(410 ILCS 305/1) (from Ch. 111 1/2, par. 7301) Sec. 1. This Act shall be known and may be cited as the "AIDS Confidentiality Act". (Source: P.A. 85-677; 85-679.)

(410 ILCS 305/2) (from Ch. 111 1/2, par. 7302) Sec. 2. The General Assembly finds that: (1) The use of tests designed to reveal a condition indicative of Human Immunodeficiency Virus (HIV) infection can be a valuable tool in protecting the public health. (2) Despite existing laws, regulations and professional standards which require or promote the informed, voluntary and confidential use of tests designed to reveal HIV infection, many members of the public are deterred from seeking such testing because they misunderstand the nature of the test or fear that test results or other health information that reveals their HIV status will be disclosed without their consent. (3) The public health will be served by facilitating informed, voluntary and confidential use of tests designed to reveal HIV infection and appropriately protecting the health information privacy of patients who are HIV-positive. (4) The public health will also be served by expanding the availability of informed, voluntary, and confidential HIV testing and treatment and making HIV testing a routine part of general medical care, as recommended by the United States Centers for Disease Control and Prevention. (5) The use of electronic health record systems and the exchange of electronic patient records, both paper and electronic, through secure means, including through secure health information exchanges, should be encouraged to improve patient health care and care coordination, facilitate public health reporting, and control health care costs, among other purposes.(6) Limiting the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish an intended purpose, when being transmitted by or on behalf of a covered entity under HIPAA, is a key component of health information privacy. The disclosure of HIV-related information, when allowed by this Act, shall be performed in accordance with the minimum necessary standard when required under HIPAA. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/3) (from Ch. 111 1/2, par. 7303) Sec. 3. Definitions. When used in this Act: (a) "AIDS" means acquired immunodeficiency syndrome. (b) "Authority" means the Illinois Health Information Exchange Authority established pursuant to the Illinois Health Information Exchange and Technology Act. (c) "Business associate" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103. (d) "Covered entity" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103. (e) "De-identified information" means health information that is not individually identifiable as described under HIPAA, as specified in 45 CFR 164.514(b). (f) "Department" means the Illinois Department of Public Health or its designated agents. (g) "Disclosure" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103. (h) "Health care operations" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501. (i) "Health care professional" means (i) a licensed physician, (ii) a licensed physician assistant, (iii) a licensed advanced practice registered nurse, (iv) an advanced practice registered nurse or physician assistant who practices in a hospital or ambulatory surgical treatment center and possesses appropriate clinical privileges, (v) a licensed dentist, (vi) a licensed podiatric physician, or (vii) an individual certified to provide HIV testing and counseling by a state or local public health department. (j) "Health care provider" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103. (k) "Health facility" means a hospital, nursing home, blood bank, blood center, sperm bank, or other health care institution, including any "health facility" as that term is defined in the Illinois Finance Authority Act. (l) "Health information exchange" or "HIE" means a health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act, or any subsequent amendments thereto, and any administrative rules adopted thereunder; (ii) has established a data sharing arrangement with the Authority; or (iii) as of August 16, 2013, was designated by the Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee. In certain circumstances, in accordance with HIPAA, an HIE will be a business associate.(m) "Health oversight agency" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.(n) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, Public Law 111-05, and any subsequent amendments thereto and any regulations promulgated thereunder.(o) "HIV" means the human immunodeficiency virus. (p) "HIV-related information" means the identity of a person upon whom an HIV test is performed, the results of an HIV test, as well as diagnosis, treatment, and prescription information that reveals a patient is HIV-positive, including such information contained in a limited data set. "HIV-related information" does not include information that has been de-identified in accordance with HIPAA. (q) "Informed consent" means:(1) where a health care provider, health care

professional, or health facility has implemented opt-in testing, a process by which an individual or their legal representative receives pre-test information, has an opportunity to ask questions, and consents verbally or in writing to the test without undue inducement or any element of force, fraud, deceit, duress, or other form of constraint or coercion; or

(2) where a health care provider, health care

professional, or health facility has implemented opt-out testing, the individual or their legal representative has been notified verbally or in writing that the test is planned, has received pre-test information, has been given the opportunity to ask questions and the opportunity to decline testing, and has not declined testing; where such notice is provided, consent for opt-out HIV testing may be incorporated into the patient's general consent for medical care on the same basis as are other screening or diagnostic tests; a separate consent for opt-out HIV testing is not required.

