HB1017enr 98TH GENERAL ASSEMBLY

HB1017 Enrolled LRB098 04914 HEP 34944 b

AN ACT concerning civil law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Mental Health and Developmental Disabilities Confidentiality Act is amended by changing Sections 2, 6, 7, 9, 9.2, 9.4, 11, and 13 and by adding Sections 9.5, 9.6, 9.7, 9.8, 9.9, 9.10, and 9.11 as follows:

(740 ILCS 110/2) (from Ch. 91 1/2, par. 802)

Sec. 2. The terms used in this Act, unless the context requires otherwise, have the meanings ascribed to them in this Section.

"Agent" means a person who has been legally appointed as an individual's agent under a power of attorney for health care or for property.

"Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Confidential communication" or "communication" means any communication made by a recipient or other person to a therapist or to or in the presence of other persons during or in connection with providing mental health or developmental disability services to a recipient. Communication includes information which indicates that a person is a recipient. "Communication" does not include information that has been de-identified in accordance with HIPAA, as specified in 45 CFR 164.514.

"Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.

"Guardian" means a legally appointed guardian or conservator of the person.

"Health information exchange" or "HIE" means a health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules promulgated thereunder; or (ii) has established a data sharing arrangement with the Illinois Health Information Exchange; or (iii) as of the effective date of this amendatory Act of the 98th General Assembly, was designated by the Illinois Health Information Exchange Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee.

"HIE purposes" means those uses and disclosures (as those terms are defined under HIPAA, as specified in 45 CFR 160.103) for activities of an HIE: (i) set forth in the Illinois Health Information Exchange and Technology Act or any subsequent amendments thereto and any administrative rules promulgated thereunder; or (ii) which are permitted under federal law.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and any subsequent amendments thereto and any regulations promulgated thereunder, including the Security Rule, as specified in 45 CFR 164.302-18, and the Privacy Rule, as specified in 45 CFR 164.500-34.

"Integrated health system" means an organization with a system of care which incorporates physical and behavioral healthcare and includes care delivered in an inpatient and outpatient setting.

"Interdisciplinary team" means a group of persons representing different clinical disciplines, such as medicine, nursing, social work, and psychology, providing and coordinating the care and treatment for a recipient of mental health or developmental disability services. The group may be composed of individuals employed by one provider or multiple providers.

"Mental health or developmental disabilities services" or "services" includes but is not limited to examination, diagnosis, evaluation, treatment, training, pharmaceuticals, aftercare, habilitation or rehabilitation.

"Personal notes" means:

(i) information disclosed to the therapist in confidence by other persons on condition that such information would never be disclosed to the recipient or other persons;

(ii) information disclosed to the therapist by the recipient which would be injurious to the recipient's relationships to other persons, and

(iii) the therapist's speculations, impressions, hunches, and reminders.

"Parent" means a parent or, in the absence of a parent or guardian, a person in loco parentis.

"Recipient" means a person who is receiving or has received mental health or developmental disabilities services.

"Record" means any record kept by a therapist or by an agency in the course of providing mental health or developmental disabilities service to a recipient concerning the recipient and the services provided. "Records" includes all records maintained by a court that have been created in connection with, in preparation for, or as a result of the filing of any petition or certificate under Chapter II, Chapter III, or Chapter IV of the Mental Health and Developmental Disabilities Code and includes the petitions, certificates, dispositional reports, treatment plans, and reports of diagnostic evaluations and of hearings under Article VIII of Chapter III or under Article V of Chapter IV of that Code. Record does not include the therapist's personal notes, if such notes are kept in the therapist's sole possession for his own personal use and are not disclosed to any other person, except the therapist's supervisor, consulting therapist or attorney. If at any time such notes are disclosed, they shall be considered part of the recipient's record for purposes of this Act. "Record" does not include information that has been de-identified in accordance with HIPAA, as specified in 45 CFR 164.514.

"Record custodian" means a person responsible for maintaining a recipient's record.

"Therapist" means a psychiatrist, physician, psychologist, social worker, or nurse providing mental health or developmental disabilities services or any other person not prohibited by law from providing such services or from holding himself out as a therapist if the recipient reasonably believes that such person is permitted to do so. Therapist includes any successor of the therapist.

(Source: P.A. 89-58, eff. 1-1-96; 90-538, eff. 12-1-97.)

