Bill Text: IL SB3437 | 2023-2024 | 103rd General Assembly | Introduced

---

Bill Title: Amends the Illinois Controlled Substances Act. Deletes provision that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System must meet applicable requirements outlined in administrative rules of the Department of Human Services. Provides that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System that meets either the requirements of at least one certification criterion adopted under the Office of National Coordinator for Health Information Technology (ONC) or HITRUST certification shall be deemed qualified by the Department of Human Services to integrate pharmacy records with the Prescription Monitoring Program, subject to specified requirements. Defines "one-to-one secure link".

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-02-08 - Referred to Assignments [SB3437 Detail]

Download: Illinois-2023-SB3437-Introduced.html

---

103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3437 Introduced 2/8/2024, by Sen. David Koehler SYNOPSIS AS INTRODUCED:
720 ILCS 570/316.1
720 ILCS 570/318
Amends the Illinois Controlled Substances Act. Deletes provision that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System must meet applicable requirements outlined in administrative rules of the Department of Human Services. Provides that any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System that meets either the requirements of at least one certification criterion adopted under the Office of National Coordinator for Health Information Technology (ONC) or HITRUST certification shall be deemed qualified by the Department of Human Services to integrate pharmacy records with the Prescription Monitoring Program, subject to specified requirements. Defines "one-to-one secure link".
LRB103 38535 RLC 68671 b
A BILL FOR
SB3437 LRB103 38535 RLC 68671 b
AN ACT concerning criminal law.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Illinois Controlled Substances Act is
amended by changing Sections 316.1 and 318 as follows:
(720 ILCS 570/316.1)
(This Section may contain text from a Public Act with a
delayed effective date)
Sec. 316.1. Access to the integration of pharmacy records
with the Prescription Monitoring Program.
(a) Subject to the requirements and limitations set out in
this Section and in administrative rule, the Department shall
not require, either expressly or effectively, Electronic
Health Records Systems, pharmacies, or other providers to
utilize a particular entity or system for access to the
integration of pharmacy records with the Prescription
Monitoring Program.
(1) Any entity or system for integration (transmitting
the data maintained by the Prescription Monitoring
Program) into an Electronic Health Records System,
Certified Health IT Module, Pharmacy Dispensing System, or
Pharmacy Management System that meets either the
requirements of at least one certification criterion

SB3437 - 2 - LRB103 38535 RLC 68671 b
adopted under the Office of National Coordinator for
Health Information Technology (ONC) or HITRUST
certification shall be deemed qualified by the Department
to integrate pharmacy records with the Prescription
Monitoring Program, subject to must meet applicable
requirements outlined in administrative rule, including,
but not limited to, the following:
(A) enter into a data sharing agreement with the
Department of Human Services, Prescription Monitoring
Program;
(B) all security requirements noted within this
Section, administrative rule, and all other applicable
State and federal security and privacy requirements;
(C) the Prescription Monitoring Program shall have
administrative control over the approval of each site
and individual integration point and the Prescription
Monitoring Program shall have the ability to disable
individual integration points, at no additional cost
to the State;
(D) interstate data sharing shall be completed
with written authorization from the Prescription
Monitoring Program;
(E) data available from the Prescription
Monitoring Program shall not be stored, cached, or
sold and the State may inspect and review an entity or
system for integration to assure and confirm the same,

SB3437 - 3 - LRB103 38535 RLC 68671 b
subject to a reasonable non-disclosure agreement, as
permitted by State law, to protect the entity's or
system's trade secrets or other proprietary
information;
(F) analysis of data shall only be allowed with
express written permission from the Prescription
Monitoring Program; and
(G) access to audit data, shall be available in
hourly to real-time increments at no cost to the
State.
(2) Electronic Health Record Systems, Certified Health
IT Modules, Pharmacy Management Systems, and Pharmacy
Dispensing Systems integrated with the Prescription
Monitoring Program must meet applicable requirements
outlined in rule, including, but not limited to, the
following:
(A) provide their customers (healthcare entity,
pharmacy, provider, prescriber, dispenser, etc.) the
choice of approved integration vendor, meeting the
requirements of this Section and administrative rule,
or direct connect to the Illinois Prescription
Monitoring Program;
(B) provide their customers with access to the
data provided by the customer's chosen integration
vendor as allowed under State and federal statute; and
(C) follow all State and federal security and