In addition, where the person providing informed consent is a participant in an HIE, informed consent requires a fair explanation that the results of the patient's HIV test will be accessible through an HIE and meaningful disclosure of the patient's opt-out right under Section 9.6 of this Act. A health care provider, health care professional, or health facility undertaking an informed consent process for HIV testing under this subsection may combine a form used to obtain informed consent for HIV testing with forms used to obtain written consent for general medical care or any other medical test or procedure, provided that the forms make it clear that the subject may consent to general medical care, tests, or procedures without being required to consent to HIV testing, and clearly explain how the subject may decline HIV testing. Health facility clerical staff or other staff responsible for the consent form for general medical care may obtain consent for HIV testing through a general consent form. (r) "Limited data set" has the meaning ascribed to it under HIPAA, as described in 45 CFR 164.514(e)(2).(s) "Minimum necessary" means the HIPAA standard for using, disclosing, and requesting protected health information found in 45 CFR 164.502(b) and 164.514(d). (s-1) "Opt-in testing" means an approach where an HIV test is presented by offering the test and the patient accepts or declines testing. (s-3) "Opt-out testing" means an approach where an HIV test is presented such that a patient is notified that HIV testing may occur unless the patient declines. (t) "Organized health care arrangement" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.(u) "Patient safety activities" has the meaning ascribed to it under 42 CFR 3.20.(v) "Payment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.(w) "Person" includes any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity.(w-5) "Pre-test information" means:(1) a reasonable explanation of the test, including

its purpose, potential uses, limitations, and the meaning of its results; and

(2) a reasonable explanation of the procedures to be

followed, including the voluntary nature of the test, the availability of a qualified person to answer questions, the right to withdraw consent to the testing process at any time, the right to anonymity to the extent provided by law with respect to participation in the test and disclosure of test results, and the right to confidential treatment of information identifying the subject of the test and the results of the test, to the extent provided by law.

Pre-test information may be provided in writing, verbally, or by video, electronic, or other means and may be provided as designated by the supervising health care professional or the health facility.For the purposes of this definition, a qualified person to answer questions is a health care professional or, when acting under the supervision of a health care professional, a registered nurse, medical assistant, or other person determined to be sufficiently knowledgeable about HIV testing, its purpose, potential uses, limitations, the meaning of the test results, and the testing procedures in the professional judgment of a supervising health care professional or as designated by a health care facility. (x) "Protected health information" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103.(y) "Research" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.(z) "State agency" means an instrumentality of the State of Illinois and any instrumentality of another state that, pursuant to applicable law or a written undertaking with an instrumentality of the State of Illinois, is bound to protect the privacy of HIV-related information of Illinois persons. (aa) "Test" or "HIV test" means a test to determine the presence of the antibody or antigen to HIV, or of HIV infection. (bb) "Treatment" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501.(cc) "Use" has the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103, where context dictates. (Source: P.A. 99-54, eff. 1-1-16; 99-173, eff. 7-29-15; 99-642, eff. 7-28-16; 100-513, eff. 1-1-18.)

(410 ILCS 305/4) (from Ch. 111 1/2, par. 7304) Sec. 4. Informed consent. No person may order an HIV test without first providing pre-test information, as defined under subsection (w-5) of Section 3 of this Act, and receiving the informed consent of the subject of the test or the subject's legally authorized representative in accordance with paragraph (1) or (2) of subsection (q) of Section 3 of this Act.A health care provider, health care professional, or health care facility conducting opt-in testing and obtaining informed consent pursuant to paragraph (1) of subsection (q) of Section 3 shall document verbal or written consent in the general consent for medical care, a separate consent form, or elsewhere in the medical record.A health care provider, health care professional, or health care facility conducting opt-out testing pursuant to paragraph (2) of subsection (q) of Section 3 shall document the subject's or the subject's legally authorized representative's declination of the test in the medical record. Individual documentation of the provision of pre-test information to each test subject is not required. A health care provider, health care professional, or health facility conducting opt-out testing and shall establish and implement a written procedure for conducting opt-out testing pursuant to paragraph (2) of subsection (q) of Section 3 and for providing pre-test information, as that term is defined under subsection (w-5) of Section 3 of this Act. (Source: P.A. 99-54, eff. 1-1-16.)

