Protection of and confidential access to medical records and information under the Hospital Licensing Act - 210 ILL. COMP. STAT. § 85/6.17

All information gathered by the hospital is the property of the hospital, and must be protected from unauthorized disclosure.
 
Hospitals must retain medical records for 10 years. If the hospital is notified before the expiration of 10 years by an attorney regarding pending litigation involving a particular patient, the hospital must retain the record until being notified in writing that the case has concluded, or for a period of 12 years from when the record was produced, whichever occurs first.
 
Hospital staff may not disclose information to persons other than the patient or persons authorized by the patient, parties involved in treatment or payment, and to parties responsible for peer review, utilization review, quality assurance, risk management, or in connection with claims brought against the hospital, and as required by law.
 
Hospital staff may communicate with legal counsel regarding medical record privacy and retention requirements at any time and in any fashion.
 
Any person that acts in good faith acts in accordance with this section will not be subject to liability or professional discipline.
 
Any person who willfully discloses information from a medical record is guilty of a Class A misdeamnor.