(740 ILCS 110/6) (from Ch. 91 1/2, par. 806)

Sec. 6. Such information from a recipient's record as is necessary to enable him to apply for or receive benefits may be disclosed with consent obtained pursuant to Section 5 of this Act. Disclosure may be made without consent when despite every reasonable effort it is not possible to obtain consent because the person entitled to give consent is not capable of consenting or is not available to do so. The recipient shall be informed of any disclosure made without consent. The information disclosed without consent under this Section may include only the identity of the recipient and therapist and a description of the nature, purpose, quantity, and date of the services provided. Any request for additional information shall state with particularity what further information is needed and the reasons therefor. Refusal to consent to the disclosure of more information than is necessary to apply for or receive direct benefits shall not be grounds for in any way denying, limiting, or cancelling such benefits or refusing to accept an application or renew such benefits. Such information shall not be redisclosed except as provided in this Act with the consent of the person entitled to give consent.

(Source: P.A. 80-1508.)

(740 ILCS 110/7) (from Ch. 91 1/2, par. 807)

Sec. 7. Review of therapist or agency; use of recipient's record.

(a) When a therapist or agency which provides services is being reviewed for purposes of licensure, statistical compilation, research, evaluation, or other similar purpose, a recipient's record may be used by the person conducting the review to the extent that this is necessary to accomplish the purpose of the review, provided that personally identifiable data is removed from the record before use. Personally identifiable data may be disclosed only in accordance with the consent obtained under Section 5 of this Act. Licensure and the like may not be withheld or withdrawn for failure to disclose personally identifiable data if consent is not obtained.

(b) When an agency which provides services is being reviewed for purposes of funding, accreditation, reimbursement or audit by a State or federal agency or accrediting body, a recipient's record may be used by the person conducting the review and personally identifiable information may be disclosed without consent, provided that the personally identifiable information is necessary to accomplish the purpose of the review.

For the purpose of this subsection, an inspection investigation or site visit by the United States Department of Justice regarding compliance with a pending consent decree is considered an audit by a federal agency.

(c) An independent team of experts under Brian's Law shall be entitled to inspect and copy the records of any recipient whose death is being examined by such a team pursuant to the mortality review process authorized by Brian's Law. Information disclosed under this subsection may not be redisclosed without the written consent of one of the persons identified in Section 4 of this Act.

(Source: P.A. 96-1235, eff. 1-1-11.)

(740 ILCS 110/9) (from Ch. 91 1/2, par. 809)

(Text of Section WITHOUT the changes made by P.A. 89-7, which has been held unconstitutional)

Sec. 9. In the course of providing services and after the conclusion of the provision of services, including for the purposes of treatment and care coordination, a therapist, integrated health system, or member of an interdisciplinary team may use, disclose, or re-disclose may disclose a record or communications without consent to:

(1) the therapist's supervisor, a consulting therapist, members of a staff team participating in the provision of services, a record custodian, a business associate, an integrated health system, a member of an interdisciplinary team, or a person acting under the supervision and control of the therapist;

(2) persons conducting a peer review of the services being provided;

(3) the Institute for Juvenile Research and the Institute for the Study of Developmental Disabilities;

(4) an attorney or advocate consulted by a therapist or agency which provides services concerning the therapist's or agency's legal rights or duties in relation to the recipient and the services being provided; and

(5) the Inspector General of the Department of Children and Family Services when such records or communications are relevant to a pending investigation authorized by Section 35.5 of the Children and Family Services Act where:

(A) the recipient was either (i) a parent, foster parent, or caretaker who is an alleged perpetrator of abuse or neglect or the subject of a dependency investigation or (ii) a non-ward victim of alleged abuse or neglect, and

(B) available information demonstrates that the mental health of the recipient was or should have been an issue to the safety of the child.

In the course of providing services, a therapist, integrated health system, or member of an interdisciplinary team may disclose a record or communications without consent to any department, agency, institution or facility which has custody of the recipient pursuant to State statute or any court order of commitment.

Information may be disclosed under this Section only to the extent that knowledge of the record or communications is essential to the purpose for which disclosure is made and only after the recipient is informed that such disclosure may be made. A person to whom disclosure is made under this Section shall not redisclose any information except as provided in this Act.

(Source: P.A. 86-955; 90-512, eff. 8-22-97.)

