SB4023 amends Illinois' Department of Professional Regulation Law to expand the data DFPR collects when health care professionals apply for or renew a license. For those defined as “health care professionals,” the bill makes provision of practice information mandatory: areas of specialty, addresses of all current practice locations, hours spent at each location on direct outpatient care, the applicant’s National Provider Identifier (if applicable), and an anticipated retirement date.
The Department must share that practice-level data with authorized personnel at the Illinois Department of Public Health and treats the data collected under that mandate as exempt from the Freedom of Information Act.
The bill also preserves a broader, voluntary demographic collection (sex, race, ethnicity, disability, primary language, zip code and anticipated retirement) and requires DFPR to publish an annual, aggregate report by March 1 summarizing demographic data it collected, counts of license and renewal applications, and counts of applicants denied licensure in the prior calendar year. The combination of mandatory, practice‑level collection, IDPH access, FOIA exemption, and required aggregated publication creates a new state data pipeline for workforce planning while raising questions about privacy, implementation burden, and data quality for regulators and employers.
At a Glance
What It Does
Requires DFPR to collect mandatory practice information from health-care licensure applicants and renewals (specialty, all current practice addresses, hours at each location for direct outpatient care, NPI where applicable, and anticipated retirement). It requires DFPR to share that practice data with authorized personnel at IDPH and exempts those data from FOIA.
Who It Affects
Directly affects professionals licensed under a specified list of Illinois health-practice acts (physicians, nurses, physician assistants, podiatrists, clinical psychologists, therapists, counselors, audiologists, and others), DFPR and IDPH staff, and entities that use workforce data for planning or oversight.
Why It Matters
Creates a persistent, state-controlled dataset tying providers to practice locations and hours, enabling more granular workforce planning and oversight. At the same time, the FOIA exemption and mandatory submission of location-level information shift privacy and operational responsibilities onto licensees and state agencies.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB4023 operates on two parallel tracks. First, it keeps an existing voluntary demographic collection: DFPR will request (but not require) applicants provide sex, race, ethnicity, disability status, primary language, zip code, and an anticipated retirement date.
Those fields remain optional and are intended for aggregate reporting. Second, and more consequentially, the bill compels health-care license applicants and renewals to provide specific practice information — specialty, every current practice address, hours devoted at each site to direct outpatient care, and an NPI if the practitioner has one — plus an anticipated retirement date.
DFPR must collect these fields as a condition of processing applications for the professions listed in the bill.
Once DFPR collects the required practice data, the agency must share it with authorized personnel at the Illinois Department of Public Health. The statute makes the data collected under the mandatory practice-information subsection exempt from the Illinois Freedom of Information Act; that is, raw practice-location and hours data submitted by applicants are not subject to public FOIA requests.
Separately, DFPR must prepare and post an annual aggregate report on its website by March 1 covering the prior calendar year. That report must include aggregated demographic information from the voluntary fields, the count of licensure and renewal applications DFPR received, and the number of applicants who were denied licensure during the prior year “regardless of whether application was made in that calendar year.” The law also explicitly bars publishing any data that would identify an individual provider.Operationally, the bill draws a direct line between licensing records and public-health workforce planning: DFPR gathers granular practice data, IDPH gets authorized access, and DFPR publishes aggregated summaries.
That raises implementation questions (how DFPR captures and validates multiple practice addresses and hours, how often practitioners update the data, and how DFPR and IDPH secure FOIA-exempt data). The statute defines which professions fall under the “health care professional” label by referencing a list of existing Illinois licensing Acts, so the collection applies only to those license categories enumerated in the bill.
The Five Things You Need to Know
DFPR must require applicants for the listed health-professional licenses to submit addresses for all current practice locations and the hours spent at each location on direct outpatient care.
Data specifically collected under the compulsory practice-information subsection is explicitly exempted from the Illinois Freedom of Information Act.
DFPR must publish an annual, aggregate report by March 1 that includes demographic aggregates, the number of licensure and renewal applications received the prior year, and the number of applicants denied licensure in that prior year regardless of when their application was filed.
DFPR is required to share the collected practice-level information with authorized personnel at the Illinois Department of Public Health for workforce or public-health purposes.
