Shown verbatim: the complete text as captured from the official PDF posted by the Illinois General Assembly, fetched 2026-09-25. Page and line markers are part of the official record; nothing is edited or removed. This is the current version. The official bill page.
SB2886 Enrolled LRB104 17128 BDA 30547 b
1 AN ACT concerning health.
2 Be it enacted by the People of the State of Illinois,
3 represented in the General Assembly:
4 Section 5. The Genetic Information Privacy Act is amended
5 by changing Sections 5, 10, 15, 20, 25, 30, 31, 31.1, 31.2,
6 31.3, 31.5, 31.7, 31.8, 31.9, 31.10, and 50 as follows:
7 (410 ILCS 513/5)
8 Sec. 5. Legislative findings; intent. The General Assembly
9 finds that:
10 (1) The use of genetic testing, biomarker testing, or
11 both can be valuable to an individual.
12 (2) Despite existing laws, regulations, and
13 professional standards which require or promote voluntary
14 and confidential use of genetic testing and biomarker
15 testing information, many members of the public are
16 deterred from seeking genetic testing or biomarker testing
17 because of fear that test results will be disclosed
18 without consent in a manner not permitted by law or will be
19 used in a discriminatory manner.
20 (3) The public health will be served by facilitating
21 voluntary and confidential nondiscriminatory use of
22 genetic testing and biomarker testing information.
23 (4) The use of electronic health record systems and
SB2886 Enrolled -2- LRB104 17128 BDA 30547 b
1 the exchange of patient records, both paper and
2 electronic, through secure means, including through secure
3 health information exchanges, should be encouraged to
4 improve patient health care and care coordination,
5 facilitate public health reporting, and control health
6 care costs, among other purposes.
7 (5) Limiting the use or disclosure of, and requests
8 for, protected health information to the minimum necessary
9 to accomplish an intended purpose, when being transmitted
10 by or on behalf of a covered entity under HIPAA, is a key
11 component of health information privacy. The disclosure of
12 genetic information or biomarkers, when allowed by this
13 Act, shall be performed in accordance with the minimum
14 necessary standard when required under HIPAA.
15 (Source: P.A. 98-1046, eff. 1-1-15.)
16 (410 ILCS 513/10)
17 Sec. 10. Definitions. As used in this Act:
18 "Biomarker" has the meaning ascribed to it in Section
19 356z.46 of the Illinois Insurance Code.
20 "Biomarker testing" has the meaning ascribed to it in
21 Section 356z.46 of the Illinois Insurance Code.
22 "Business associate" has the meaning ascribed to it under
23 HIPAA, as specified in 45 CFR 160.103.
24 "Covered entity" has the meaning ascribed to it under
25 HIPAA, as specified in 45 CFR 160.103.
SB2886 Enrolled -3- LRB104 17128 BDA 30547 b
1 "De-identified information" means health information that
2 is not individually identifiable as described under HIPAA, as
3 specified in 45 CFR 164.514(b).
4 "Disclosure" has the meaning ascribed to it under HIPAA,
5 as specified in 45 CFR 160.103.
6 "Employer" means the State of Illinois, any unit of local
7 government, and any board, commission, department,
8 institution, or school district, any party to a public
9 contract, any joint apprenticeship or training committee
10 within the State, and every other person employing employees
11 within the State.
12 "Employment agency" means both public and private
13 employment agencies and any person, labor organization, or
14 labor union having a hiring hall or hiring office regularly
15 undertaking, with or without compensation, to procure
16 opportunities to work, or to procure, recruit, refer, or place
17 employees.
18 "Family member" means, with respect to an individual, (i)
19 the spouse of the individual; (ii) a dependent child of the
20 individual, including a child who is born to or placed for
21 adoption with the individual; (iii) any other person
22 qualifying as a covered dependent under a managed care plan;
23 and (iv) all other individuals related by blood or law to the
24 individual or the spouse or child described in subsections (i)
25 through (iii) of this definition.
26 "Genetic information" has the meaning ascribed to it under
SB2886 Enrolled -4- LRB104 17128 BDA 30547 b
1 HIPAA, as specified in 45 CFR 160.103.
2 "Genetic monitoring" means the periodic examination of
3 employees to evaluate acquired modifications to their genetic
4 material, such as chromosomal damage or evidence of increased
5 occurrence of mutations that may have developed in the course
6 of employment due to exposure to toxic substances in the
7 workplace in order to identify, evaluate, and respond to
8 effects of or control adverse environmental exposures in the
9 workplace.