SB3437 - 4 - LRB103 38535 RLC 68671 b
privacy standards.
(3) Customers required to integrate under State or
federal law must meet the requirements outlined in
administrative rule, including, but not limited to, the
following:
(A) the customer retains the choice of which
integration vendor or direct connect is utilized to
connect to the Illinois Prescription Monitoring
Program; and
(B) customers seeking to contract with a new
integration vendor, shall enter into a memorandum of
understanding with the Prescription Monitoring
Program.
(b) The Illinois Prescription Monitoring Program may
exercise the power, by rule, to require Memoranda of
Understanding with all customers. The general contents of the
memorandum of understanding shall be set out in rule and shall
include, but not be limited to:
(1) the acknowledgment and choice of the customer of
the method of integration with the Prescription Monitoring
Program and
(2) the data use and other requirements on the
customer in accessing and using the Prescription
Monitoring Program.
A fee cannot be levied as part of a memorandum of
understanding required by the Department under this Section.

SB3437 - 5 - LRB103 38535 RLC 68671 b
(c) Non-compliance by the Integration Vendor, Electronic
Health Record System, Certified Health IT Module, Pharmacy
Management System or Pharmacy Dispensing System, customer, or
any parties required to comply with this Section may result in
the party being prohibited from serving as entity or system
for integration with the Prescription Monitoring Program,
termination of contracts, agreements, or other business
relationships. The Department shall institute appropriate cure
notices, as necessary to remedy non-compliance.
(Source: P.A. 103-477, eff. 7-1-24.)
(720 ILCS 570/318)
Sec. 318. Confidentiality of information.
(a) Information received by the central repository under
Section 316 and former Section 321 is confidential.
(a-1) To ensure the federal Health Insurance Portability
and Accountability Act and confidentiality of substance use
disorder patient records rules that mandate the privacy of an
individual's prescription data reported to the Prescription
Monitoring Program received from a retail dispenser under this
Act, and in order to execute the duties and responsibilities
under Section 316 of this Act and rules for disclosure under
this Section, the Clinical Director of the Prescription
Monitoring Program or his or her designee shall maintain
direct access to all Prescription Monitoring Program data. Any
request for Prescription Monitoring Program data from any

SB3437 - 6 - LRB103 38535 RLC 68671 b
other department or agency must be approved in writing by the
Clinical Director of the Prescription Monitoring Program or
his or her designee unless otherwise permitted by law.
Prescription Monitoring Program data shall only be disclosed
as permitted by law.
(a-2) As an active step to address the current opioid
crisis in this State and to prevent and reduce addiction
resulting from a sports injury or an accident, the
Prescription Monitoring Program and the Department of Public
Health shall coordinate a continuous review of the
Prescription Monitoring Program and the Department of Public
Health data to determine if a patient may be at risk of opioid
addiction. Each patient discharged from any medical facility
with an International Classification of Disease, 10th edition
code related to a sport or accident injury shall be subject to
the data review. If the discharged patient is dispensed a
controlled substance, the Prescription Monitoring Program
shall alert the patient's prescriber as to the addiction risk
and urge each to follow the Centers for Disease Control and
Prevention guidelines or his or her respective profession's
treatment guidelines related to the patient's injury. This
subsection (a-2), other than this sentence, is inoperative on
or after January 1, 2024.
(b) The Department must carry out a program to protect the
confidentiality of the information described in subsection
(a). The Department may disclose the information to another