(410 ILCS 305/5) (from Ch. 111 1/2, par. 7305) Sec. 5. (Repealed). (Source: P.A. 95-7, eff. 6-1-08. Repealed by P.A. 99-54, eff. 1-1-16.)

(410 ILCS 305/5.5) Sec. 5.5. Rapid testing. The Department shall adopt rules to allow for the implementation of HIV/AIDS rapid testing. The rules must include, but need not be limited to, standards for ordering and administration of testing and counseling and dissemination of test results. (Source: P.A. 93-482, eff. 8-8-03.)

(410 ILCS 305/6) (from Ch. 111 1/2, par. 7306) Sec. 6. Any individual seeking an HIV test shall have the right to anonymous testing, unless identification of the test subject is otherwise required. Anonymous testing shall be performed after pre-test information is provided and informed consent is obtained, using a coded system that does not link individual identity with the request or result. A health care facility or health care provider that does not provide anonymous testing shall refer an individual requesting an anonymous test to a site where it is available. The Department may, if it deems necessary, promulgate regulations exempting blood banks, as defined in the Illinois Blood Bank Act, from the requirements of this Section. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/7) (from Ch. 111 1/2, par. 7307)Sec. 7. (a) Notwithstanding the provisions of Sections 4, 5 and 6 of this Act, informed consent is not required for a health care provider or health facility to perform a test when the health care provider or health facility procures, processes, distributes or uses a human body part donated for a purpose specified under the Illinois Anatomical Gift Act, or semen provided prior to the effective date of this Act for the purpose of artificial insemination, and such a test is necessary to assure medical acceptability of such gift or semen for the purposes intended. (b) Informed consent is not required for a health care provider or health facility to perform a test when a health care provider or employee of a health facility, or a firefighter or an EMR, EMT, EMT-I, A-EMT, paramedic, or PHRN, is involved in an accidental direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment. Should such test prove to be positive, the patient and the health care provider, health facility employee, firefighter, EMR, EMT, EMT-I, A-EMT, paramedic, or PHRN shall be provided appropriate counseling consistent with this Act. (c) Informed consent is not required for a health care provider or health facility to perform a test when a law enforcement officer is involved in the line of duty in a direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment. Should such test prove to be positive, the patient shall be provided appropriate counseling consistent with this Act. For purposes of this subsection (c), "law enforcement officer" means any person employed by the State, a county or a municipality as a policeman, peace officer, auxiliary policeman, correctional officer or in some like position involving the enforcement of the law and protection of the public interest at the risk of that person's life. (Source: P.A. 98-973, eff. 8-15-14.)

(410 ILCS 305/8) (from Ch. 111 1/2, par. 7308) Sec. 8. Notwithstanding the provisions of Sections 4 and 5 of this Act, informed consent and pre-test information are not required for the performance of an HIV test: (a) for the purpose of research, if the testing is performed in such a way that the identity of the test subject is not known and may not be retrieved by the researcher, and in such a way that the test subject is not informed of the results of the testing, or (b) when in the judgment of the physician, such testing is medically indicated to provide appropriate diagnosis and treatment to the subject of the test, provided that the subject of the test has otherwise provided his or her consent to such physician for medical treatment. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/9) (from Ch. 111 1/2, par. 7309) Sec. 9. (1) No person may disclose or be compelled to disclose HIV-related information, except to the following persons: (a) The subject of an HIV test or the subject's

legally authorized representative. A physician may notify the spouse or civil union partner of the test subject, if the test result is positive and has been confirmed pursuant to rules adopted by the Department, provided that the physician has first sought unsuccessfully to persuade the patient to notify the spouse or civil union partner or that, a reasonable time after the patient has agreed to make the notification, the physician has reason to believe that the patient has not provided the notification. This paragraph shall not create a duty or obligation under which a physician must notify the spouse or civil union partner of the test results, nor shall such duty or obligation be implied. No civil liability or criminal sanction under this Act shall be imposed for any disclosure or non-disclosure of a test result to a spouse or civil union partner by a physician acting in good faith under this paragraph. For the purpose of any proceedings, civil or criminal, the good faith of any physician acting under this paragraph shall be presumed.

