Illinois Administrative Code › Title 77 - PUBLIC HEALTH › Part 2060 - ALCOHOLISM AND SUBSTANCE ABUSE TREATMENT AND INTERVENTION LICENSES › Subpart C - REQUIREMENTS - ALL LICENSES › Section 2060.319 - Confidentiality - Patient Information

Current through Register Vol. 48, No. 28, July 12, 2024
a) The organization shall have written
				policies and procedures controlling access to and use of records and
				information that are governed by the Confidentiality of Alcohol and Drug Abuse
				Patient Records regulations ( 42 CFR 2(1987) ) of the Alcohol, Drug Abuse, and
				Mental Health Administration of the Public Health Service of the United States
				Department of Health and Human Services effective August 10, 1987 and Article
				30 of the Act [20 ILCS 301 /Art. 30], and access to and use of protected health
				information governed by the Health Insurance Portability and Accountability Act
				(HIPAA),
				42 USC
				1320 et seq., and the regulations promulgated
				thereunder at 45 CFR 160, 162 and 164. The policies and procedures shall be
				consistent with said regulations and statutes. The organization shall comply
				with said regulations and statutes. However, nothing in this Part shall be
				construed as having the effect of imposing HIPAA requirements on a provider to
				whom HIPAA does not apply.
b) This
				Section shall not prohibit:
1) disclosure of
				information about a crime committed by a patient at the organization, or a
				threat to commit such crime;
2)
				disclosure of information about suspected child abuse or neglect, as allowed
				by, required by and consistent with State law;
3) disclosure of a patient's own records to
				the patient, or as consented to in writing by the patient;
4) communications of information between or
				among personnel having a need for the information in connection with their
				duties either within the organization or with an entity having direct
				administrative control over the services;
5) disclosure of information to medical
				personnel if necessary in a medical emergency;
6) disclosure of information as authorized by
				an appropriate court order upon showing of good cause, after appropriate
				procedure and notice, and with appropriate safeguards against unauthorized
				disclosure contained in the order as set forth in
				42 CFR 2.61
				-
				2.67(1987);
7) disclosure of information to qualified
				personnel for the purpose of conducting scientific research as set forth in
				42 CFR
				2.52(1987) (if such
				disclosure is in compliance with HIPAA regulations, 45 CFR 160, 162 and 164
				);
8) disclosure of information to
				qualified personnel who are authorized by law or who provide financial
				assistance for the purpose of conducting audit or evaluation activity (services
				review or evaluation, quality review, financial or management audits, etc., as
				set forth in
				42 CFR
				2.53(1987) ).
This Section shall also not prohibit any other disclosure not
				  precluded by the regulations and statute cited in subsection (a), nor by any
				  other applicable law, provided that any and all of the above disclosure is done
				  consistent with the regulations and laws in subsection (a), is made only to the
				  extent allowed, for the purposes allowed and that appropriate safeguards as
				  required therein are provided.