(740 ILCS 110/9.2)

Sec. 9.2. Interagency disclosure of recipient information. For the purposes of continuity of care, the Department of Human Services (as successor to the Department of Mental Health and Developmental Disabilities), community agencies funded by the Department of Human Services in that capacity, licensed private hospitals, integrated health systems, members of an interdisciplinary team, federally qualified health centers, or physicians or therapists or other healthcare providers licensed or certified by or receiving payments from the Department of Human Services or the Department of Healthcare and Family Services, State correctional facilities, juvenile justice facilities, mental health facilities operated by a county, mental health court professionals as defined in Section 10 of the Mental Health Court Treatment Act, Veterans and Servicemembers Court professionals as defined in Section 10 of the Veterans and Servicemembers Court Treatment Act and jails and juvenile detention facilities operated by any county of this State may disclose a recipient's record or communications, without consent, to each other, but only for the purpose of admission, treatment, planning, coordinating care, or discharge, or governmentally mandated public health reporting. Entities shall not redisclose any personally identifiable information, unless necessary for admission, treatment, planning, coordinating care, or discharge, or governmentally mandated public health reporting of the identified recipient to another setting. No records or communications may be disclosed to a county jail or State correctional facility pursuant to this Section unless the Department has entered into a written agreement with the county jail or State correctional facility requiring that the county jail or State correctional facility adopt written policies and procedures designed to ensure that the records and communications are disclosed only to those persons employed by or under contract to the county jail or State correctional facility who are involved in the provision of mental health services to inmates and that the records and communications are protected from further disclosure.

(Source: P.A. 96-1399, eff. 7-29-10; 96-1453, eff. 8-20-10; 97-946, eff. 8-13-12.)

(740 ILCS 110/9.4)

Sec. 9.4. Disclosure for treatment and coordination of care.

(a) For recipients in a program administered or operated by the Department of Healthcare and Family Services or the Department of Human Services (as successor to the Department of Mental Health and Developmental Disabilities), records of a recipient may be disclosed without consent by county jails, insurance companies, integrated health systems, and State agencies, including the Department of Corrections, the Department of Children and Family Services, the Department of Healthcare and Family Services and the Department of Human Services, to hospitals, physicians, therapists, emergency medical personnel, and members of an interdisciplinary team treating a recipient for the purposes of treatment and coordination of care.

(b) An interdisciplinary team treating a recipient may disclose the recipient's records without the recipient's consent to other members of the team.

(c) The records that may be disclosed under this Section are services rendered, providers rendering the services, pharmaceuticals prescribed or dispensed, and diagnoses. All disclosures under this Section must be made in a manner consistent with existing federal and State laws and regulations, including the federal Health Insurance Portability and Accountability Act (HIPAA).

(d) (Blank). For the purpose of this Section only:

"Integrated health system" means an organization with a system of care which incorporates physical and behavioral healthcare and includes care delivered in an inpatient and outpatient setting.

"Interdisciplinary team" means a group of persons, representing different clinical disciplines (medicine, nursing, social work, psychology, etc.) providing and coordinating the care and treatment for a person with mental illness. The group may be composed of individuals employed by one provider or multiple providers.

(Source: P.A. 97-515, eff. 8-23-11.)

(740 ILCS 110/9.5 new)

Sec. 9.5. Use and disclosure of information to an HIE.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, or covered entity may, without a recipient's consent, use or disclose information from a recipient's record in connection with an HIE, including disclosure to the Illinois Health Information Exchange Authority, an HIE, or the business associate of either. An HIE and its business associate may, without a recipient's consent, use or disclose and re-disclose such information for HIE purposes or for such other purposes as are specifically allowed under this Act.

(b) As used in this Section:

(1) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code; and

(2) the terms "disclosure" and "use" have the meanings ascribed to them under HIPAA, as specified in 45 CFR 160.103.

(740 ILCS 110/9.6 new)