10 "Genetic services" has the meaning ascribed to it under
11 HIPAA, as specified in 45 CFR 160.103.
12 "Genetic testing" and "genetic test" have the meaning
13 ascribed to "genetic test" under HIPAA, as specified in 45 CFR
14 160.103. "Genetic testing" includes direct-to-consumer
15 commercial genetic testing.
16 "Health care operations" has the meaning ascribed to it
17 under HIPAA, as specified in 45 CFR 164.501.
18 "Health care professional" means (i) a licensed physician,
19 (ii) a licensed physician assistant, (iii) a licensed advanced
20 practice registered nurse, (iv) a licensed dentist, (v) a
21 licensed podiatric physician, (vi) a licensed genetic
22 counselor, or (vii) an individual certified to provide genetic
23 testing by a state or local public health department.
24 "Health care provider" has the meaning ascribed to it
25 under HIPAA, as specified in 45 CFR 160.103.
26 "Health facility" means a hospital, blood bank, blood
SB2886 Enrolled -5- LRB104 17128 BDA 30547 b
1 center, sperm bank, or other health care institution,
2 including any "health facility" as that term is defined in the
3 Illinois Finance Authority Act.
4 "Health information exchange" or "HIE" means a health
5 information exchange or health information organization that
6 exchanges health information electronically. In certain
7 circumstances, in accordance with HIPAA, an HIE will be a
8 business associate.
9 "Health oversight agency" has the meaning ascribed to it
10 under HIPAA, as specified in 45 CFR 164.501.
11 "HIPAA" means the Health Insurance Portability and
12 Accountability Act of 1996, Public Law 104-191, as amended by
13 the Health Information Technology for Economic and Clinical
14 Health Act of 2009, Public Law 111-05, and any subsequent
15 amendments thereto and any regulations promulgated thereunder.
16 "Insurer" means (i) an entity that is subject to the
17 jurisdiction of the Director of Insurance and (ii) a managed
18 care plan.
19 "Labor organization" includes any organization, labor
20 union, craft union, or any voluntary unincorporated
21 association designed to further the cause of the rights of
22 union labor that is constituted for the purpose, in whole or in
23 part, of collective bargaining or of dealing with employers
24 concerning grievances, terms or conditions of employment, or
25 apprenticeships or applications for apprenticeships, or of
26 other mutual aid or protection in connection with employment,
SB2886 Enrolled -6- LRB104 17128 BDA 30547 b
1 including apprenticeships or applications for apprenticeships.
2 "Licensing agency" means a board, commission, committee,
3 council, department, or officers, except a judicial officer,
4 in this State or any political subdivision authorized to
5 grant, deny, renew, revoke, suspend, annul, withdraw, or amend
6 a license or certificate of registration.
7 "Limited data set" has the meaning ascribed to it under
8 HIPAA, as described in 45 CFR 164.514(e)(2).
9 "Managed care plan" means a plan that establishes,
10 operates, or maintains a network of health care providers that
11 have entered into agreements with the plan to provide health
12 care services to enrollees where the plan has the ultimate and
13 direct contractual obligation to the enrollee to arrange for
14 the provision of or pay for services through:
15 (1) organizational arrangements for ongoing quality
16 assurance, utilization review programs, or dispute
17 resolution; or
18 (2) financial incentives for persons enrolled in the
19 plan to use the participating providers and procedures
20 covered by the plan.
21 A managed care plan may be established or operated by any
22 entity including a licensed insurance company, hospital or
23 medical service plan, health maintenance organization, limited
24 health service organization, preferred provider organization,
25 third party administrator, or an employer or employee
26 organization.
SB2886 Enrolled -7- LRB104 17128 BDA 30547 b
1 "Minimum necessary" means HIPAA's standard for using,
2 disclosing, and requesting protected health information found
3 in 45 CFR 164.502(b) and 164.514(d).
4 "Nontherapeutic purpose" means a purpose that is not
5 intended to improve or preserve the life or health of the
6 individual whom the information concerns.
7 "Organized health care arrangement" has the meaning
8 ascribed to it under HIPAA, as specified in 45 CFR 160.103.
9 "Patient safety activities" has the meaning ascribed to it
10 under 42 CFR 3.20.
11 "Payment" has the meaning ascribed to it under HIPAA, as
12 specified in 45 CFR 164.501.
13 "Person" includes any natural person, partnership,
14 association, joint venture, trust, governmental entity, public
15 or private corporation, health facility, or other legal
16 entity.
17 "Protected health information" has the meaning ascribed to
18 it under HIPAA, as specified in 45 CFR 164.103.
19 "Research" has the meaning ascribed to it under HIPAA, as
20 specified in 45 CFR 164.501.