SB3437 - 7 - LRB103 38535 RLC 68671 b
person only under subsection (c), (d), or (f) and may charge a
fee not to exceed the actual cost of furnishing the
information.
(c) The Department may disclose confidential information
described in subsection (a) to any person who is engaged in
receiving, processing, or storing the information.
(d) The Department may release confidential information
described in subsection (a) to the following persons:
(1) A governing body that licenses practitioners and
is engaged in an investigation, an adjudication, or a
prosecution of a violation under any State or federal law
that involves a controlled substance.
(2) An investigator for the Consumer Protection
Division of the office of the Attorney General, a
prosecuting attorney, the Attorney General, a deputy
Attorney General, or an investigator from the office of
the Attorney General, who is engaged in any of the
following activities involving controlled substances:
(A) an investigation;
(B) an adjudication; or
(C) a prosecution of a violation under any State
or federal law that involves a controlled substance.
(3) A law enforcement officer who is:
(A) authorized by the Illinois State Police or the
office of a county sheriff or State's Attorney or
municipal police department of Illinois to receive

SB3437 - 8 - LRB103 38535 RLC 68671 b
information of the type requested for the purpose of
investigations involving controlled substances; or
(B) approved by the Department to receive
information of the type requested for the purpose of
investigations involving controlled substances; and
(C) engaged in the investigation or prosecution of
a violation under any State or federal law that
involves a controlled substance.
(4) Select representatives of the Department of
Children and Family Services through the indirect online
request process. Access shall be established by an
intergovernmental agreement between the Department of
Children and Family Services and the Department of Human
Services.
(e) Before the Department releases confidential
information under subsection (d), the applicant must
demonstrate in writing to the Department that:
(1) the applicant has reason to believe that a
violation under any State or federal law that involves a
controlled substance has occurred; and
(2) the requested information is reasonably related to
the investigation, adjudication, or prosecution of the
violation described in subdivision (1).
(f) The Department may receive and release prescription
record information under Section 316 and former Section 321
to:

SB3437 - 9 - LRB103 38535 RLC 68671 b
(1) a governing body that licenses practitioners;
(2) an investigator for the Consumer Protection
Division of the office of the Attorney General, a
prosecuting attorney, the Attorney General, a deputy
Attorney General, or an investigator from the office of
the Attorney General;
(3) any Illinois law enforcement officer who is:
(A) authorized to receive the type of information
released; and
(B) approved by the Department to receive the type
of information released; or
(4) prescription monitoring entities in other states
per the provisions outlined in subsection (g) and (h)
below;
confidential prescription record information collected under
Sections 316 and 321 (now repealed) that identifies vendors or
practitioners, or both, who are prescribing or dispensing
large quantities of Schedule II, III, IV, or V controlled
substances outside the scope of their practice, pharmacy, or
business, as determined by the Advisory Committee created by
Section 320.
(f-5) In accordance with a confidentiality agreement
entered into with the Department, a medical director, or a
public health administrator and their delegated analysts, of a
county or municipal health department or the Department of
Public Health shall have access to data from the system for any

SB3437 - 10 - LRB103 38535 RLC 68671 b
of the following purposes:
(1) developing education programs or public health
interventions relating to prescribing trends and
controlled substance use; or
(2) conducting analyses and publish reports on
prescribing trends in their respective jurisdictions.
At a minimum, the confidentiality agreement entered into
with the Department shall:
(i) prohibit analysis and reports produced under
subparagraph (2) from including information that
identifies, by name, license, or address, any
practitioner, dispenser, ultimate user, or other person
administering a controlled substance; and
(ii) specify the appropriate technical and physical
safeguards that the county or municipal health department
must implement to ensure the privacy and security of data
obtained from the system. The data from the system shall
not be admissible as evidence, nor discoverable in any
action of any kind in any court or before any tribunal,
board, agency, or person. The disclosure of any such
information or data, whether proper or improper, shall not
waive or have any effect upon its confidentiality,
non-discoverability, or non-admissibility.
(g) The information described in subsection (f) may not be
released until it has been reviewed by an employee of the
Department who is licensed as a prescriber or a dispenser and