The bill defines “health care professional” by reference to a specific list of Illinois licensing Acts (Medical Practice Act of 1987; Nurse Practice Act; Clinical Psychologist Licensing Act; Illinois Optometric Practice Act; Physical Therapy Act; Physician Assistant Practice Act; Clinical Social Work and Social Work Practice Act; Nursing Home Administrators Act; Occupational Therapy Act; Podiatric Medical Practice Act of 1987; Respiratory Care Practice Act; Professional Counselor and Clinical Professional Counselor Act; and Speech‑Language Pathology and Audiology Practice Act).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Voluntary demographic data collection
DFPR will continue to request, but not require, demographic fields such as sex, race, ethnicity, disability, primary language, zip code and anticipated retirement from all applicants. These items are intended for aggregation and are optional; applicants can choose not to provide them. The practical implication is DFPR can use voluntary responses to produce demographic summaries without creating a statutory obligation on applicants to supply personally identifying demographic data.
Mandatory practice‑level information for health care professionals
This is the operative core: for applicants and renewals in professions listed elsewhere in the bill, DFPR must collect specialty, every current practice address, hours at each location devoted to direct outpatient care, NPI if applicable, and anticipated retirement date. DFPR must share these records with authorized IDPH personnel. The subsection also makes this category of data exempt from FOIA, narrowing public access to raw, person-level practice records while preserving IDPH access for planning or regulatory uses.
Annual aggregate reporting requirement
DFPR must publish an annual website report by March 1 for the previous calendar year. The report must contain aggregate demographic data (from the voluntary fields), counts of licensure and renewal applications received, and counts of applicants denied licensure during the preceding year — including denials of applications submitted in prior years. The statute requires that none of the published material identify an individual provider or include data that would lead to identification, which limits the public-facing usefulness to summary statistics rather than searchable records.
Who’s covered: the statutory definition of health care professional
The bill attaches the mandatory reporting regime to license categories by listing the Acts under which practitioners are licensed (medicine, nursing, clinical psychology, optometry, physical therapy, physician assistant, clinical social work and social work, nursing home administrators, occupational therapy, podiatry, respiratory care, professional counseling, speech-language pathology and audiology). That definitional choice means the bill applies only to those licenses regulated by DFPR under those Acts and not to every occupational title that could be considered a health worker.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Illinois Department of Public Health — gains authorized access to address-level and hours data to produce finer-grained workforce and access-to-care analyses and to target public-health interventions or planning.
- State health workforce planners and policy makers — obtain a state-curated dataset that links licensed providers to practice locations and service hours, improving capacity and geographic distribution assessments.
- Regulatory compliance and licensure teams — DFPR and IDPH can use consolidated practice data to detect mismatches between licensure records and practice locations, improving oversight and enforcement.
Who Bears the Cost
- Health care licensees covered by the listed Acts — must supply and keep current multiple practice addresses, hours by site, and retirement timing; that raises administrative burden, potential privacy concerns, and risk of disciplinary or reimbursement scrutiny if data are inaccurate.
- DFPR — must modify application and renewal systems, validate or store multi-site address and hours data securely, coordinate data transfers to IDPH, and absorb IT, personnel, and data‑security costs.
- IDPH — while gaining access to richer data, IDPH inherits responsibilities for using and protecting FOIA-exempt records and for defining authorized personnel and permissible uses, which may require additional staffing, policies, and technical safeguards.
Key Issues
The Core Tension
The central tension is between the state’s legitimate need for high-resolution workforce and access-to-care data and individual providers’ privacy and administrative burdens: collecting addresses, site-level hours, and retirement timing creates valuable planning signals but also concentrates sensitive, re-identification-prone data in state hands while denying FOIA-based public scrutiny of the raw records.
The bill balances two legitimate goals—better workforce intelligence and protection of provider privacy from broad public disclosure—by making practice-level submissions mandatory but raw records non-public and only accessible to authorized IDPH personnel. That design reduces the risk of open‑file misuse of provider addresses, yet publishing only aggregate summaries will limit the usefulness of the dataset for independent researchers and community stakeholders who rely on public records.
Aggregation also raises methodological questions: how DFPR will bin hours and locations, how it will handle low-count suppression to avoid re-identification, and whether the published aggregates will be frequent or granular enough to meet planning needs.
Implementation depends on operational choices the bill leaves unspecified. DFPR must decide how to capture and validate multiple practice addresses, whether telehealth or administrative offices count as “practice locations,” how often applicants must update records, and how to reconcile self-reported hours with billing/NPI activity.
The FOIA exemption applies only to data collected under the mandatory practice-information subsection, not to voluntary demographic fields, producing an uneven transparency regime. Finally, the statute requires DFPR to share the data with “authorized personnel” at IDPH but does not detail access controls, retention schedules, or permitted analytic uses—decisions that will materially affect privacy risk and analytic value.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.