HIPAA compliance for pediatric practices in Illinois

Illinois keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Illinois has 12 recorded rules that apply to pediatric practices differently from other businesses in the state — set out below with their conditions and sources.

Illinois jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Illinois's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Pediatric practices that electronically conduct claims, eligibility, authorization, or other adopted transactions are HIPAA covered entities. Once covered, the duties below are required, including the additional work of managing parents, minors, personal representatives, and age-dependent confidentiality.

State — how Illinois law interacts with HIPAA

Illinois substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Pediatric practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Illinois operates a bifurcated regime. Under §50, a HIPAA/HITECH covered entity or business associate that is subject to and in compliance with the HIPAA/HITECH breach-notification rules is deemed to be in compliance with the Illinois Act — the deemed-compliance substitution operates through §50. In parallel, §10(e)'s ordinary >500-resident AG threshold expressly excludes §50-compliant CEs and BAs, so a HIPAA-compliant practice is NOT subject to that ordinary AG trigger. However, when the HIPAA-compliant CE/BA is required to notify HHS, §50 imposes its own affirmative Illinois AG notice within 5 business days after HHS notice — the substitution is not a full opt-out.

What Illinois adds for pediatric practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Illinois's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

Any minor 12 years of age or older may request and receive counseling services or psychotherapy on an outpatient basis. For a minor under 17 the services are initially limited to not more than eight 90-minute sessions before parental consent must be sought.

Service: outpatient counseling or psychotherapy
Patient population: minors

Reaches this practice type when the practice provides outpatient counseling or psychotherapy itself.

What this means operationally

The Illinois limit is measured in sessions of a stated length, so session duration is part of the compliance record and not just a scheduling detail. Practices running shorter or longer appointments need to record actual session length to show where the eighth 90-minute session falls.

Applies when

The minor is 12 or older
The services are outpatient counseling or psychotherapy

State statute405 ILCS 5/3-550Minors aged 12 and older; the session limit applies under 17Verified 2026-08-28

Minor may consent

Consent to the performance of a medical or surgical procedure by a licensed physician, chiropractor, optometrist, advanced practice registered nurse or physician assistant may be given by a married person who is a minor, by a parent who is a minor, or by a pregnant woman who is a minor, and the consent is not voidable because of minority.

Provider class: a licensed physician, chiropractor, optometrist, advanced practice nurse or physician assistant
Patient population: minors who are married, a parent, or pregnant

What this means operationally

This is the Illinois provision most likely to be missed by a behavioral-health practice, because it is not about behavioral health — it is a status-based general consent, and it is one of the very few in the corpus that names chiropractors and optometrists explicitly. An Illinois chiropractic or optometry practice therefore does have a minor-consent rule reaching it, which the counseling statute alone would not have shown.

Applies when

The minor is married, is a parent, or is pregnant
The provider is a licensed physician, chiropractor, optometrist, advanced practice nurse or physician assistant

State statute410 ILCS 210/1Minors who are married, a parent, or pregnantVerified 2026-08-29

Minor may consent

A minor aged 14 to 17 who is living separate and apart from parents or legal guardian and managing their own personal affairs, and who is identified in writing by one of six specified entities — an adult relative, a homeless service agency representative, a licensed attorney, a school homeless liaison or social worker, an at-risk youth service agency, or a religious organization representative — may consent to primary care services. Primary care services means screening, counseling, immunizations, medication, and treatment of illness and conditions in outpatient settings, and includes optometric eye care and chiropractic services within the respective scopes of practice. It excludes invasive care beyond standard injections, laceration care, or non-surgical fracture care.

