Notice of Privacy Practices for COVID-19 Testing

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Review it carefully.

This notice gives you information, as required by law, about the duties and practices of the Illinois Department of Public Health (IDPH) to protect the privacy of your personal health information. Because IDPH provides you COVID-19 testing, IDPH receives and maintains personal health information about you. IDPH may contract with companies, other government agencies, or individuals to help provide these services to you; therefore, contractors also may receive and maintain your personal health information.

The Effective Date of This Notice is April 15, 2020. IDPH is required to follow the terms of this notice until it is replaced. IDPH reserves the right to change the terms of the notice at any time and will provide an updated notice of any such changes.

Purposes for which IDPH may use or disclose your personal health information without your authorization:

  • Health Care Providers’ Treatment Purposes: IDPH can use your health information and share it with other professionals who are treating you. For example, IDPH may disclose your personal health information to your doctor, at the doctor’s request, for treatment by your doctor.  
  • Payment: IDPH can use and share your information for payment purposes. For example, IDPH may use or disclose your personal health information to provide eligibility information to your doctor when you receive treatment, to pay for claims for covered health care services, or to recover costs from other medical insurance or probate estates.
  • Health Care Operations: IDPH can use and share your health information for IDPH’s operations, to improve your care, and to contact you when necessary. For example, IDPH or its contractors may use or disclose your personal health information (1) to conduct quality assessment and improvement activities; (2) to review applications for services; (3) to engage in care coordination or case management; (4) to manage, plan, or develop IDPH’s services and budget; and (5) to coordinate services with other health-related benefits and services that may be of interest to you.
  • Health Services: IDPH or its contractors may contact you to give you information about your test results.
  • As Required by Law: IDPH can use and share your health information when required by law. For example, IDPH is required by law to allow the U.S. Department of Health and Human Services to audit IDPH records. IDPH may disclose your personal health information necessary to comply with workers’ compensation or other laws. IDPH also may be required to disclose personal health information about abuse, neglect, or domestic violence to governmental or social service agencies.
  • Public Health Activities and Public Health Reporting: For example, IDPH is permitted to disclose protected health information for public health activities (such as investigation and surveillance), interventions, and activities related to public health oversight.
  • Other Reasons:
    • To comply with legal proceedings, such as court orders.
    • To law enforcement officials or to correctional institutions for limited law enforcement and health and safety purposes.
    • With your written authorization, to a family member, friend or other person, to help you with your health care or payment for your health care.
    • To your personal representative appointed by you or designated by law.
    • For research purposes in limited circumstances and where the information will be protected by the researchers.
    • To a coroner, medical examiner, or funeral director to identify a deceased person or to arrange payment benefits,
    • To an organ procurement organization in limited circumstances,
    • To avert a serious threat to your health or safety or the health or safety of others,
    • To a governmental agency authorized to oversee government health care programs,
    • To federal officials for lawful national security purposes,
    • To appropriate military authorities, if you are a member of the armed forces,

Uses and disclosures with your permission. IDPH will not use or disclose your personal health information for any other purposes unless you give IDPH your written authorization to do so. In most cases, you may revoke your written authorization at any time, unless IDPH has relied upon your written authorization for a continuing disclosure, for example, for a research study. Your revocation will be effective from the date IDPH received the revocation forward for all your personal health information that IDPH maintains regarding your COVID-19 testing.

Your rights. You may make a written request to IDPH to do one or more of the following concerning your personal health information maintained by the state:

  • To put additional restrictions on IDPH’s use and disclosure of your personal health information. IDPH does not have to agree to your request under certain circumstances.
  • To have IDPH communicate with you in confidence about your personal health information by a different means or at a different location than IDPH is currently doing. Your request must be in writing specifying the alternative means or location to communicate with you.
  • To see and get copies of your personal health information. You may be charged a nominal fee for the copies.
  • To request a change to your personal health information. IDPH does not have to agree to your request.
  • To receive a list of disclosures of your personal health information that IDPH and its contractors made for certain purposes for the last six years.
  • To have IDPH provide you with another copy of this notice.

If you want to exercise any of the rights described in this notice, contact the Privacy Officer at the Illinois Department of Public Health:

Complaints. If you believe your privacy rights have been violated by IDPH, you have the right to complain to IDPH or to the Secretary of the U.S. Department of Health and Human Services. You may file a complaint with IDPH at the address below. IDPH will not retaliate against you if you choose to file a complaint with IDPH or with the U.S. Department of Health and Human Services.

Privacy Officer. To request additional copies of this notice or to receive more information about the privacy practices or your rights or to file a complaint, contact the Chief Privacy Officer at the following address:

Chief Privacy Officer
Illinois Department of Public Health
535 W. Jefferson St.— Fifth Floor
Springfield, IL 62761
(217) 782-4977

Last Updated:  7/21/2020