SB3437 - 11 - LRB103 38535 RLC 68671 b
until that employee has certified that further investigation
is warranted. However, failure to comply with this subsection
(g) does not invalidate the use of any evidence that is
otherwise admissible in a proceeding described in subsection
(h).
(h) An investigator or a law enforcement officer receiving
confidential information under subsection (c), (d), or (f) may
disclose the information to a law enforcement officer or an
attorney for the office of the Attorney General for use as
evidence in the following:
(1) A proceeding under any State or federal law that
involves a controlled substance.
(2) A criminal proceeding or a proceeding in juvenile
court that involves a controlled substance.
(i) The Department may compile statistical reports from
the information described in subsection (a). The reports must
not include information that identifies, by name, license or
address, any practitioner, dispenser, ultimate user, or other
person administering a controlled substance.
(j) Based upon federal, initial and maintenance funding, a
prescriber and dispenser inquiry system shall be developed to
assist the health care community in its goal of effective
clinical practice and to prevent patients from diverting or
abusing medications.
(1) An inquirer shall have read-only access to a
stand-alone database which shall contain records for the

SB3437 - 12 - LRB103 38535 RLC 68671 b
previous 12 months.
(2) Dispensers may, upon positive and secure
identification, make an inquiry on a patient or customer
solely for a medical purpose as delineated within the
federal HIPAA law.
(3) The Department shall provide a one-to-one secure
link and encrypted software necessary to establish the
link between an inquirer and the Department. Technical
assistance shall also be provided. "One-to-one secure
link" only means connecting a provider and the Illinois
Prescription Monitoring Program through an electronic
health record or a pharmacy management system by issuing
unique credentials for each connecting system that can be
individually approved or denied by the Illinois
Prescription Monitoring Program. "One-to-one secure link"
refers only to the access controls and approval of
credentials, not the routing path of the transaction.
"One-to-one secure link" or "one-to-one connection" does
not mean that the integrating service will provide a
direct connection between the Electronic health Records
System or pharmacy management system and the Illinois
Prescription Monitoring Program.
(4) Written inquiries are acceptable but must include
the fee and the requester's Drug Enforcement
Administration license number and submitted upon the
requester's business stationery.

SB3437 - 13 - LRB103 38535 RLC 68671 b
(5) As directed by the Prescription Monitoring Program
Advisory Committee and the Clinical Director for the
Prescription Monitoring Program, aggregate data that does
not indicate any prescriber, practitioner, dispenser, or
patient may be used for clinical studies.
(6) Tracking analysis shall be established and used
per administrative rule.
(7) Nothing in this Act or Illinois law shall be
construed to require a prescriber or dispenser to make use
of this inquiry system.
(8) If there is an adverse outcome because of a
prescriber or dispenser making an inquiry, which is
initiated in good faith, the prescriber or dispenser shall
be held harmless from any civil liability.
(k) The Department shall establish, by rule, the process
by which to evaluate possible erroneous association of
prescriptions to any licensed prescriber or end user of the
Illinois Prescription Information Library (PIL).
(l) The Prescription Monitoring Program Advisory Committee
is authorized to evaluate the need for and method of
establishing a patient specific identifier.
(m) Patients who identify prescriptions attributed to them
that were not obtained by them shall be given access to their
personal prescription history pursuant to the validation
process as set forth by administrative rule.
(n) The Prescription Monitoring Program is authorized to

