(a) The Department may make no disclosure of any item, collection or grouping of health data which makes the individual supplying or described in such data identifiable unless: (1) The individual described in the data has consented to the disclosure.(2) The disclosure is to a governmental entity in this State, in another state or to the federal government, provided that: (i) the data will be used for a purpose for which the data was collected by the Department; and (ii) the recipient of the data has entered into a written agreement satisfactory to the Department, that it will protect such data in accordance with the requirements of this Act and will not permit further disclosure without prior approval of the Department.(3) The disclosure is to an individual or organization, for a specified time period determined by the Department, solely for bona fide research and statistical purposes, as determined in accordance with guidelines adopted by the Department, and the Department determines that: (i) the disclosures of the data to the requesting individual or organization is required for the research and statistical purposes proposed; and (ii) the requesting individual or organization has entered into a written agreement satisfactory to the Department that it will protect such data in accordance with the requirements of this Act and will not permit further disclosure without prior approval of the Department. In no event, however, may the name, address or other unique personal identifier of an individual supplying the data or described in it be disclosed under this subparagraph to the requesting individual or organization, unless a Department-approved Institutional Review Board or its equivalent on the protection of human subjects in research has reviewed and approved the data request .(4) The disclosure is to a governmental entity for the purpose of conducting an audit, evaluation or investigation of the Department and such governmental entity agrees not to use such data for making any determination to whom the health data relates.(b) Any disclosure provided for in paragraph (a) of this Section shall be made at the discretion of the Department except that the disclosure provided for in subparagraph (4) of paragraph (a) of this Section must be made when the requirements of that subparagraph have been met.(c) No identifiable health data obtained in the course of activities undertaken or supported under this Act shall be subject to subpoena or similar compulsory process in any civil or criminal, judicial, administrative or legislative proceeding, nor shall any individual or organization with lawful access to identifiable health data under the provisions of this Act be compelled to testify with regard to such health data, except that data pertaining to a party in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of such individual to enforce any liability arising under this Act.Amended by P.A. 096-0966,§ 5, eff. 7/2/2010.