Sec. 9.6. HIE opt-out. The Illinois Health Information Exchange Authority shall, through appropriate rules, standards, or contractual obligations, which shall be binding upon any HIE, as defined under Section 2, require that participants of such HIE provide each recipient whose record is accessible through the health information exchange the reasonable opportunity to expressly decline the further disclosure of the record by the health information exchange to third parties, except to the extent permitted by law such as for purposes of public health reporting. These rules, standards, or contractual obligations shall permit a recipient to revoke a prior decision to opt-out or a decision not to opt-out. These rules, standards, or contractual obligations shall provide for written notice of a recipient's right to opt-out which directs the recipient to a health information exchange website containing (i) an explanation of the purposes of the health information exchange; and (ii) audio, visual, and written instructions on how to opt-out of participation in whole or in part to the extent possible. These rules, standards, or contractual obligations shall be reviewed annually and updated as the technical options develop. The recipient shall be provided meaningful disclosure regarding the health information exchange, and the recipient's decision whether to opt-out should be obtained without undue inducement or any element of force, fraud, deceit, duress, or other form of constraint or coercion. To the extent that HIPAA, as specified in 45 CFR 164.508(b)(4), prohibits a covered entity from conditioning the provision of its services upon an individual's provision of an authorization, an HIE participant shall not condition the provision of its services upon a recipient's decision to opt-out of further disclosure of the record by an HIE to third parties. The Illinois Health Information Exchange Authority shall, through appropriate rules, standards, or contractual obligations, which shall be binding upon any HIE, as defined under Section 2, give consideration to the format and content of the meaningful disclosure and the availability to recipients of information regarding an HIE and the rights of recipients under this Section to expressly decline the further disclosure of the record by an HIE to third parties. The Illinois Health Information Exchange Authority shall also give annual consideration to enable a recipient to expressly decline the further disclosure by an HIE to third parties of selected portions of the recipient's record while permitting disclosure of the recipient's remaining patient health information. In establishing rules, standards, or contractual obligations binding upon HIEs under this Section to give effect to recipient disclosure preferences, the Illinois Health Information Exchange Authority in its discretion may consider the extent to which relevant health information technologies reasonably available to therapists and HIEs in this State reasonably enable the effective segmentation of specific information within a recipient's electronic medical record and reasonably enable the effective exclusion of specific information from disclosure by an HIE to third parties, as well as the availability of sufficient authoritative clinical guidance to enable the practical application of such technologies to effect recipient disclosure preferences. The provisions of this Section 9.6 shall not apply to the secure electronic transmission of data which is point-to-point communication directed by the data custodian. Any rules or standards promulgated under this Section which apply to HIEs shall be limited to that subject matter required by this Section and shall not include any requirement that an HIE enter a data sharing arrangement or otherwise participate with the Illinois Health Information Exchange. In connection with its annual consideration regarding the issue of segmentation of information within a medical record and prior to the adoption of any rules or standards regarding that issue, the Authority Board shall consider information provided by affected persons or organizations regarding the feasibility, availability, cost, reliability, and interoperability of any technology or process under consideration by the Board. Nothing in this Act shall be construed to limit the authority of the Illinois Health Information Exchange Authority to impose limits or conditions on consent for disclosures to or through any HIE, as defined under Section 2, which are more restrictive than the requirements under this Act or under HIPAA.

(740 ILCS 110/9.7 new)

Sec. 9.7. Other limitations on consent requirements. The consent requirements under Section 5 may not be required for the use or disclosure (as those terms are defined under HIPAA, as specified in 45 CFR 160.103) of a record or communication disclosed (as that term is defined under HIPAA, as specified in 45 CFR 160.103) to or through an HIE for HIE purposes and in accordance with this Act.

(740 ILCS 110/9.8 new)

Sec. 9.8. Business associates. An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Authority, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, utilize the services of and disclose information from a recipient's record to a business associate, as defined by and in accordance with the requirements set forth under HIPAA. As used in this Section, the term "disclosure" has the meaning ascribed to it by HIPAA, as specified in 45 CFR 160.103.

(740 ILCS 110/9.9 new)

Sec. 9.9. Record locator service.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Authority, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, disclose the existence of a recipient's record to a record locator service, master patient index, or other directory or services necessary to support and enable the establishment and operation of an HIE.

(b) As used in this Section:

(1) the term "disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103; and

(2) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code.

(740 ILCS 110/9.10 new)

Sec. 9.10. Interagency disclosures by HIE. Nothing in this Act shall be construed to limit the use of an HIE to facilitate the disclosure or re-disclosure of information from a recipient's record to any agency or department of this State as authorized by Sections 7.1, 9.2 and 9.4 of this Act. Notwithstanding the foregoing, nothing in this Act shall be construed to allow for the disclosure or re-disclosure of information from a recipient's record to law enforcement personnel or for law enforcement purposes.

(740 ILCS 110/9.11 new)

Sec. 9.11. Establishment and disclosure of limited data sets and de-identified information.

(a) An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Authority, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, use information from a recipient's record to establish, or disclose such information to a business associate to establish, and further disclose information from a recipient's record as part of a limited data set as defined by and in accordance with the requirements set forth under HIPAA, as specified in 45 CFR 164.514(e). An HIE, person, therapist, facility, agency, interdisciplinary team, integrated health system, business associate, covered entity, the Illinois Health Information Exchange Authority, or entity facilitating the establishment or operation of an HIE may, without a recipient's consent, use information from a recipient's record or disclose information from a recipient's record to a business associate to de-identity the information in accordance with HIPAA, as specified in 45 CFR 164.514.

(b) As used in this Section:

(1) the terms "disclosure" and "use" shall have the meanings ascribed to them by HIPAA, as specified in 45 CFR 160.103; and

(2) "facility" means a developmental disability facility as defined in Section 1-107 of the Mental Health and Developmental Disabilities Code or a mental health facility as defined in Section 1-114 of the Mental Health and Developmental Disabilities Code.