(b) Any person designated in a legally effective

authorization for release of the HIV-related information executed by the subject of the HIV-related information or the subject's legally authorized representative.

(c) An authorized agent or employee of a health

facility or health care provider if the health facility or health care provider itself is authorized to obtain the test results, the agent or employee provides patient care or handles or processes specimens of body fluids or tissues, and the agent or employee has a need to know such information.

(d) The Department and local health authorities

serving a population of over 1,000,000 residents or other local health authorities as designated by the Department, in accordance with rules for reporting, preventing, and controlling the spread of disease and the conduct of public health surveillance, public health investigations, and public health interventions, as otherwise provided by State law. The Department, local health authorities, and authorized representatives shall not disclose HIV test results and HIV-related information, publicly or in any action of any kind in any court or before any tribunal, board, or agency. HIV test results and HIV-related information shall be protected from disclosure in accordance with the provisions of Sections 8-2101 through 8-2105 of the Code of Civil Procedure.

(e) A health facility, health care provider, or

health care professional which procures, processes, distributes or uses: (i) a human body part from a deceased person with respect to medical information regarding that person; or (ii) semen provided prior to the effective date of this Act for the purpose of artificial insemination.

(f) Health facility staff committees for the purposes

of conducting program monitoring, program evaluation or service reviews.

(f-5) A court in accordance with the provisions of

Section 12-5.01 of the Criminal Code of 2012.

(g) (Blank). (h) Any health care provider, health care

professional, or employee of a health facility, and any firefighter or EMR, EMT, A-EMT, paramedic, PHRN, or EMT-I, involved in an accidental direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment.

(i) Any law enforcement officer, as defined in

subsection (c) of Section 7, involved in the line of duty in a direct skin or mucous membrane contact with the blood or bodily fluids of an individual which is of a nature that may transmit HIV, as determined by a physician in his medical judgment.

(j) A temporary caretaker of a child taken into

temporary protective custody by the Department of Children and Family Services pursuant to Section 5 of the Abused and Neglected Child Reporting Act, as now or hereafter amended.

(k) In the case of a minor under 18 years of age

whose test result is positive and has been confirmed pursuant to rules adopted by the Department, the health care professional who ordered the test shall make a reasonable effort to notify the minor's parent or legal guardian if, in the professional judgment of the health care professional, notification would be in the best interest of the child and the health care professional has first sought unsuccessfully to persuade the minor to notify the parent or legal guardian or a reasonable time after the minor has agreed to notify the parent or legal guardian, the health care professional has reason to believe that the minor has not made the notification. This subsection shall not create a duty or obligation under which a health care professional must notify the minor's parent or legal guardian of the test results, nor shall a duty or obligation be implied. No civil liability or criminal sanction under this Act shall be imposed for any notification or non-notification of a minor's test result by a health care professional acting in good faith under this subsection. For the purpose of any proceeding, civil or criminal, the good faith of any health care professional acting under this subsection shall be presumed.

(2) All information and records held by a State agency, local health authority, or health oversight agency pertaining to HIV-related information shall be strictly confidential and exempt from copying and inspection under the Freedom of Information Act. The information and records shall not be released or made public by the State agency, local health authority, or health oversight agency, shall not be admissible as evidence nor discoverable in any action of any kind in any court or before any tribunal, board, agency, or person, and shall be treated in the same manner as the information and those records subject to the provisions of Part 21 of Article VIII of the Code of Civil Procedure, except under the following circumstances:(A) when made with the written consent of all persons

to whom the information pertains; or

(B) when authorized by Section 5-4-3 of the Unified

Code of Corrections.

Disclosure shall be limited to those who have a need to know the information, and no additional disclosures may be made. (Source: P.A. 98-973, eff. 8-15-14; 98-1046, eff. 1-1-15; 99-54, eff. 1-1-16; 99-78, eff. 7-20-15.)

