410 ILCS 532/10: Segregation of information; technological capabilities.

(This Section may contain text from a Public Act with a delayed effective date)

(a) An electronic health network shall prevent the disclosure of a patient's coded private health care information to a provider, business entity, other electronic health network, or health information exchange located outside this State unless the disclosure is:

(1) for technical support purposes;

(2) for quality assurance purposes;

(3) for payment or health care operations, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); or

(4) to a specific covered entity with the consent of:

(A) the patient, for health care services for which the patient can provide consent under the laws of this State; or

(B) the patient's parent, guardian, health care surrogate decision maker, or power of attorney for health care for health care services for which the parent, guardian, health care surrogate decision maker, or power of attorney for health care can provide consent under the laws of this State.

(b) An electronic health network shall develop and enable the technological capabilities to, with respect to out-of-state disclosures:

(1) parse coded private health care information and convey all other information in a patient's electronic health record that is not prohibited by law;

(2) allow a health care provider to manually segregate or otherwise prevent the sharing or disclosure of private health care information from a patient's electronic health record;

(3) allow a patient to request and consent to the exchange of private health care information to a specific covered entity; and

(4) allow a patient to opt out of segregating private health care information in a patient's electronic health record.

(c) An electronic health network shall not notify a health care provider, business entity, other electronic health network, or health information exchange located outside this State that private health care information may have been segregated from a patient's electronic health record.

(d) The Department of Public Health may adopt rules as necessary to administer and implement this Act. If the Department adopts rules regarding the definition of private health care information, the Department shall consider any necessary exceptions to segregation and adopt rules that set forth those exceptions as determined.

(e) Nothing in this Act shall be interpreted to undermine the existing protections against disclosure of confidential health information or lawful health care activity, including, but not limited to, pursuant to the Lawful Health Care Activity Act and the Personal Information Protection Act.

(f) Nothing in this Act shall be interpreted to require health care providers to use electronic health networks.