(410 ILCS 130/145)
    (Section scheduled to be repealed on July 1, 2020)
    Sec. 145. Confidentiality.
    (a) The following information received and records kept by the Department of Public Health, Department of Financial and Professional Regulation, Department of Agriculture, or Department of State Police for purposes of administering this Act are subject to all applicable federal privacy laws, confidential, and exempt from the Freedom of Information Act, and not subject to disclosure to any individual or public or private entity, except as necessary for authorized employees of those authorized agencies to perform official duties under this Act and the following information received and records kept by Department of Public Health, Department of Agriculture, Department of Financial and Professional Regulation, and Department of State Police, excluding any existing or non-existing Illinois or national criminal history record information as defined in subsection (d), may be disclosed to each other upon request:
        (1) Applications and renewals, their contents, and
    
supporting information submitted by qualifying patients and designated caregivers, including information regarding their designated caregivers and physicians.
        (2) Applications and renewals, their contents, and
    
supporting information submitted by or on behalf of cultivation centers and dispensing organizations in compliance with this Act, including their physical addresses.
        (3) The individual names and other information
    
identifying persons to whom the Department of Public Health has issued registry identification cards.
        (4) Any dispensing information required to be kept
    
under Section 135, Section 150, or Department of Public Health, Department of Agriculture, or Department of Financial and Professional Regulation rules shall identify cardholders and registered cultivation centers by their registry identification numbers and medical cannabis dispensing organizations by their registration number and not contain names or other personally identifying information.
        (5) All medical records provided to the Department of
    
Public Health in connection with an application for a registry card.
    (b) Nothing in this Section precludes the following:
        (1) Department of Agriculture, Department of
    
Financial and Professional Regulation, or Public Health employees may notify law enforcement about falsified or fraudulent information submitted to the Departments if the employee who suspects that falsified or fraudulent information has been submitted conferred with his or her supervisor and both agree that circumstances exist that warrant reporting.
        (2) If the employee conferred with his or her
    
supervisor and both agree that circumstances exist that warrant reporting, Department of Public Health employees may notify the Department of Financial and Professional Regulation if there is reasonable cause to believe a physician:
            (A) issued a written certification without a bona
        
fide physician-patient relationship under this Act;
            (B) issued a written certification to a person
        
who was not under the physician's care for the debilitating medical condition; or
            (C) failed to abide by the acceptable and
        
prevailing standard of care when evaluating a patient's medical condition.
        (3) The Department of Public Health, Department of
    
Agriculture, and Department of Financial and Professional Regulation may notify State or local law enforcement about apparent criminal violations of this Act if the employee who suspects the offense has conferred with his or her supervisor and both agree that circumstances exist that warrant reporting.
        (4) Medical cannabis cultivation center agents and
    
medical cannabis dispensing organizations may notify the Department of Public Health, Department of Financial and Professional Regulation, or Department of Agriculture of a suspected violation or attempted violation of this Act or the rules issued under it.
        (5) Each Department may verify registry
    
identification cards under Section 150.
        (6) The submission of the report to the General
    
Assembly under Section 160.
    (c) It is a Class B misdemeanor with a $1,000 fine for any person, including an employee or official of the Department of Public Health, Department of Financial and Professional Regulation, or Department of Agriculture or another State agency or local government, to breach the confidentiality of information obtained under this Act.
    (d) The Department of Public Health, the Department of Agriculture, the Department of State Police, and the Department of Financial and Professional Regulation shall not share or disclose any existing or non-existing Illinois or national criminal history record information. For the purposes of this Section, "any existing or non-existing Illinois or national criminal history record information" means any Illinois or national criminal history record information, including but not limited to the lack of or non-existence of these records.
(Source: P.A. 98-122, eff. 1-1-14; 98-1172, eff. 1-12-15.)