21 "State agency" means an instrumentality of the State of
22 Illinois and any instrumentality of another state which
23 pursuant to applicable law or a written undertaking with an
24 instrumentality of the State of Illinois is bound to protect
25 the privacy of genetic information of Illinois persons or
26 biomarkers of Illinois persons.
SB2886 Enrolled -8- LRB104 17128 BDA 30547 b
1 "Treatment" has the meaning ascribed to it under HIPAA, as
2 specified in 45 CFR 164.501.
3 "Use" has the meaning ascribed to it under HIPAA, as
4 specified in 45 CFR 160.103, where context dictates.
5 (Source: P.A. 103-508, eff. 8-4-23; 104-417, eff. 8-15-25.)
6 (410 ILCS 513/15)
7 Sec. 15. Confidentiality of genetic information.
8 (a) Except as otherwise provided in this Act, biomarker
9 testing, information derived from biomarker testing, genetic
10 testing, and information derived from genetic testing are is
11 confidential and privileged and may be released only to the
12 individual tested and to persons specifically authorized, in
13 writing in accordance with Section 30, by that individual to
14 receive the information. Except as otherwise provided in
15 subsection (b) and in Section 30, this information shall not
16 be admissible as evidence, nor discoverable in any action of
17 any kind in any court, or before any tribunal, board, agency,
18 or person pursuant to Part 21 of Article VIII of the Code of
19 Civil Procedure. No liability shall attach to any hospital,
20 physician, or other health care provider for compliance with
21 the provisions of this Act including a specific written
22 release by the individual in accordance with this Act.
23 (b) When a biological sample is legally obtained by a
24 peace officer for use in a criminal investigation or
25 prosecution, information derived from genetic testing of that
SB2886 Enrolled -9- LRB104 17128 BDA 30547 b
1 sample may be disclosed for identification purposes to
2 appropriate law enforcement authorities conducting the
3 investigation or prosecution and may be used in accordance
4 with Section 5-4-3 of the Unified Code of Corrections. The
5 information may be used for identification purposes during the
6 course of the investigation or prosecution with respect to the
7 individual tested without the consent of the individual and
8 shall be admissible as evidence in court.
9 The information shall be confidential and may be disclosed
10 only for purposes of criminal investigation or prosecution.
11 Genetic testing and genetic information derived thereof
12 shall be admissible as evidence and discoverable, subject to a
13 protective order, in any actions alleging a violation of this
14 Act, seeking to enforce Section 30 of this Act through the
15 Illinois Insurance Code, alleging discriminatory genetic
16 testing or use of genetic information under the Illinois Human
17 Rights Act or the Illinois Civil Rights Act of 2003, or
18 requesting a workers' compensation claim under the Workers'
19 Compensation Act.
20 (c) If the subject of the information requested by law
21 enforcement is found innocent of the offense or otherwise not
22 criminally penalized, then the court records shall be expunged
23 by the court within 30 days after the final legal proceeding.
24 The court shall notify the subject of the information of the
25 expungement of the records in writing.
26 (d) Results of genetic testing that indicate that the
SB2886 Enrolled - 10 - LRB104 17128 BDA 30547 b
1 individual tested is at the time of the test afflicted with a
2 disease, whether or not currently symptomatic, are not subject
3 to the confidentiality requirements of this Act.
4 (Source: P.A. 95-927, eff. 1-1-09.)
5 (410 ILCS 513/20)
6 Sec. 20. Use of genetic testing information for insurance
7 purposes.
8 (a) An insurer may not seek information derived from
9 genetic testing or biomarker testing for use in connection
10 with a policy of accident and health insurance. Except as
11 provided in subsection (c), an insurer that receives
12 information derived from genetic testing or biomarker testing,
13 regardless of the source of that information, may not use the
14 information for a nontherapeutic purpose as it relates to a
15 policy of accident and health insurance.
16 (b) An insurer shall not use or disclose protected health
17 information that is genetic information or a biomarker for
18 underwriting purposes. For purposes of this Section,
19 "underwriting purposes" means, with respect to an insurer:
20 (1) rules for, or determination of, eligibility
21 (including enrollment and continued eligibility) for, or
22 determination of, benefits under the plan, coverage, or
23 policy (including changes in deductibles or other
24 cost-sharing mechanisms in return for activities such as
25 completing a health risk assessment or participating in a
SB2886 Enrolled - 11 - LRB104 17128 BDA 30547 b
1 wellness program);
2 (2) the computation of premium or contribution amounts
3 under the plan, coverage, or policy (including discounts,
4 rebates, payments in kind, or other premium differential
5 mechanisms in return for activities, such as completing a
6 health risk assessment or participating in a wellness
7 program);
8 (3) the application of any pre-existing condition
9 exclusion under the plan, coverage, or policy; and
10 (4) other activities related to the creation, renewal,
11 or replacement of a contract of health insurance or health
12 benefits.