(740 ILCS 110/11) (from Ch. 91 1/2, par. 811)

Sec. 11. Disclosure of records and communications. Records and communications may be disclosed:

(i) in accordance with the provisions of the Abused and Neglected Child Reporting Act, subsection (u) of Section 5 of the Children and Family Services Act, or Section 7.4 of the Child Care Act of 1969;

(ii) when, and to the extent, a therapist, in his or her sole discretion, determines that disclosure is necessary to initiate or continue civil commitment or involuntary treatment proceedings under the laws of this State or to otherwise protect the recipient or other person against a clear, imminent risk of serious physical or mental injury or disease or death being inflicted upon the recipient or by the recipient on himself or another;

(iii) when, and to the extent disclosure is, in the sole discretion of the therapist, necessary to the provision of emergency medical care to a recipient who is unable to assert or waive his or her rights hereunder;

(iv) when disclosure is necessary to collect sums or receive third party payment representing charges for mental health or developmental disabilities services provided by a therapist or agency to a recipient under Chapter V of the Mental Health and Developmental Disabilities Code or to transfer debts under the Uncollected State Claims Act; however, disclosure shall be limited to information needed to pursue collection, and the information so disclosed shall not be used for any other purposes nor shall it be redisclosed except in connection with collection activities;

(v) when requested by a family member, the Department of Human Services may assist in the location of the interment site of a deceased recipient who is interred in a cemetery established under Section 26 of the Mental Health and Developmental Disabilities Administrative Act;

(vi) in judicial proceedings under Article VIII of Chapter III and Article V of Chapter IV of the Mental Health and Developmental Disabilities Code and proceedings and investigations preliminary thereto, to the State's Attorney for the county or residence of a person who is the subject of such proceedings, or in which the person is found, or in which the facility is located, to the attorney representing the petitioner in the judicial proceedings, to the attorney representing the recipient in the judicial proceedings, to any person or agency providing mental health services that are the subject of the proceedings and to that person's or agency's attorney, to any court personnel, including but not limited to judges and circuit court clerks, and to a guardian ad litem if one has been appointed by the court. Information disclosed under this subsection shall not be utilized for any other purpose nor be redisclosed except in connection with the proceedings or investigations. Copies of any records provided to counsel for a petitioner shall be deleted or destroyed at the end of the proceedings and counsel for petitioner shall certify to the court in writing that he or she has done so. At the request of a recipient or his or her counsel, the court shall issue a protective order insuring the confidentiality of any records or communications provided to counsel for a petitioner;

(vii) when, and to the extent disclosure is necessary to comply with the requirements of the Census Bureau in taking the federal Decennial Census;

(viii) when, and to the extent, in the therapist's sole discretion, disclosure is necessary to warn or protect a specific individual against whom a recipient has made a specific threat of violence where there exists a therapist-recipient relationship or a special recipient-individual relationship;

(ix) in accordance with the Sex Offender Registration Act;

(x) in accordance with the Rights of Crime Victims and Witnesses Act;

(xi) in accordance with Section 6 of the Abused and Neglected Long Term Care Facility Residents Reporting Act; and

(xii) in accordance with Section 55 of the Abuse of Adults with Disabilities Intervention Act; and .

(xiii) to an HIE as specifically allowed under this Act for HIE purposes and in accordance with any applicable requirements of the HIE.

Any person, institution, or agency, under this Act, participating in good faith in the making of a report under the Abused and Neglected Child Reporting Act or in the disclosure of records and communications under this Section, shall have immunity from any liability, civil, criminal or otherwise, that might result by reason of such action. For the purpose of any proceeding, civil or criminal, arising out of a report or disclosure under this Section, the good faith of any person, institution, or agency so reporting or disclosing shall be presumed.

(Source: P.A. 96-466, eff. 8-14-09; 97-333, eff. 8-12-11; 97-375, eff. 8-15-11.)

(740 ILCS 110/13) (from Ch. 91 1/2, par. 813)

Sec. 13. Whenever disclosure of a record or communication is made without consent pursuant to this Act, other than uses, disclosures, or redisclosures permitted under Sections 9.5, 9.8, 9.9, 9.10, and 9.11 of this Act, or other than uses, disclosures, or redisclosures permitted under Sections 9, 9.2, and 9.4 of this Act effected by electronic transmission, or whenever a record is used pursuant to Sections 7 and 8 of this Act, a notation of the information disclosed and the purpose of such disclosure or use shall be noted in the recipient's record together with the date and the name of the person to whom disclosure was made or by whom the record was used.

(Source: P.A. 80-1508.)

Section 99. Effective date. This Act takes effect upon becoming law.