Service: primary care services — screening, counseling, immunizations, medication, and treatment of illness and conditions, plus optometric eye care and chiropractic services within scope of practice
Patient population: minors aged 14 to 17 living separate and apart from parents or legal guardian and managing their own personal affairs
Setting: outpatient
Modality: excludes invasive care beyond standard injections, laceration care, or non-surgical fracture care

What this means operationally

The written-identification requirement is the operational core and it is unusual: the consent does not arise from the minor's own account of their circumstances but from a document produced by one of six named third parties. Before relying on this pathway a practice therefore needs written identification from a qualifying source, and needs to recognize which sources qualify. The section itself does not impose a duty to authenticate the third party, to retain the document for any period, or to file it in the medical record — if a retention duty exists it comes from Illinois recordkeeping rules, not from here. The consent is also bounded by service: it does not extend to invasive care beyond standard injections, laceration care, or non-surgical fracture care, so care of that kind needs a different basis. That limits the consent, not the appointment.

Applies when

The minor is 14 to 17
The minor is living separate and apart from parents or legal guardian and managing their own personal affairs
The minor is identified in writing by one of the six specified entities
The service is primary care as the section defines it

Exceptions

Excludes invasive care beyond standard injections, laceration care, or non-surgical fracture care

State statute410 ILCS 210/1.5Minors aged 14 to 17 living apart, managing their own affairs, and identified in writingVerified 2026-08-29

Minor may consent

A physician, chiropractic physician, optometrist, advanced practice registered nurse, physician assistant, dentist or hospital may treat a minor without parental consent where obtaining consent is not reasonably feasible under the circumstances without adversely affecting the minor's health. Separately, a minor who is the victim of predatory criminal sexual assault or a related offense may consent to counseling, diagnosis or treatment as if the minor had reached the age of majority, and that consent is not voidable or subject to later disaffirmance because of minority.

Provider class: physicians, chiropractic physicians, optometrists, advanced practice registered nurses, physician assistants, dentists and hospitals
Service: emergency treatment where obtaining consent is not reasonably feasible without adversely affecting the minor's health; and counseling, diagnosis or treatment for a minor who is the victim of predatory criminal sexual assault or a related offense
Patient population: minors

What this means operationally

This is the section that names dentists, which neither § 1 nor § 1.5 does — but it is a SCOPED EMERGENCY PATHWAY, not a general dental self-consent rule. It reaches a dental practice only where obtaining parental consent is not reasonably feasible without adversely affecting the minor's health. The sexual-assault limb is a different shape again: not an emergency test and not a status test, granting full majority-equivalent consent for counseling as well as treatment, which puts a behavioral-health practice inside it without any age or session condition.

Applies when

Obtaining consent is not reasonably feasible without adversely affecting the minor's health, or
The minor is the victim of predatory criminal sexual assault or a related offense

State statute410 ILCS 210/3Minors in an emergency, or minors who are victims of a qualifying sexual offenseVerified 2026-08-29

Minor confidentiality

Left to professional judgment

The confidential nature of a communication is not waived by the presence, at the time of communication, of any additional persons present at the request of the minor seeking care; by the health care professional's disclosure of confidential information to that additional person with the consent of the minor seeking care, when reasonably necessary to accomplish the purpose for which the additional person is consulted; or by the health care professional billing a health benefit insurance or plan under which the minor seeking care is insured, is enrolled, or has coverage for the services provided.

Service: primary care services under § 1.5
Patient population: minors aged 14 to 17 consenting under § 1.5

What this means operationally

The billing limb is the one most likely to be misread. Submitting a claim under a plan the minor is covered by does not itself waive confidentiality, so billing cannot be treated as blanket authorization for otherwise-confidential disclosure. What happens downstream at the plan — explanation-of-benefits routing and the like — turns on separately applicable rules including HIPAA's confidential-communications provisions, and this section does not settle it. The other two limbs mean a minor can bring a support person, and the clinician can speak to that person within the purpose they were consulted for, without the protection lapsing.

Applies when

The minor sought care under § 1.5

State statute410 ILCS 210/1.5(c)Minors aged 14 to 17 receiving care under § 1.5Verified 2026-08-29

Parental access to records

Release prohibited

The service provider must not allow a parent, guardian or person in loco parentis to inspect or copy the minor's record, or any part of it, where the provider finds there are compelling reasons for denying access.

