HB3513 97TH GENERAL ASSEMBLY

LRB097 09903 AEK 50066 b

97TH GENERAL ASSEMBLY
State of Illinois
2011 and 2012
HB3513

Introduced 2/24/2011, by Rep. Sandra M. Pihos

SYNOPSIS AS INTRODUCED:

815 ILCS 530/35 new

Amends the Personal Information Protection Act. Prohibits a person or entity, not including a State or local agency, from: (i) publicly posting or publicly displaying in any manner an individual's social security number; (ii) printing an individual's social security number on any card required for the individual to access products or services provided by the person or entity; (iii) track personal or medical data using an individual's social security number (iv) requiring an individual to transmit his or her social security number over the Internet unless the connection is secure or the social security number is encrypted; (v) requiring an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Web site; or (vi) printing an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed. Makes an exception for applications and forms sent by mail to include social security numbers. Provides that the use of a social security number is not prohibited for the collection, use, or release of a social security number as required by State or federal law or the use of a social security number for internal verification or administrative purposes. Effective January 1, 2012.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Personal Information Protection Act is amended by adding Section 35 as follows:

(815 ILCS 530/35 new)

Sec. 35. Social security numbers.

(a) A person or entity, not including a State or local agency, shall not do any of the following:

(1) Publicly post or publicly display in any manner an individual's social security number.

(2) Print an individual's social security number on any card required for the individual to access products or services provided by the person or entity.

(3) Track personal or medical data using an individual's social security number.

(4) Require an individual to transmit his or her social security number over the Internet unless the connection is secure or the social security number is encrypted.

(5) Require an individual to use his or her social security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the website.

(6) Print an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed. Notwithstanding this provision, applications and forms sent by mail may include social security numbers.

(b) This Section does not prevent the collection, use, or release of a social security number as required by State or federal law or the use of a social security number for internal verification or administrative purposes.

(c) This Section does not apply to records that are required by statute, case law, or the Illinois Supreme Court to be made available to the public.

(d) The Director of Public Health or the Director of Insurance, upon a determination of good cause, may grant extensions not to exceed 6 months for compliance by health care service plans and insurers with the requirements of this Section when requested by the health care service plan provider or insurer. Any extension granted shall apply to the health care service plan provider or insurer's affected providers, pharmacy benefits manager, and contractors.

(e) As used in this Section:

"Contractor" means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan provider or a health care provider.

"Health care provider" means any physician, hospital facility, or other person licensed or otherwise authorized to deliver care services.

"Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

Section 99. Effective date. This Act takes effect January 1, 2012.