Section 560.130  Confidentiality and Availability of Data

a)         All reports and records made pursuant to the Act and maintained by the Department and other appropriate persons, officials and institutions pursuant to the Act shall be confidential. Information shall not be made available to any individual or institution except to:

1)         Appropriate staff of the Department to determine the impact of violent acts on children. The Department shall report its findings to the General Assembly every 2 years by December 31;

2)         The Department for the purpose of injury prevention or determining the impact of violence.

A)        All information and data shared with the Department shall be kept confidential and limited to the scope of the project.  No data may be shared with the Department that could lead to the identity of any facility, or the identity of any person whose condition or treatment is submitted to the Department;

B)        The Department requesting data shall enter into a written agreement with the Division of EMS which shall include, at minimum:

i)          Data being requested;

ii)         Proposed usage of data; and

iii)        Responsible Individual charged with ensuring the confidentiality of the data.

C)        The written agreement must be approved by the providing and receiving Department Deputy Director and the Director of the Department.

3)         Bona Fide Researchers, with the permission of the Director of Public Health, except that no information identifying the subjects of the reports or the reporters shall be made available to researchers.

b)         All information and data reported shall be confidential and privileged in accordance with Part 21 of Article VIII of the Code of Civil Procedure [735 ILCS 5/Art. VIII, Part 21].  (Section 55.81 of the Civil Administrative Code of Illinois)

c)         The Department shall request consent for release from a patient, a physician or hospital only upon a showing by the applicant for such release that obtaining the identities of certain patients, physicians or hospitals is necessary for his bona fide research directly related to the objectives of the Act.

d)         The Department shall compile the reports required under subsection (a) of the Act.  The Department shall, using only data from which the identity of an individual cannot be ascertained, reconstructed, or verified and to which the identity of an individual cannot be linked by a recipient of the data, report its findings to the General Assembly by December 31, 1997, and every 2 years thereafter.

e)         Violent Injury Registry data may be available for medical or epidemiological research in accordance with subsection (f). All requests by medical or epidemiologic researchers for Registry data must be submitted in writing to the Department at https://dph.illinois.gov/data-statistics/institutional-review-board.html. The request must include a study protocol that contains:  objectives of the research; rationale for the research including scientific literature justifying the current proposal; overall study methods, including copies of forms, questionnaires, and consent forms used to contact facilities, physicians or study subjects; methods for the processing of data; storage and security measures taken to ensure confidentiality of patient and facility identifying information; time frame of the study; a description of the funding source of the study (e.g., federal contract); the curriculum vitae of the principal investigator and a list of collaborators.

f)         All requests to conduct research and modifications to approved research proposals involving the use of data that includes patient or facility identifying information shall be subject to a review to determine compliance with the following conditions:

1)         The request for patient or facility identifying information contains stated goals or objectives.

2)         The request documents the feasibility of the study design in achieving the stated goals and objectives.

3)         The request documents the need for the requested data to achieve the stated goals and objectives.

4)         The requested data can be provided within the time frame set forth in the request.

5)         The request clearly documents that the principal researcher has qualifications relevant to the type of research being conducted and qualifies as a bona fide researcher.

6)         The research will not duplicate other research already underway using the same registry data when both require the contact of a patient, reporting facility or physician about an individual patient involved in the previously approved concurrent research.

g)         The Department will enter into a written Research Agreement for all approved research requests. The Agreement shall specify the information that is being released and how it can be used, in accordance with subsection (e) above. The Department will only provide available data relevant to the goals and objectives of the specific research approved by the Department.

h)         The identity of any facility, or any group of facts that tends to lead to the identity of any person whose condition or treatment is submitted to the Department, shall not be open to public inspection or dissemination.

i)          Every hospital shall provide representatives of the Department with access to information from all medical, pathological, and other pertinent records and logs related to reportable registry information. The Department shall not require hospitals to provide information on cases that are dated more than two years before the Department's request for further information.

j)          Every hospital shall provide access to information regarding specified patients or other patients specified for research studies, related to reportable registry information, conducted by the Department.

(Source:  Added at 46 Ill. Reg. 15715, effective August 30, 2022)