Service: a minor's counseling or psychotherapy record
Patient population: minors

Reaches this practice type when the practice holds a minor's counseling or psychotherapy record.

What this means operationally

This is a prohibition, not a permission, so a practice cannot treat a parental record request as a routine release. Every request for a minor's counseling record needs a recorded compelling-reasons determination before anything is produced, and the release workflow has to be able to withhold part of a record rather than only all or nothing.

Applies when

The record is a minor's counseling or psychotherapy record
The provider finds compelling reasons for denying access

State statute405 ILCS 5/3-550Minors receiving outpatient counseling or psychotherapyVerified 2026-08-28

Parental right of access

Any parent, including a parent who is a minor, may consent to the performance upon their child of a health care service by a physician licensed to practice medicine in all its branches, a chiropractic physician, a licensed optometrist, a licensed advanced practice registered nurse or a licensed physician assistant, or a dental procedure by a licensed dentist. A consenting parent may inspect and copy the part of that child's records related to the specific health care service for which the parent is treated as the child's personal representative under HIPAA, 45 CFR § 164.502(g). Each appointment, referral, test, treatment, procedure or other medical intervention is a separate and distinct health care service for the purpose of determining whether a parent is treated as the child's personal representative with respect to that service.

Provider class: a physician licensed to practice medicine in all its branches, a chiropractic physician, a licensed optometrist, a licensed advanced practice registered nurse, a licensed physician assistant, or a licensed dentist for a dental procedure
Service: the specific health care service for which the parent is treated as the child's personal representative under 45 CFR § 164.502(g)

What this means operationally

Illinois resolves the HIPAA personal-representative question at the granularity of the individual service rather than the relationship or the chart. A parent who consented to one appointment is the personal representative for THAT appointment, and the statutory access entitlement runs to the part of the records related to it — not to the child's file. A release process therefore cannot rest on a single patient-level determination: it has to support a service-specific evaluation and release only what that service authorises. How a practice achieves that is its own choice — manual review, tagging, logical separation — the statute sets the access granularity, not the record-keeping architecture.

Applies when

The parent consented to the specific health care service
The parent is treated as the child's personal representative under 45 CFR § 164.502(g) for that service

State statute410 ILCS 210/2Children whose parent consented to the specific serviceVerified 2026-08-29

Parental right of access

The parent or guardian of a recipient who is under 12 years of age may inspect and copy the recipient's record. A recipient who is 12 or older may inspect and copy their own record. For a recipient aged 12 to 17, the parent or guardian may inspect and copy the record if the recipient is informed and does not object, or if the therapist does not find that there are compelling reasons for denying the access. A parent or guardian denied access by either the recipient or the therapist may petition a court for access. Nothing prohibits a parent or guardian from requesting the recipient's current physical and mental condition, diagnosis, treatment needs, services provided, and services needed, including medication. Whenever access or modification is requested, the request and any action taken on it shall be noted in the recipient's record.

Service: mental health and developmental disabilities records under the Confidentiality Act
Patient population: recipients under 12, and recipients aged 12 to 17

Reaches this practice type when the practice holds records under the Confidentiality Act.

What this means operationally

Three age bands with different holders of the right, and the middle band has two independent routes to access — the recipient not objecting, or the therapist finding no compelling reason. Those are alternatives, so a refusal has to rest on the therapist's finding once the recipient has objected, and the finding is what the record needs to show. The documentation duty is unusually concrete: every access or modification request AND the action taken must be noted, which makes an unlogged request a defect in itself. Note also the information floor — a parent may still request condition, diagnosis, treatment needs, services and medication even where record access is denied, so a refusal is not a refusal of everything.