(410 ILCS 305/9.1) Sec. 9.1. Uses and disclosures for treatment, payment, and health care operations. Notwithstanding Sections 9 and 10 of this Act, a covered entity may, without a patient's consent:(1) use or disclose HIV-related information for its

own treatment, payment, or health care operations;

(2) disclose HIV-related information for treatment

activities of a health care provider or health care professional;

(3) disclose HIV-related information to another

covered entity or health care provider or health care professional for the payment activities of the entity that receives the information;

(4) disclose HIV-related information to another

covered entity for health care operations activities of the entity that receives the information, if each entity has or had a relationship with the individual who is the subject of the HIV-related information being requested, the HIV-related information pertains to such relationship, and the disclosure is for the purpose of (A) conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management, and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment; (B) reviewing the competence or qualifications of health care professionals or health care providers, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities; or (C) health care fraud and abuse detection or compliance; and

(5) disclose HIV-related information to other

participants in an organized health care arrangement in which the covered entity is also a participant for any health care operations activities of the organized health care arrangement.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.2) Sec. 9.2. Uses and disclosures for health oversight activities.(a) Notwithstanding Sections 9 and 10 of this Act, a covered entity may disclose HIV-related information, without a patient's consent, to a health oversight agency for health oversight activities authorized by law, including audits, civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil administrative or criminal proceedings or actions; or other activities necessary for appropriate oversight of (i) the health care system; (ii) government benefit programs for which health information is relevant to beneficiary eligibility; (iii) entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or (iv) entities subject to civil rights laws for which health information is necessary for determining compliance.(b) For purposes of the disclosures permitted by this Section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to (i) the receipt of health care; (ii) a claim for public benefits related to health; or (iii) qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services, except that, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of this Section.(c) If a covered entity is also a health oversight agency, the covered entity may use HIV-related information for health oversight activities permitted by this Section. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.3) Sec. 9.3. Business associates.(a) Notwithstanding Sections 9 and 10 of this Act, a covered entity may, without a patient's consent, disclose a patient's HIV-related information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains, through a written contract or other written agreement or arrangement that meets the applicable requirements of 45 CFR 164.504(e), satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.(b) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.4) Sec. 9.4. Use and disclosure of information to an HIE. Notwithstanding the provisions of Sections 9 and 10 of this Act, a covered entity may, without a patient's consent, disclose the identity of any patient upon whom a test is performed and such patient's HIV-related information from a patient's record to an HIE if the disclosure is a required or permitted disclosure to a business associate or is a disclosure otherwise required or permitted under this Act. An HIE may, without a patient's consent, use or disclose such information to the extent it is allowed to use or disclose such information as a business associate in compliance with 45 CFR 164.502(e) or for such other purposes as are specifically allowed under this Act. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.4a) Sec. 9.4a. Other disclosures. Nothing in this Act shall be construed (1) to limit the use of an HIE to facilitate disclosures permitted by this Act or (2) to allow for the disclosure of information from a patient's record to law enforcement or for law enforcement purposes. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.5) Sec. 9.5. Delivery of test results.(a) The Department shall develop rules regarding the delivery of HIV test results to patients.(b) The subject of the test or the subject's legally authorized representative shall be notified by personal contact whenever possible of the confirmed positive result of an HIV test. When the subject or the subject's legally authorized representative is notified of a confirmed positive test result, the health care provider or professional shall provide the subject or the subject's legally authorized representative with a referral to counseling in connection with the confirmed positive test result and a referral to an appropriate medical facility for the treatment and management of HIV.(c) A health care provider shall not be in violation of this Section when an attempt to contact the test subject or the subject's legally authorized representative at the address or telephone number provided by the test subject or the test subject's legally authorized representative does not result in contact and notification or where an attempt to deliver results by personal contact has not been successful. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/9.6) Sec. 9.6. HIE opt out. Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act is incorporated herein by reference. In addition to the requirements set out in Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act, at the time of a patient's first encounter for HIV-related care with a health care provider, health care professional, or health facility that participates in an HIE, or, in the event of a medical emergency that makes it impossible, as soon thereafter as is practicable, the patient shall receive meaningful disclosure regarding the HIE in which the health care provider, health care professional, or health facility participates and shall be afforded an opportunity to opt out of disclosure of the patient's health information through the HIE. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.7) Sec. 9.7. Record locator service to support HIE. Section 9.9 of the Mental Health and Developmental Disabilities Confidentiality Act is herein incorporated by reference. (Source: P.A. 98-1046, eff. 1-1-15; 99-78, eff. 7-20-15.)