SB3437 - 14 - LRB103 38535 RLC 68671 b
develop operational push reports to entities with compatible
electronic medical records. The process shall be covered
within administrative rule established by the Department.
(o) Hospital emergency departments and freestanding
healthcare facilities providing healthcare to walk-in patients
may obtain, for the purpose of improving patient care, a
unique identifier for each shift to utilize the PIL system.
(p) The Prescription Monitoring Program shall
automatically create a log-in to the inquiry system when a
prescriber or dispenser obtains or renews his or her
controlled substance license. The Department of Financial and
Professional Regulation must provide the Prescription
Monitoring Program with electronic access to the license
information of a prescriber or dispenser to facilitate the
creation of this profile. The Prescription Monitoring Program
shall send the prescriber or dispenser information regarding
the inquiry system, including instructions on how to log into
the system, instructions on how to use the system to promote
effective clinical practice, and opportunities for continuing
education for the prescribing of controlled substances. The
Prescription Monitoring Program shall also send to all
enrolled prescribers, dispensers, and designees information
regarding the unsolicited reports produced pursuant to Section
314.5 of this Act.
(q) A prescriber or dispenser may authorize a designee to
consult the inquiry system established by the Department under

SB3437 - 15 - LRB103 38535 RLC 68671 b
this subsection on his or her behalf, provided that all the
following conditions are met:
(1) the designee so authorized is employed by the same
hospital or health care system; is employed by the same
professional practice; or is under contract with such
practice, hospital, or health care system;
(2) the prescriber or dispenser takes reasonable steps
to ensure that such designee is sufficiently competent in
the use of the inquiry system;
(3) the prescriber or dispenser remains responsible
for ensuring that access to the inquiry system by the
designee is limited to authorized purposes and occurs in a
manner that protects the confidentiality of the
information obtained from the inquiry system, and remains
responsible for any breach of confidentiality; and
(4) the ultimate decision as to whether or not to
prescribe or dispense a controlled substance remains with
the prescriber or dispenser.
The Prescription Monitoring Program shall send to
registered designees information regarding the inquiry system,
including instructions on how to log onto the system.
(r) The Prescription Monitoring Program shall maintain an
Internet website in conjunction with its prescriber and
dispenser inquiry system. This website shall include, at a
minimum, the following information:
(1) current clinical guidelines developed by health

SB3437 - 16 - LRB103 38535 RLC 68671 b
care professional organizations on the prescribing of
opioids or other controlled substances as determined by
the Advisory Committee;
(2) accredited continuing education programs related
to prescribing of controlled substances;
(3) programs or information developed by health care
professionals that may be used to assess patients or help
ensure compliance with prescriptions;
(4) updates from the Food and Drug Administration, the
Centers for Disease Control and Prevention, and other
public and private organizations which are relevant to
prescribing;
(5) relevant medical studies related to prescribing;
(6) other information regarding the prescription of
controlled substances; and
(7) information regarding prescription drug disposal
events, including take-back programs or other disposal
options or events.
The content of the Internet website shall be periodically
reviewed by the Prescription Monitoring Program Advisory
Committee as set forth in Section 320 and updated in
accordance with the recommendation of the advisory committee.
(s) The Prescription Monitoring Program shall regularly
send electronic updates to the registered users of the
Program. The Prescription Monitoring Program Advisory
Committee shall review any communications sent to registered

SB3437 - 17 - LRB103 38535 RLC 68671 b
users and also make recommendations for communications as set
forth in Section 320. These updates shall include the
following information:
(1) opportunities for accredited continuing education
programs related to prescribing of controlled substances;
(2) current clinical guidelines developed by health
care professional organizations on the prescribing of
opioids or other drugs as determined by the Advisory
Committee;
(3) programs or information developed by health care
professionals that may be used to assess patients or help
ensure compliance with prescriptions;
(4) updates from the Food and Drug Administration, the
Centers for Disease Control and Prevention, and other
public and private organizations which are relevant to
prescribing;
(5) relevant medical studies related to prescribing;
(6) other information regarding prescribing of
controlled substances;
(7) information regarding prescription drug disposal
events, including take-back programs or other disposal
options or events; and
(8) reminders that the Prescription Monitoring Program
is a useful clinical tool.
(t) Notwithstanding any other provision of this Act,
neither the Prescription Monitoring Program nor any other

SB3437 - 18 - LRB103 38535 RLC 68671 b