Illinois Administrative Code › Title 77 - PUBLIC HEALTH › Part 1005 - COLLECTION, DISCLOSURE, AND CONFIDENTIALITY OF HEALTH STATISTICS; INSTITUTIONAL REVIEW BOARD › Subpart A - GENERAL PROVISIONS › Section 1005.35 - Department Standards for Health Data Release

Current through Register Vol. 48, No. 28, July 12, 2024
a) Disclosure of Individually Identifiable
				Health Data
1) The Department may make no
				disclosure of any item, collection or grouping of health data that makes the
				individual supplying or described in the health data identifiable unless:
A) The individual described in the health
				data, or the parent or legal guardian if the individual is a minor or mentally
				incompetent or a person holding a power of attorney covering the matters on
				behalf of the individual, has consented to the disclosure;
B) The disclosure is to a governmental entity
				in this State or in another state or to the federal government, provided that:
i) The health data will be used for a purpose
				for which the health data was collected by the Department;
ii) The recipient of the health data has
				entered into a written agreement, satisfactory to the Department, that it will
				protect the health data in accordance with the requirements of the Act and this
				Part and will not permit further disclosure without prior approval of the
				Department (Section 5(a)(2) of the Act);
C) The disclosure is to an individual or
				organization, for a specified time period as set forth in the written agreement
				and as determined by the Department, solely for bona fide research or
				statistical purposes, as determined in accordance with guidelines and
				procedures adopted by the Department, and the Department determines that:
i) the disclosure of the health data to the
				requesting individual or organization is required for the research or
				statistical purposes proposed;
ii)
				the requesting individual or organization has entered into a written agreement
				satisfactory to the Department that it will protect the health data in
				accordance with the requirements of the Act and this Part and will not permit
				further disclosure without prior approval of the Department. In no event,
				however, may the name, address, social security number, recipient number, or
				other unique personal identifier of an individual supplying the health data to
				the Department or described in it be disclosed under this Part to the
				requesting individual or organization, unless a Department-approved
				Institutional Review Board or its equivalent on the protection of human
				subjects in research has reviewed and approved the health data request.
				(Section 5(a)(3) of the Act); and
iii) The applicant is qualified to undertake
				the intended activity or study, as determined by the Department, based upon the
				IRB's assessment. In making its determination, the Department will consider,
				but is not limited to, the applicant's credentials and experience; and
				complexity of the health data request;
D) The disclosure is to a governmental entity
				for the purpose of conducting an audit, evaluation or investigation of the
				Department and the governmental entity agrees not to use the health data for
				making any determination to whom the health data relates (Section 5(a)(4) of
				the Act);
E) The disclosure is of
				specific medical or epidemiological information to authorized personnel in this
				or another state or the federal government, or agencies responsible to enforce
				quarantine, when necessary to continue patient services or to undertake public
				health efforts to control communicable, infectious, acute, chronic, or any
				other disease or health hazard that the Department considers to be dangerous or
				important or that may affect public health;
F) The disclosure is of specific medical or
				epidemiologic information to a health care provider, health care personnel, or
				public health personnel who has a legitimate need to have access to the
				information in order to assist the patient or protect the patient. This does
				not create a duty to warn third parties; or
G) The disclosure is necessary to obtain
				payment from an insurer or other third party payor in order for the Department
				to obtain payment or coordinate benefits for a patient.