Section 845.65  Provision of Data

a)         All reports issued by the Department, which are aggregated to make it impossible to identify any patient, reporting entity, or primary caregiver, shall be made available to the public pursuant to the Freedom of Information Act.

b)         All requests by medical or epidemiologic researchers for confidential data shall be submitted in writing to the Department.  The request shall include a study protocol that contains:  objectives of the research; rationale for the research, including scientific literature justifying the current proposal; overall study methods, including copies of forms, questionnaires, and consent forms used to contact facilities, physicians or study subjects; methods for documenting compliance with Department of Health and Human Services − Protection of Identity – Research Subjects; 42 CFR 2a.4(a) through (j), 2a.6(a) and (b), 2a.7(a) and (b)(1); methods for processing data; storage and security measures taken to ensure confidentiality of patient identifying information; time frame of the study; a description of the funding source of the study (e.g., federal contract); the curriculum vitae of the principal investigator; and a list of collaborators.  In addition, the research request must specify what patient identifying information is needed and how the information will be used.  Identifying information concerning the reporting entity will not be made available by the Department.  Identifying information is defined as any information, collection, or groups of data from which the identity of the patient or reporting entity to which it relates may be discerned, e.g., name, address or ID number.

c)         All requests to conduct research and modifications to approved research proposals involving the use of data that includes patient identifying information shall be subject to a review to determine compliance with the following conditions:

1)         The request for patient identifying information contains stated goals or objectives;

2)         The request documents the feasibility of the study design in achieving the stated goals and objectives;

3)         The request documents the need for the requested data to achieve the stated goals and objectives;

4)         The requested data can be provided within the time frame set forth in the request;

5)         The request documents that the researcher has qualifications relevant to the type of research being conducted;

6)         The research will not duplicate other research already underway using the same data when both require the contact of a patient involved in the previously approved concurrent research; and

7)         Other conditions relevant to the need for the patient identifying information and the patient's confidentiality rights.  (The Department will release only the patient identifying information that is necessary for research.)

d)         The Director or designee will review the request and approve or deny the request. The Information Agreement (Appendix B) shall contain the signatures of the Director and the applicant before data can be provided.  Reasons for denial may include the following:

1)         Confidentiality, privacy and/or security measures are unsatisfactory in the opinion of the Department;

2)         Data requested are unavailable or unreliable in the opinion of the Department;

3)         The stated purpose does not meet the Department's mission statement;

4)         The Department is unable to provide the data in the requested format;

5)         The applicant is not an accredited or licensed research institution, a government agency, legislative commission, or other organization with the ability  to conduct research, such as a university research center or private research firm; or

6)         The information cannot be provided by the requested date.

e)         Denied requests may be revised and resubmitted.

f)          Information Agreements

1)         The Department will enter into information agreements for all approved research requests.  These agreements shall specify the information that is being released and how it can be used in accordance with subsection (c) of this Section.  In addition, the researcher shall include an assurance that:

A)        Use of data is restricted to the specifications of the protocol;

B)        All data that may lead to the identity of any patient, research subject, physician, other person, or hospital are strictly privileged and confidential, and the researcher agrees to keep all such data strictly confidential at all times;

C)        All officers, agents and employees will keep all such data strictly confidential.  The researcher will communicate the requirements of this Section to all officers, agents and employees, will discipline all persons who may violate the requirements of this Section, and will notify the Department in writing within 48 hours after any violation of this Section, including full details of the violation and corrective actions to be taken;

D)        All data provided by the Department pursuant to the agreement may be used only for the purposes named in the agreement and any other or additional use of the data may result in immediate termination of the agreement by the Department; and

E)         All data provided by the Department pursuant to the agreement are the sole property of the Department and may not be copied or reproduced in any form or manner, except for research use by the researcher, and that all data, copies and reproductions of the data made for the researcher's internal use shall be returned to the Department upon termination of the agreement.

2)         Any departures from the approved protocol shall be submitted in writing and approved by the Director or designee in accordance with subsections (c) and (d) of this Section prior to initiation.  A researcher shall not release identifying information to a third party.

g)         Upon request, the Department shall disclose individual patient or reporting entity information to the reporting entity that originally supplied that information to the Department.

h)         By written reciprocating agreement, the Department may disclose individual patient information concerning residents of another state to the Childhood Lead Poisoning Prevention Program in the individual's state of residence only if the recipient of the information is legally required to hold the information in confidence and provides protection from disclosure of patient identifying information equivalent to the protection afforded by the Medical Studies Act.

i)          The identity of any person (or any group of facts that tends to lead to the identity of any person) whose blood test result is submitted to the Illinois Childhood Lead Poisoning Prevention Program is confidential and shall not be open to public inspection or dissemination.  Such information shall not be available for disclosure, inspection or copying under the Freedom of Information Act or the State Records Act.  All information for specific research purposes may be released in accordance with procedures established by the Department in this Section.

j)          The patient identifying information submitted to the Department by those entities required to submit information under the Act and this Part is to be used in the course of medical study under the Medical Studies Act and is privileged from disclosure by the Medical Studies Act.