13 "Underwriting purposes" does not include determinations of
14 medical appropriateness where an individual seeks a benefit
15 under the plan, coverage, or policy.
16 This subsection (b) does not apply to insurers that are
17 issuing a long-term care policy, excluding a nursing home
18 fixed indemnity plan.
19 (c) An insurer may consider the results of genetic testing
20 or biomarker testing in connection with a policy of accident
21 and health insurance if the individual voluntarily submits the
22 results and the results are favorable to the individual.
23 (d) An insurer that possesses information derived from
24 genetic testing or biomarker testing may not release the
25 information to a third party, except as specified in this Act.
26 (e) A company providing direct-to-consumer commercial
SB2886 Enrolled - 12 - LRB104 17128 BDA 30547 b
1 genetic testing or biomarker testing is prohibited from
2 sharing any genetic test information or biomarker information
3 or other personally identifiable information about a consumer
4 with any health or life insurance company without written
5 consent from the consumer.
6 (Source: P.A. 101-132, eff. 1-1-20.)
7 (410 ILCS 513/25)
8 Sec. 25. Use of genetic testing information or biomarker
9 testing information by employers.
10 (a) An employer, employment agency, labor organization,
11 and licensing agency shall treat genetic testing, and genetic
12 information, biomarker testing, and biomarkers in such a
13 manner that is consistent with the requirements of federal
14 law, including but not limited to the Genetic Information
15 Nondiscrimination Act of 2008, the Americans with Disabilities
16 Act, Title VII of the Civil Rights Act of 1964, the Family and
17 Medical Leave Act of 1993, the Occupational Safety and Health
18 Act of 1970, the Federal Mine Safety and Health Act of 1977, or
19 the Atomic Energy Act of 1954.
20 (b) An employer may release genetic testing or biomarker
21 testing information only in accordance with this Act.
22 (c) An employer, employment agency, labor organization,
23 and licensing agency shall not directly or indirectly do any
24 of the following:
25 (1) solicit, request, require, or purchase biomarker
SB2886 Enrolled - 13 - LRB104 17128 BDA 30547 b
1 testing, biomarkers, genetic testing, or genetic
2 information of a person or a family member of the person,
3 or administer a genetic test or biomarker test to a person
4 or a family member of the person as a condition of
5 employment, preemployment application, labor organization
6 membership, or licensure;
7 (2) affect the terms, conditions, or privileges of
8 employment, preemployment application, labor organization
9 membership, or licensure, or terminate the employment,
10 labor organization membership, or licensure of any person
11 because of biomarker testing, biomarkers, genetic testing,
12 or genetic information with respect to the employee or
13 family member, or information about a request for or the
14 receipt of genetic testing or biomarker testing by such
15 employee or family member of such employee;
16 (3) limit, segregate, or classify employees in any way
17 that would deprive or tend to deprive any employee of
18 employment opportunities or otherwise adversely affect the
19 status of the employee as an employee because of biomarker
20 testing, biomarkers, genetic testing, or genetic
21 information with respect to the employee or a family
22 member, or information about a request for or the receipt
23 of biomarker testing, biomarkers, genetic testing, or
24 genetic information by such employee or family member of
25 such employee; and
26 (4) retaliate through discharge or in any other manner
SB2886 Enrolled - 14 - LRB104 17128 BDA 30547 b
1 against any person alleging a violation of this Act or
2 participating in any manner in a proceeding under this
3 Act.
4 (d) An agreement between a person and an employer,
5 prospective employer, employment agency, labor organization,
6 or licensing agency, or its employees, agents, or members
7 offering the person employment, labor organization membership,
8 licensure, or any pay or benefit in return for taking a genetic
9 test or biomarker test is prohibited.
10 (e) An employer shall not use biomarker testing,
11 biomarkers, genetic information, or genetic testing in
12 furtherance of a workplace wellness program benefiting
13 employees unless (1) health or genetic services are offered by
14 the employer, (2) the employee provides written authorization
15 in accordance with Section 30 of this Act, (3) only the
16 employee or family member if the family member is receiving
17 genetic services and the licensed health care professional or
18 licensed genetic counselor involved in providing such services
19 receive individually identifiable information concerning the
20 results of such services, and (4) any individually
21 identifiable information is only available for purposes of
22 such services and shall not be disclosed to the employer
23 except in aggregate terms that do not disclose the identity of
24 specific employees. An employer shall not penalize an employee
25 who does not disclose his or her genetic information or
26 biomarkers or does not choose to participate in a program
SB2886 Enrolled - 15 - LRB104 17128 BDA 30547 b
1 requiring disclosure of the employee's genetic information or
2 biomarkers.