Applies when

The record is a mental health or developmental disabilities record under the Act

Exceptions

For a recipient aged 12 to 17, access may be denied where the recipient objects or the therapist finds compelling reasons
A denied parent or guardian may petition a court

State statute740 ILCS 110/4Recipients under 18Verified 2026-08-29

Provider disclosure to a parent

Provider may disclose, subject to a test

Anyone furnishing health services to the minor, or counseling related to the prevention, diagnosis or treatment of the minor's disease or of drug or alcohol use by the minor or a member of the minor's family, shall, upon the minor's consent, make reasonable efforts to involve the family of the minor in the treatment, if the person furnishing treatment believes that the involvement of the family will not be detrimental to the progress and care of the minor. Parental consent is not necessary for these services, and the minor's consent is valid and binding as if the minor had achieved majority.

Service: health services, or counseling related to the prevention, diagnosis or treatment of the minor's disease or of drug or alcohol use by the minor or a family member
Patient population: minors treated on their own consent

What this means operationally

Two gates stand before family involvement and both must be open: the MINOR must consent to it, and the clinician must believe it will not be detrimental to care. The duty that follows is to make reasonable efforts, not to achieve involvement, so the record should show the effort rather than the outcome. This is a family-involvement obligation rather than a disclosure permission — it does not authorize telling a parent anything the minor has not agreed to.

Applies when

The minor consented to family involvement
The person furnishing treatment believes involvement will not be detrimental to the minor's progress and care

State statute410 ILCS 210/4Minors receiving services on their own consentVerified 2026-08-29

Provider may disclose

A provider may, but shall not be obligated to, inform the parent, parents or guardian of a minor about treatment for a sexually transmitted infection.

Service: counseling or treatment for a sexually transmitted infection
Patient population: minors treated on their own consent

What this means operationally

A bare permission with no test attached, and it sits in the same section as an outright prohibition for substance-use counseling. Illinois therefore runs OPPOSITE disclosure defaults depending on why the minor is being seen, which means a single parental-request workflow cannot serve both — the presenting reason determines the rule before the request is even assessed.

Applies when

The counseling or treatment concerns a sexually transmitted infection

State statute410 ILCS 210/5Minors receiving STI counseling or treatmentVerified 2026-08-29

Release prohibited

A provider shall not inform the parent, parents, guardian or other responsible adult of a minor's drug or alcohol abuse condition or treatment without the minor's consent, unless that action is, in the person's judgment, necessary to protect the safety of the minor, a family member, or another individual.

Service: counseling for drug or alcohol abuse
Patient population: minors treated on their own consent

Reaches this practice type when the practice provides drug or alcohol abuse counseling.

What this means operationally

The prohibition is the default and the exception is a safety judgment reaching beyond the patient — the minor, a family member, or another individual. That third category is wider than the harm-to-self-or-others formula most jurisdictions here use, and it is a judgment rather than a threshold, so the record should show whose safety was at issue. Note also that the persons who may not be told include an 'other responsible adult', which is broader than parent or guardian.

Applies when

The counseling concerns the minor's drug or alcohol abuse

Exceptions

Disclosure is permitted where, in the person's judgment, it is necessary to protect the safety of the minor, a family member, or another individual

State statute410 ILCS 210/5Minors receiving drug or alcohol abuse counselingVerified 2026-08-29

Release prohibited

Except as provided in Sections 6 through 12.2 of the Act, records and communications may be disclosed only with the written consent of those persons who are entitled to inspect and copy a recipient's record pursuant to Section 4.

Service: records and communications under the Confidentiality Act
Patient population: recipients of mental health services

Reaches this practice type when the practice holds records under the Confidentiality Act.

What this means operationally

For disclosures governed by the section 5 consent rule, authority to consent is derived rather than assumed: whoever holds the section 4 inspection right is the person whose written consent the disclosure needs. For a twelve-to-seventeen-year-old that is the recipient, and the parent's position depends on the section 4 conditions being satisfied, so a release signed by a parent alone is not necessarily valid. The practice has to resolve the section 4 question BEFORE deciding whose signature it needs, which is the reverse of the usual order. Sections 6 through 12.2 provide separate statutory exceptions that still have to be evaluated — section 5 is not the only route to a lawful disclosure.

