB093 02057 LCB 11136 b
 1    examination and upon good cause shown.
 2        (f)  Paragraphs (a) through (e) of this Section shall not
 3    apply  to  and  shall  not  be  construed  to limit insurance
 4    companies writing  Life,  Accident  or  Health  insurance  as
 5    defined  in  Section  4  of  the  Illinois  Insurance Code in
 6    obtaining general consents for the release to them  or  their
 7    designated   representatives  of  any  and  all  confidential
 8    communications  and  records  kept  by  agencies,  hospitals,
 9    therapists  or  record   custodians,   and   utilizing   such
10    information   in   connection   with   the   underwriting  of
11    applications for coverage for such policies or contracts,  or
12    in  connection with evaluating claims or liability under such
13    policies or contracts, or coordinating benefits  pursuant  to
14    policy or contract provisions.
15        (g)  In  the  case  of a conflict between this Section or
16    any other provision of this Act and the  Medical  Information
17    Confidentiality  Act,  this Section or the other provision of
18    this Act controls.
19    (Source: P.A. 90-655, eff. 7-30-98)