3 (f) Nothing in this Act shall be construed to prohibit
4 biomarker testing or genetic testing of an employee who
5 requests a biomarker test or genetic test and who provides
6 written authorization, in accordance with Section 30 of this
7 Act, from taking a biomarker test or genetic test for the
8 purpose of initiating a workers' compensation claim under the
9 Workers' Compensation Act.
10 (g) A purchase of commercially and publicly available
11 documents, including newspapers, magazines, periodicals, and
12 books but not including medical databases or court records or
13 inadvertently requesting family medical history by an
14 employer, employment agency, labor organization, and licensing
15 agency does not violate this Act.
16 (h) Nothing in this Act shall be construed to prohibit an
17 employer that conducts DNA analysis for law enforcement
18 purposes as a forensic laboratory and that includes such
19 analysis in the Combined DNA Index System pursuant to the
20 federal Violent Crime Control and Law Enforcement Act of 1994
21 from requesting or requiring genetic testing or genetic
22 information of such employer's employees, but only to the
23 extent that such genetic testing or genetic information is
24 used for analysis of DNA identification markers for quality
25 control to detect sample contamination.
26 (i) Nothing in this Act shall be construed to prohibit an
SB2886 Enrolled - 16 - LRB104 17128 BDA 30547 b
1 employer from requesting or requiring genetic information to
2 be used for genetic monitoring of the biological effects of
3 toxic substances in the workplace, but only if (1) the
4 employer provides written notice of the genetic monitoring to
5 the employee; (2) the employee provides written authorization
6 under Section 30 of this Act or the genetic monitoring is
7 required by federal or State law; (3) the employee is informed
8 of individual monitoring results; (4) the monitoring is in
9 compliance with any federal genetic monitoring regulations or
10 State genetic monitoring regulations under the authority of
11 the federal Occupational Safety and Health Act of 1970; and
12 (5) the employer, excluding any health care provider, health
13 care professional, or health facility that is involved in the
14 genetic monitoring program, receives the results of the
15 monitoring only in aggregate terms that do not disclose the
16 identity of specific employees.
17 (j) Despite lawful acquisition of biomarker testing,
18 biomarkers, genetic testing, or genetic information under
19 subsections (e) through (i) of this Section, an employer,
20 employment agency, labor organization, and licensing agency
21 still may not use or disclose the biomarker test, biomarkers,
22 genetic test, or genetic information in violation of this Act.
23 (k) Except as provided in subsections (e), (f), (h), and
24 (i) of this Section, a person shall not knowingly sell to or
25 interpret for an employer, employment agency, labor
26 organization, or licensing agency, or its employees, agents,
SB2886 Enrolled - 17 - LRB104 17128 BDA 30547 b
1 or members, a biomarker test or genetic test of an employee,
2 labor organization member, or license holder, or of a
3 prospective employee, member, or license holder.
4 (Source: P.A. 100-396, eff. 1-1-18.)
5 (410 ILCS 513/30)
6 Sec. 30. Disclosure of person tested and test results.
7 (a) No person may disclose or be compelled to disclose the
8 identity of any person upon whom a genetic test or biomarker
9 test is performed or the results of a genetic test or biomarker
10 test in a manner that permits identification of the subject of
11 the test, except to the following persons:
12 (1) The subject of the test or the subject's legally
13 authorized representative. This paragraph does not create
14 a duty or obligation under which a health care provider
15 must notify the subject's spouse or legal guardian of the
16 test results, and no such duty or obligation shall be
17 implied. No civil liability or criminal sanction under
18 this Act shall be imposed for any disclosure or
19 nondisclosure of a test result to a spouse by a physician
20 acting in good faith under this paragraph. For the purpose
21 of any proceedings, civil or criminal, the good faith of
22 any physician acting under this paragraph shall be
23 presumed.
24 (2) Any person designated in a specific written
25 legally effective authorization for release of the test
SB2886 Enrolled - 18 - LRB104 17128 BDA 30547 b
1 results executed by the subject of the test or the
2 subject's legally authorized representative.
3 (3) An authorized agent or employee of a health
4 facility or health care provider if the health facility or
5 health care provider itself is authorized to obtain the
6 test results, the agent or employee provides patient care,
7 and the agent or employee has a need to know the
8 information in order to conduct the tests or provide care
9 or treatment.
10 (4) A health facility, health care provider, or health
11 care professional that procures, processes, distributes,
12 or uses:
13 (A) a human body part from a deceased person with
14 respect to medical information regarding that person;
15 or
16 (B) semen provided prior to the effective date of
17 this Act for the purpose of artificial insemination.
