Section 2080.210  Access to the Prescription Information Library (PIL)


a)         Any entity choosing to undergo electronic integration should do so using the process in this subsection (a).


1)         The entity shall email dhs.pmp@illinois.gov to request the Automated Connection Guide (ACG) and shall review its contents once the ACG is received.


A)        The ACG describes the electronic message exchange processing flow and provides all the technical specifications for the transaction.


B)        The entity shall share the ACG with its EHR vendor and its information technology support team to begin work to prepare for the electronic integration.


2)         The entity shall determine its connectivity to the PMP for electronic integration.


A)        The PMP Automated Connection supports two connectivity options.  The entity must use one of the following connectivity options:


i)          a SOAP based web service that uses a PMIX based protocol; or


ii)         a RESTful based web service that uses the NCPDP protocol.


B)        The entity shall complete the Meaningful Use Registration of Intent with the Illinois Department of Public Health (https://murs.illinois.gov).  Once the Meaningful Use Registration of Intent is completed, the PMP will arrange a connectivity consultation with the entity.


3)         The PMP will set up a secure, HIPAA compliant electronic integration testing environment during the connectivity determination process for use to test transactions.  This testing environment shall be used by the entity to test transactions before moving to production.


4)         Following successful testing, the connection is ready to be activated.  The PMP will activate the production environment for the entity's use in exchanging transactions and the electronic integration process is complete.


A)        The participating entities must maintain both electronic and physical security of the information.


B)        Security failures or misuse of the account will be handled as any other case of HIPAA violation pursuant to 42 USC 1320 et seq.


b)         Medical prescribers or dispensers or their authorized designee may utilize the PIL for patient care after obtaining authorization from the PMP.


c)         Only the following licensed healthcare professionals shall serve as an authorized designee for a prescriber or dispenser for office or pharmacy practice sites:


1)         registered nurse;


2)         licensed practical nurse;


3)         pharmacy technician;


4)         student pharmacist; or


5)         certified medical assistant.


d)         The prescriber or dispenser shall only have up to three designees.


e)         The prescriber and dispenser shall register the designees and must also agree to the terms and conditions for designees.


f)         Each designee shall have an individual account that must be linked to the prescriber or dispenser.


g)         PMP staff shall verify the following information about each designee:


1)         license/certification number;


2)         employer's phone number and address; and


3)         work email address.  If no work email is available, PMP staff shall contact the prescriber or dispenser to verify the designee.


h)         PMP shall send out a notice for the prescriber or dispenser to ensure continued employment of their designees.  If the designee is no longer employed with the prescriber or dispenser, the prescriber or dispenser shall terminate the designee's access to the PMP by locking the designee's account or by notifying the PMP that the designee's account should be locked.


i)          A user may only access the PIL for a patient's medical treatment.


j)          Department staff shall develop, modify and maintain data files of the PIL.


k)         PIL users are ultimately responsible for any usage of their authorization credentials.


l)          In order to expedite the approval and oversight of PIL applicants and users, the PIL must be managed by a licensed dispenser.


m)        PIL staff determine if a PIL user applicant may become a PIL user by using the following criteria:


1)         Applicant's first and last name;


2)         Pharmacy, clinic or office street address, city, state and zip code;


3)         DEA number;


4)         For a pharmacist's application, the pharmacy DEA number;


5)         Illinois prescriber or dispenser license number; and


6)         Business telephone number.


n)         PIL staff determine if a PIL user applicant may become a PIL group user by applying the following criteria:


1)         The prescriber or dispenser who will be the account's custodian shall provide the following information:


A)        First and last name;


B)        DEA number;


C)        National Provider Identifier (NPI) number;


D)        Illinois prescriber or dispenser license number; and


E)        Business telephone number;


2)         Hospital emergency department's or freestanding clinic's street address, city, state and zip code;


3)         The pharmacist-in-charge (PIC) as the central user of the hospital pharmacy; and


4)         A listing of all users with the following information:


A)        First and last name; and


B)        Illinois healthcare license number.


o)         The Clinical Director or designee shall review user applications that are unusual and render a professional decision as to whether access shall be granted.


p)         The PMP Assistant Administrator shall review the user access log for any unusual or improper activity by a user.


q)         The Clinical Director or his or her designee shall directly monitor the development, modification and/or expansion of the PIL.


(Source:  Amended at 41 Ill. Reg. 11909, effective September 13, 2017)