Applies when

The disclosure is of records or communications under the Act

Exceptions

Sections 6 through 12.2 of the Act provide exceptions to the consent requirement
Subsection (e) permits post-death disclosure with the recipient's representative and therapist consenting, or by court order on good cause
Subsection (f) addresses general consents obtained by insurers for underwriting and claims evaluation

State statute740 ILCS 110/5Recipients of mental health servicesVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Illinois breach obligations

These apply to businesses generally rather than to pediatric practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Illinoisbreach data →

Individual notice deadline

Following discovery or notification of the breach, in the most expedient time possible and without unreasonable delay, subject to the specified law-enforcement delay and any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required above 500 residents

For data collectors that are NOT HIPAA/HITECH covered entities or business associates operating under §50, § 10(e) requires notification to the Illinois Attorney General when a single breach requires notification of more than 500 Illinois residents, no later than when notice is provided to consumers. §10(e) expressly excludes covered entities and business associates in compliance with §50 from this ordinary >500-resident rule — for those entities the HIPAA-specific rule below governs instead.

Source: 815 ILCS 530/10 (Illinois Personal Information Protection Act)

Statewide rules that also reach pediatric practices

Parental right of access

Every health care practitioner shall, on the request of any patient the practitioner has treated — or of any person, entity or organization presenting a valid authorization for release signed by the patient or the patient's legally authorized representative — permit the patient, the patient's health care practitioner or authorized attorney, or that authorized requester, to examine and copy the patient's records, including those relating to diagnosis, treatment, prognosis, history, charts, pictures and plates kept in connection with the patient's treatment. A request for copies must be in writing and delivered to the practitioner.

What this means operationally

The definitions do the important work and they are counter-intuitive. 'Health care practitioner' expressly includes a medical office, health care clinic, group practice and any other organizational structure through which a licensed professional provides care — so an independent practice is a PRACTITIONER under this Act, not a facility, and the facility rule in subsection (b) is not the one that governs it. The list of practitioner types is broad: physician, dentist, podiatric physician, APRN, RN, LPN, physician assistant, clinical psychologist, clinical social worker, therapist and counsellor.

Applies when

A patient or an authorized requester asks in writing to examine or copy the record

Statewide735 ILCS 5/8-2001(c), (d) first sentencePatients treated by the practitionerVerified 2026-08-29

Deadline to respond to an access request

The requirements of § 8-2001 shall be satisfied within 30 days of receipt of a written request. If the practitioner needs more time, then WITHIN THOSE 30 DAYS the practitioner must give the requester a written statement of the reasons for the delay and the date by which the information will be provided. In any event the information must be provided no later than 60 days after receiving the request. Failure to comply with the time limit subjects the denying party to expenses and reasonable attorneys' fees incurred in any court-ordered enforcement.

What this means operationally

Illinois runs its own clock and it is stricter in shape than the federal one. The 60 days is an absolute ceiling rather than a 30-day extension that can be taken by notifying late — the written statement of reasons is itself due inside the original 30 days, so a practice that lets day 30 pass and then asks for more time has already missed the deadline it was relying on. Illinois also attaches a fee-shifting consequence the federal rule does not.