18 (5) Health facility staff committees for the purposes
19 of conducting program monitoring, program evaluation, or
20 service reviews.
21 (6) In the case of a minor under 18 years of age, the
22 health care provider, health care professional, or health
23 facility who ordered the test shall make a reasonable
24 effort to notify the minor's parent or legal guardian if,
25 in the professional judgment of the health care provider,
26 health care professional, or health facility, notification
SB2886 Enrolled - 19 - LRB104 17128 BDA 30547 b
1 would be in the best interest of the minor and the health
2 care provider, health care professional, or health
3 facility has first sought unsuccessfully to persuade the
4 minor to notify the parent or legal guardian or after a
5 reasonable time after the minor has agreed to notify the
6 parent or legal guardian, the health care provider, health
7 care professional, or health facility has reason to
8 believe that the minor has not made the notification. This
9 paragraph shall not create a duty or obligation under
10 which a health care provider, health care professional, or
11 health facility must notify the minor's parent or legal
12 guardian of the test results, nor shall a duty or
13 obligation be implied. No civil liability or criminal
14 sanction under this Act shall be imposed for any
15 notification or non-notification of a minor's test result
16 by a health care provider, health care professional, or
17 health facility acting in good faith under this paragraph.
18 For the purpose of any proceeding, civil or criminal, the
19 good faith of any health care provider, health care
20 professional, or health facility acting under this
21 paragraph shall be presumed.
22 (b) All information and records held by a State agency,
23 local health authority, or health oversight agency pertaining
24 to genetic information or biomarkers shall be strictly
25 confidential and exempt from copying and inspection under the
26 Freedom of Information Act. The information and records shall
SB2886 Enrolled - 20 - LRB104 17128 BDA 30547 b
1 not be released or made public by the State agency, local
2 health authority, or health oversight agency and shall not be
3 admissible as evidence nor discoverable in any action of any
4 kind in any court or before any tribunal, board, agency, or
5 person and shall be treated in the same manner as the
6 information and those records subject to the provisions of
7 Part 21 of Article VIII of the Code of Civil Procedure except
8 under the following circumstances:
9 (A) when made with the written consent of all
10 persons to whom the information pertains;
11 (B) when authorized by Section 5-4-3 of the
12 Unified Code of Corrections;
13 (C) when made for the sole purpose of implementing
14 the Newborn Metabolic Screening Act and rules; or
15 (D) when made under the authorization of the
16 Illinois Parentage Act of 2015.
17 Disclosure shall be limited to those who have a need to
18 know the information, and no additional disclosures may be
19 made.
20 (c) Disclosure by an insurer in accordance with the
21 requirements of the Article XL of the Illinois Insurance Code
22 shall be deemed compliance with this Section.
23 (Source: P.A. 98-1046, eff. 1-1-15; 99-85, eff. 1-1-16.)
24 (410 ILCS 513/31)
25 Sec. 31. Uses and disclosures for treatment, payment, and
SB2886 Enrolled - 21 - LRB104 17128 BDA 30547 b
1 health care operations. Notwithstanding Sections 30 and 35 of
2 this Act, a covered entity may, without a patient's consent:
3 (1) use or disclose genetic information or biomarkers
4 for its own treatment, payment, or health care operations;
5 (2) disclose genetic information or biomarkers for
6 treatment activities of a health care provider;
7 (3) disclose genetic information or biomarkers to
8 another covered entity or health care provider for the
9 payment activities of the entity that receives the
10 information;
11 (4) disclose genetic information or biomarkers to
12 another covered entity for health care operations
13 activities of the entity that receives the information, if
14 each entity has or had a relationship with the individual
15 who is the subject of the genetic information or
16 biomarkers being requested, the genetic information or
17 biomarkers pertains to such relationship, and the
18 disclosure is for the purpose of (A) conducting quality
19 assessment and improvement activities, including outcomes
20 evaluation and development of clinical guidelines,
21 provided that the obtaining of generalizable knowledge is
22 not the primary purpose of any studies resulting from such
23 activities; patient safety activities; population-based
24 activities relating to improving health or reducing health
25 care costs, protocol development, case management, and
26 care coordination, contacting of health care providers and
SB2886 Enrolled - 22 - LRB104 17128 BDA 30547 b
1 patients with information about treatment alternatives;
2 and related functions that do not include treatment; (B)
3 reviewing the competence or qualifications of health care
4 professionals or health care providers, evaluating
5 practitioner and provider performance, health plan
6 performance, conducting training programs in which
7 students, trainees, or practitioners in areas of health
8 care learn under supervision to practice or improve their
9 skills as health care providers, training of non-health
10 care professionals, accreditation, certification,
11 licensing, or credentialing activities; or (C) health care
12 fraud and abuse detection or compliance; and
13 (5) disclose genetic information or biomarkers to
14 other participants in an organized health care arrangement
15 in which the covered entity is also a participant for any
16 health care operations activities of the organized health
17 care arrangement.
