SB2900 101ST GENERAL ASSEMBLY

LRB101 18188 CPF 67630 b

101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
SB2900

Introduced 2/4/2020, by Sen. Julie A. Morrison

SYNOPSIS AS INTRODUCED:

410 ILCS 50/3

from Ch. 111 1/2, par. 5403

Amends the Medical Patient Rights Act. Provides that if a covered entity under the federal Health Insurance Portability and Accountability Act of 1996 intends to use or disclose an individual's protected and individually identifiable health information to engage in fundraising communications or communications for marketing purposes, the covered entity must, prior to the use or disclosure, obtain valid authorization from the individual who is the subject of the protected and individually identifiable health information. Contains language stating the intent of the General Assembly. Effective immediately.

A BILL FOR

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Medical Patient Rights Act is amended by changing Section 3 as follows:

(410 ILCS 50/3) (from Ch. 111 1/2, par. 5403)

Sec. 3. The following rights are hereby established:

(a) The right of each patient to care consistent with sound nursing and medical practices, to be informed of the name of the physician responsible for coordinating his or her care, to receive information concerning his or her condition and proposed treatment, to refuse any treatment to the extent permitted by law, and to privacy and confidentiality of records except as otherwise provided by law.

(b) The right of each patient, regardless of source of payment, to examine and receive a reasonable explanation of his total bill for services rendered by his physician or health care provider, including the itemized charges for specific services received. Each physician or health care provider shall be responsible only for a reasonable explanation of those specific services provided by such physician or health care provider.

(c) In the event an insurance company or health services corporation cancels or refuses to renew an individual policy or plan, the insured patient shall be entitled to timely, prior notice of the termination of such policy or plan.

An insurance company or health services corporation that requires any insured patient or applicant for new or continued insurance or coverage to be tested for infection with human immunodeficiency virus (HIV) or any other identified causative agent of acquired immunodeficiency syndrome (AIDS) shall (1) give the patient or applicant prior written notice of such requirement, (2) proceed with such testing only upon the written authorization of the applicant or patient, and (3) keep the results of such testing confidential. Notice of an adverse underwriting or coverage decision may be given to any appropriately interested party, but the insurer may only disclose the test result itself to a physician designated by the applicant or patient, and any such disclosure shall be in a manner that assures confidentiality.

The Department of Insurance shall enforce the provisions of this subsection.

(d) The right of each patient to privacy and confidentiality in health care. Each physician, health care provider, health services corporation and insurance company shall refrain from disclosing the nature or details of services provided to patients, except that such information may be disclosed: (1) to the patient, (2) to the party making treatment decisions if the patient is incapable of making decisions regarding the health services provided, (3) for treatment in accordance with 45 CFR 164.501 and 164.506, (4) for payment in accordance with 45 CFR 164.501 and 164.506, (5) to those parties responsible for peer review, utilization review, and quality assurance, (6) for health care operations in accordance with 45 CFR 164.501 and 164.506, (7) to those parties required to be notified under the Abused and Neglected Child Reporting Act or the Illinois Sexually Transmissible Disease Control Act, or (8) as otherwise permitted, authorized, or required by State or federal law. This right may be waived in writing by the patient or the patient's guardian or legal representative, but a physician or other health care provider may not condition the provision of services on the patient's, guardian's, or legal representative's agreement to sign such a waiver. In the interest of public health, safety, and welfare, patient information, including, but not limited to, health information, demographic information, and information about the services provided to patients, may be transmitted to or through a health information exchange, as that term is defined in Section 2 of the Mental Health and Developmental Disabilities Confidentiality Act, in accordance with the disclosures permitted pursuant to this Section. Patients shall be provided the opportunity to opt out of their health information being transmitted to or through a health information exchange in accordance with the regulations, standards, or contractual obligations adopted by the Illinois Health Information Exchange Authority in accordance with Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, Section 9.6 of the AIDS Confidentiality Act, or Section 31.8 of the Genetic Information Privacy Act, as applicable. In the case of a patient choosing to opt out of having his or her information available on an HIE, nothing in this Act shall cause the physician or health care provider to be liable for the release of a patient's health information by other entities that may possess such information, including, but not limited to, other health professionals, providers, laboratories, pharmacies, hospitals, ambulatory surgical centers, and nursing homes.

(e) In this subsection:

"Covered entity" means a covered entity under the federal Health Insurance Portability and Accountability Act of 1996 or any rules adopted under that Act.

"Marketing" means making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

"Opt in" means a patient consenting in writing using the patient's initials or signature.

"Valid authorization" means:

(A) for use or disclosure of protected and individually identifiable health information to engage in fundraising communications, an individual has opted in to receiving communications from a covered entity to raise funds; or

(B) for use or disclosure of protected and individually identifiable health information for marketing purposes, an individual has opted in to receiving communications from a covered entity for marketing purposes.

If a covered entity intends to use or disclose an individual's protected and individually identifiable health information to engage in fundraising communications or for marketing purposes, the covered entity must, prior to the use or disclosure, obtain valid authorization from the individual who is the subject of the protected and individually identifiable health information.

It is the intent of the General Assembly that the requirements of this subsection (e) increase privacy protections afforded to an individual who is the subject of the protected and individually identifiable health information.

(Source: P.A. 98-1046, eff. 1-1-15.)

Section 99. Effective date. This Act takes effect upon becoming law.