(410 ILCS 305/9.8) Sec. 9.8. Disclosure of limited data sets and de-identified information. Notwithstanding the provisions of Sections 9 and 10 of this Act:(1) a covered entity may, without a patient's

consent, create, use, and disclose a limited data set using HIV-related information from a patient's record or disclose HIV-related information from a patient's record to a business associate for the purpose of establishing a limited data set; the creation, use, and disclosure of such a limited data set must comply with the requirements set forth under HIPAA;

(2) a covered entity may, without a patient's

consent, create, use, and disclose de-identified information using information from a patient's record that is subject to this Act or disclose HIV-related information from a patient's record to a business associate for the purpose of de-identifying the information; the creation, use, and disclosure of such de-identified data must comply with the requirements set forth under HIPAA. A covered entity or a business associate may disclose information that is de-identified; and

(3) the recipient of de-identified information shall

not re-identify de-identified information using any public or private data source.

(Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.9) Sec. 9.9. Research. HIV-related information may be disclosed for research in accordance with the requirements set forth under HIPAA. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/9.10) Sec. 9.10. Minimum necessary. When using and disclosing HIV-related information under this Act, a covered entity shall do so in accordance with the minimum necessary standard under HIPAA. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/10) (from Ch. 111 1/2, par. 7310) Sec. 10. No person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized under this Act. (Source: P.A. 98-1046, eff. 1-1-15.)

(410 ILCS 305/11) (from Ch. 111 1/2, par. 7311) Sec. 11. Notwithstanding the provisions of Section 4 of this Act, informed consent is not required for the performance of an HIV test upon a person who is specifically required by law to be so tested. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/12) (from Ch. 111 1/2, par. 7312) Sec. 12. Intentional or reckless violation of this Act or any regulation issued hereunder shall constitute a Class A misdemeanor. (Source: P.A. 87-763.)

(410 ILCS 305/13) (from Ch. 111 1/2, par. 7313) Sec. 13. Any person aggrieved by a violation of this Act or of a regulation promulgated hereunder shall have a right of action in the circuit court and may recover for each violation: (1) Against any person who negligently violates a provision of this Act or the regulations promulgated hereunder, liquidated damages of $2,000 or actual damages, whichever is greater. (2) Against any person who intentionally or recklessly violates a provision of this Act or the regulations promulgated hereunder, liquidated damages of $10,000 or actual damages, whichever is greater. (3) Reasonable attorney fees. (4) Such other relief, including an injunction, as the court may deem appropriate. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/14) (from Ch. 111 1/2, par. 7314) Sec. 14. Nothing in this Act limits the right of the subject of a test to recover damages or other relief under any other applicable law. (Source: P.A. 85-677; 85-679.)

(410 ILCS 305/15) (from Ch. 111 1/2, par. 7315) Sec. 15. Nothing in this Act shall be construed to impose civil liability or criminal sanction for disclosure of a test result in accordance with any reporting requirement of the Department for a diagnosed case of HIV infection, AIDS or a related condition. Nothing in this Act shall be construed to impose civil liability or criminal sanction for performing a test without informed consent pursuant to the provisions of subsection (b) or (c) of Section 7 of this Act. (Source: P.A. 95-7, eff. 6-1-08.)

(410 ILCS 305/15.1) (from Ch. 111 1/2, par. 7315.1) Sec. 15.1. Sections 1 through 15 of this Act shall not apply to a health maintenance organization nor to any insurance company, fraternal benefit society, or other insurer regulated under the "Illinois Insurance Code", approved June 29, 1937, as amended. (Source: P.A. 85-677; 85-679.)

(410 ILCS 305/16) (from Ch. 111 1/2, par. 7316) Sec. 16. The Department shall promulgate rules and regulations concerning implementation and enforcement of this Act, except to the extent that this Act delegates to the Authority the promulgation or adoption of any rules, regulations, standards, or contractual obligations. The rules and regulations promulgated by the Department pursuant to this Act may include procedures for taking appropriate action with regard to health care facilities or health care providers which violate this Act or the regulations promulgated hereunder. The provisions of The Illinois Administrative Procedure Act shall apply to all administrative rules and procedures of the Department pursuant to this Act, except that in case of conflict between The Illinois Administrative Procedure Act and this Act, the provisions of this Act shall control. The Department shall conduct training, technical assistance, and outreach activities, as needed, to implement routine HIV testing in healthcare medical settings. (Source: P.A. 98-1046, eff. 1-1-15.)