Applies when

A written request for records has been received

Exceptions

The 30 days extends to no more than 60 where a written statement of reasons and a date is given within the first 30

Statewide735 ILCS 5/8-2001(e), (g)Patients requesting their recordsVerified 2026-08-29

Limit on copy fees, format or delivery

The requester reimburses the practitioner for reasonable copying expenses not exceeding a $20 handling charge plus actual postage, plus: for paper, 75 cents per page for pages 1–25, 50 cents for pages 26–50 and 25 cents for pages beyond 50, capped at $1.25 per page for copies made from microfiche or microfilm; and for electronic records retrieved from scanning, digital imaging or other digital format, 50% of the paper per-page charge, inclusive of the storage media. Records already maintained in electronic or digital format SHALL be provided in an electronic format when so requested, and where the records system cannot create or transmit an electronic record the practitioner must inform the requester IN WRITING of the reason. Rates adjust automatically under § 8-2006. Material that cannot routinely be copied on a standard commercial photocopier, such as X-ray films, may be charged at reasonable duplication cost.

What this means operationally

Two obligations here are easy to miss because they sit inside a fee schedule. Electronic delivery is mandatory on request where the record is already electronic — not a courtesy — and a practice that cannot comply owes a WRITTEN explanation of why. The statute also closes the obvious workaround: records retrieved from scanning or digital imaging expressly do not count as microfiche or microfilm for the higher per-page cap.

Applies when

Copies of records are requested

Exceptions

Material that cannot routinely be copied on a standard commercial photocopier may be charged at reasonable duplication cost
The handling fee may not be collected from a patient or personal representative obtaining records under § 8-2001.5

Statewide735 ILCS 5/8-2001(d), (d-5)Patients and authorized requestersVerified 2026-08-29

Limit on copy fees, format or delivery

Notwithstanding any other provision of law, a health care practitioner shall provide WITHOUT CHARGE one complete copy of a patient's records where they are requested by the patient, or by an authorized requester who has provided documentation of authority to act for the patient, or by such other requester as is authorized by statute if the patient is deceased, for the purpose of supporting a claim for federal veterans' disability benefits, federal Social Security or Supplemental Security Income benefits, or Aid to the Aged, Blind, or Persons with Disabilities benefits.

What this means operationally

The exception that swallows the fee schedule for a specific and common request type. It opens 'notwithstanding any other provision of law', so it overrides the per-page charges entirely — and the trigger is the PURPOSE of the request, which means a practice has to be able to recognize a benefits-claim request at intake rather than after it has quoted a fee.

Applies when

The records are requested to support a claim for the named federal or state benefits

Exceptions

One complete copy; updated records supplied later are governed by the same subsection

Statewide735 ILCS 5/8-2001(h)Patients pursuing a benefits claimVerified 2026-08-29

Custody on closure or transfer

A health care facility or health care practitioner must provide THE PUBLIC with at least 30 days' prior notice of the closure of the facility or the practitioner's practice. The notice must include an explanation of how copies of the records may be accessed by patients. The notice may be given by publication in a newspaper of general circulation in the area in which the facility or practitioner is located.

What this means operationally

The statewide closure duty, and the baseline every profession-specific closure rule has to be measured against. Two features matter: the notice runs to the PUBLIC rather than to identified patients, and the statute names newspaper publication as a permitted method without addressing electronic notice either way. It says nothing about who holds the records after closure, so custody itself is unresolved at state level.

Applies when

A practice or facility is closing

Statewide735 ILCS 5/8-2001(f)Patients of a closing practiceVerified 2026-08-29

What applies to pediatric practices everywhere

Pediatric privacy is not simply adult privacy with a parent copied. Access rights can change based on the child's age, custody status, the service provided, who consented to the care, and state law. The SRA and compliance program must account for those changing relationships.

The EHR and patient portal, including proxy, parent, guardian, adolescent, and transitioning-adult access

Immunization registry, public-health, school, daycare, camp, sports, and specialty-referral workflows

Systems containing reproductive-health, mental-health, substance-use, STI, or other state-protected adolescent records

Custody, guardianship, foster-care, personal-representative, and restricted-access documentation

Claims, laboratories, e-prescribing, messaging, email, text, e-fax, and patient forms

Workforce access to sensitive pediatric and adolescent information

Full pediatricscompliance guide →

Knowing the Illinois rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Illinois rules on this page.

Start the risk assessment