Illinois Code § 316.1

§ 316.1.

Access to the integration of pharmacy records with the Prescription Monitoring Program. (a) Subject to the requirements and limitations set out in this Section and in administrative rule, the Department shall not require, either expressly or effectively, Electronic Health Records Systems, pharmacies, or other providers to utilize a particular entity or system for access to the integration of pharmacy records with the Prescription Monitoring Program. (1) Any entity or system for integration (transmitting the data maintained by the Prescription Monitoring Program) into an Electronic Health Records System, Certified Health IT Module, Pharmacy Dispensing System, or Pharmacy Management System must meet applicable requirements outlined in administrative rule, including, but not limited to, the following: (A) enter into a data sharing agreement with the Department of Human Services, Prescription Monitoring Program; (B) all security requirements noted within this Section, administrative rule, and all other applicable State and federal security and privacy requirements; (C) the Prescription Monitoring Program shall have administrative control over the approval of each site and individual integration point and the Prescription Monitoring Program shall have the ability to disable individual integration points, at no additional cost to the State; (D) interstate data sharing shall be completed with written authorization from the Prescription Monitoring Program; (E) data available from the Prescription Monitoring Program shall not be stored, cached, or sold and the State may inspect and review an entity or system for integration to assure and confirm the same, subject to a reasonable non-disclosure agreement, as permitted by State law, to protect the entity's or system's trade secrets or other proprietary information; (F) analysis of data shall only be allowed with express written permission from the Prescription Monitoring Program; and (G) access to audit data, shall be available in hourly to real-time increments at no cost to the State. (2) Electronic Health Record Systems, Certified Health IT Modules, Pharmacy Management Systems, and Pharmacy Dispensing Systems integrated with the Prescription Monitoring Program must meet applicable requirements outlined in rule, including, but not limited to, the following: (A) provide their customers (healthcare entity, pharmacy, provider, prescriber, dispenser, etc.) the choice of approved integration vendor, meeting the requirements of this Section and administrative rule, or direct connect to the Illinois Prescription Monitoring Program; (B) provide their customers with access to the data provided by the customer's chosen integration vendor as allowed under State and federal statute; and (C) follow all State and federal security and privacy standards. (3) Customers required to integrate under State or federal law must meet the requirements outlined in administrative rule, including, but not limited to, the following: (A) the customer retains the choice of which integration vendor or direct connect is utilized to connect to the Illinois Prescription Monitoring Program; and (B) customers seeking to contract with a new integration vendor, shall enter into a memorandum of understanding with the Prescription Monitoring Program. (b) The Illinois Prescription Monitoring Program may exercise the power, by rule, to require Memoranda of Understanding with all customers. The general contents of the memorandum of understanding shall be set out in rule and shall include, but not be limited to: (1) the acknowledgment and choice of the customer of the method of integration with the Prescription Monitoring Program and (2) the data use and other requirements on the customer in accessing and using the Prescription Monitoring Program. A fee cannot be levied as part of a memorandum of understanding required by the Department under this Section. (c) Non-compliance by the Integration Vendor, Electronic Health Record System, Certified Health IT Module, Pharmacy Management System or Pharmacy Dispensing System, customer, or any parties required to comply with this Section may result in the party being prohibited from serving as entity or system for integration with the Prescription Monitoring Program, termination of contracts, agreements, or other business relationships. The Department shall institute appropriate cure notices, as necessary to remedy non-compliance. (Source: P.A. 103-477, eff. 7-1-24.)