18 (Source: P.A. 98-1046, eff. 1-1-15.)
19 (410 ILCS 513/31.1)
20 Sec. 31.1. Uses and disclosures for health oversight
21 activities.
22 (a) Notwithstanding Sections 30 and 35 of this Act, a
23 covered entity may disclose genetic information or biomarkers,
24 without a patient's consent, to a health oversight agency for
25 health oversight activities authorized by law, including
SB2886 Enrolled - 23 - LRB104 17128 BDA 30547 b
1 audits, civil, administrative, or criminal investigations;
2 inspections; licensure or disciplinary actions; civil
3 administrative or criminal proceedings or actions; or other
4 activities necessary for appropriate oversight of (i) the
5 health care system; (ii) government benefit programs for which
6 health information is relevant to beneficiary eligibility;
7 (iii) entities subject to government regulatory programs for
8 which health information is necessary for determining
9 compliance with program standards; or (iv) entities subject to
10 civil rights laws for which health information is necessary
11 for determining compliance.
12 (b) For purposes of the disclosures permitted by this
13 Section, a health oversight activity does not include an
14 investigation or other activity in which the individual is the
15 subject of the investigation or activity and such
16 investigation or other activity does not arise out of and is
17 not directly related to (i) the receipt of health care; (ii) a
18 claim for public benefits related to health; or (iii)
19 qualification for, or receipt of, public benefits or services
20 when a patient's health is integral to the claim for public
21 benefits or services, except that, if a health oversight
22 activity or investigation is conducted in conjunction with an
23 oversight activity or investigation relating to a claim for
24 public benefits not related to health, the joint activity or
25 investigation is considered a health oversight activity for
26 purposes of this Section.
SB2886 Enrolled - 24 - LRB104 17128 BDA 30547 b
1 (c) If a covered entity is also a health oversight agency,
2 the covered entity may use genetic information or biomarkers
3 for health oversight activities permitted by this Section.
4 (Source: P.A. 98-1046, eff. 1-1-15.)
5 (410 ILCS 513/31.2)
6 Sec. 31.2. Uses and disclosures for public health
7 activities. Notwithstanding Sections 30 and 35 of this Act,
8 genetic information or biomarkers may be disclosed without a
9 patient's consent for public health activities and purposes to
10 the Department, when the Department is authorized by law to
11 collect or receive such information for the purpose of
12 preventing or controlling disease, injury, or disability,
13 including, but not limited to, the reporting of disease,
14 injury, vital events such as birth or death, and the conduct of
15 public health surveillance, public health investigations, and
16 public health interventions.
17 (Source: P.A. 98-1046, eff. 1-1-15.)
18 (410 ILCS 513/31.3)
19 Sec. 31.3. Business associates.
20 (a) Notwithstanding Sections 30 and 35 of this Act, a
21 covered entity may, without a patient's consent, disclose a
22 patient's genetic information or biomarkers to a business
23 associate and may allow a business associate to create,
24 receive, maintain, or transmit protected health information on
SB2886 Enrolled - 25 - LRB104 17128 BDA 30547 b
1 its behalf, if the covered entity obtains, through a written
2 contract or other written agreement or arrangement that meets
3 the applicable requirements of 45 CFR 164.504(e), satisfactory
4 assurance that the business associate will appropriately
5 safeguard the information. A covered entity is not required to
6 obtain such satisfactory assurances from a business associate
7 that is a subcontractor.
8 (b) A business associate may disclose protected health
9 information to a business associate that is a subcontractor
10 and may allow the subcontractor to create, receive, maintain,
11 or transmit protected health information on its behalf, if the
12 business associate obtains satisfactory assurances, in
13 accordance with 45 CFR 164.504(e)(1)(i), that the
14 subcontractor will appropriately safeguard the information.
15 (Source: P.A. 98-1046, eff. 1-1-15.)
16 (410 ILCS 513/31.5)
17 Sec. 31.5. Use and disclosure of information to an HIE.
18 Notwithstanding the provisions of Section 30 and 35 of this
19 Act, a covered entity may, without a patient's consent,
20 disclose the identity of any patient upon whom a test is
21 performed and such patient's genetic information or biomarkers
22 from a patient's record to a HIE if the disclosure is a
23 required or permitted disclosure to a business associate or is
24 a disclosure otherwise required or permitted under this Act.
25 An HIE may, without a patient's consent, use or disclose such
SB2886 Enrolled - 26 - LRB104 17128 BDA 30547 b
1 information to the extent it is allowed to use or disclose such
2 information as a business associate in compliance with 45 CFR
3 164.502(e) or for such other purposes as are specifically
4 allowed under this Act.
5 (Source: P.A. 98-1046, eff. 1-1-15.)
6 (410 ILCS 513/31.7)
7 Sec. 31.7. Establishment and disclosure of limited data
8 sets and de-identified information.
9 (a) A covered entity may, without a genetic information
10 test or biomarker test subject's consent, create, use, and
11 disclose a limited data set using information subject to this
12 Act or disclose information subject to this Act to a business
13 associate for the purpose of establishing a limited data set.
14 The creation, use, and disclosure of such a limited data set
15 must comply with the requirements set forth under HIPAA.
16 (b) A covered entity may, without a genetic information
17 test or biomarker test subject's consent, create, use, and
18 disclose de-identified information using information subject
19 to this Act or disclose information subject to this Act to a
20 business associate for the purpose of de-identifying the
21 information. The creation, use, and disclosure of such
22 de-identified information must comply with the requirements
23 set forth under HIPAA. A covered entity or a business
24 associate may disclose information that is de-identified in
25 accordance with HIPAA.
SB2886 Enrolled - 27 - LRB104 17128 BDA 30547 b
1 (c) The recipient of de-identified information shall not
2 re-identify de-identified information using any public or
3 private data source.
4 (Source: P.A. 98-1046, eff. 1-1-15.)
5 (410 ILCS 513/31.8)
6 Sec. 31.8. HIE opt out. Section 9.6 of the Mental Health
7 and Developmental Disabilities Confidentiality Act is
8 incorporated herein by reference. In addition to the
9 requirements set out in Section 9.6 of the Mental Health and
10 Developmental Disabilities Confidentiality Act, at the time of
11 a patient's first encounter for genetic testing or biomarker
12 testing with a health care provider, health care professional,
13 or health facility that participates in an HIE, or, in the
14 event of a medical emergency that makes it impossible, as soon
15 thereafter as is practicable, the patient shall receive
16 meaningful disclosure regarding the HIE in which the health
17 care provider, health care professional, or health facility
18 participates and shall be afforded an opportunity to opt out
19 of disclosure of the patient's health information through the
20 HIE.
21 (Source: P.A. 98-1046, eff. 1-1-15.)
22 (410 ILCS 513/31.9)
23 Sec. 31.9. Research. Genetic information or biomarkers may
24 be disclosed for research, in accordance with the requirements
SB2886 Enrolled - 28 - LRB104 17128 BDA 30547 b
1 set forth under HIPAA.
2 (Source: P.A. 98-1046, eff. 1-1-15.)
3 (410 ILCS 513/31.10)
4 Sec. 31.10. Minimum necessary. When using or disclosing
5 genetic-related or biomarker-related information under this
6 Act, a covered entity shall do so in accordance with the
7 minimum necessary standard under HIPAA.
8 (Source: P.A. 98-1046, eff. 1-1-15.)
9 (410 ILCS 513/50)
10 Sec. 50. Home rule. Any home rule unit of local
11 government, any non-home rule municipality, or any non-home
12 rule county within the unincorporated territory of the county
13 may enact ordinances, standards, rules, or regulations that
14 protect biomarker testing, biomarkers, genetic information,
15 and genetic testing in a manner or to an extent equal to or
16 greater than the protection provided in this Act. This Section
17 is a limitation on the concurrent exercise of home rule power
18 under subsection (i) of Section 6 of Article VII of the
19 Illinois Constitution.
20 (Source: P.A. 95-927, eff. 1-1-09.)
SB2886 Enrolled - 29 - LRB104 17128 BDA 30547 b
1 INDEX
2 Statutes amended in order of appearance
3 410 ILCS 513/5
4 410 ILCS 513/10
5 410 ILCS 513/15
6 410 ILCS 513/20
7 410 ILCS 513/25
8 410 ILCS 513/30
9 410 ILCS 513/31
10 410 ILCS 513/31.1
11 410 ILCS 513/31.2
12 410 ILCS 513/31.3
13 410 ILCS 513/31.5
14 410 ILCS 513/31.7
15 410 ILCS 513/31.8
16 410 ILCS 513/31.9
17 410 ILCS 513/31.10
18 410 ILCS 513/50Every fact on this page links to its source, starting with the official bill record.