81R4413 YDB-D

By: Howard of Travis H.B. No. 1828

A BILL TO BE ENTITLED

AN ACT

relating to information submitted to, maintained in, and released from the immunization registry.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 161.0001, Health and Safety Code, is amended by adding Subdivision (1-c) and amending Subdivision (2) to read as follows:

(1-c) "Individual's legally authorized representative" means:

(A) a parent, managing conservator, or guardian of an individual, if the individual is a minor;

(B) a guardian of the individual, if the individual has been adjudicated incompetent to manage the individual's personal affairs; or

(C) an agent of the individual authorized under a durable power of attorney for health care.

(2) "Payor" means an insurance company, a health maintenance organization, or another organization that pays a health care provider to provide health care benefits, including providing immunizations [to a person younger than 18 years of age].

SECTION 2. Sections 161.007(a), (a-1), (b), (b-1), (c), (d), (e), (f), (j), and (k), Health and Safety Code, are amended to read as follows:

(a) The department, for the primary purpose of establishing and maintaining a single repository of accurate, complete, and current immunization records to be used in aiding, coordinating, and promoting efficient and cost-effective [childhood] communicable disease prevention and control efforts, shall establish and maintain an immunization registry. The executive commissioner of the Health and Human Services Commission [department] by rule shall develop guidelines to:

(1) protect the confidentiality of patients in accordance with Section 159.002, Occupations Code;

(2) inform the individual or the individual's legally authorized representative [a parent, managing conservator, or guardian of each patient younger than 18 years of age] about the registry and that registry information may be released under Section 161.00705(g)(2) or (3) in the event of certain disasters, emergencies, attacks, or actions;

(3) require the written consent of the individual or the individual's legally authorized representative for the individual's inclusion in the registry [a parent, managing conservator, or guardian of a patient younger than 18 years of age] before any information relating to the individual [patient] is disclosed to any other user of [included in] the registry except as otherwise provided by this subchapter;

(4) permit the individual or the individual's legally authorized representative [a parent, managing conservator, or guardian of a patient younger than 18 years of age] to withdraw consent for the individual [patient] to be included in the registry, except as provided by Section 161.00705(e); [and]

(5) determine the process by which consent is verified, including affirmation by a health care provider, birth registrar, regional health information exchange, or local immunization registry that consent has been obtained; and

(6) allow the department to retain information in the registry until a person's death.

(a-1) The written consent required by Subsection (a)(3) is required to be obtained only one time. The written consent is valid until the individual or the individual's legally authorized representative withdraws [child becomes 18 years of age unless] the consent [is withdrawn] in writing. A parent, managing conservator, or guardian of a minor [child] may provide the written consent by using an electronic signature on the minor's [child's] birth certificate. The executive commissioner of the Health and Human Services Commission by rule shall develop procedures for obtaining consent from an individual who is 18 years of age or older.

(b) Except as provided by Section 161.0071, the [The] immunization registry must contain information on the immunization history that is obtained by the department under:

(1) this section of each individual [person who is younger than 18 years of age and] for whom consent has been obtained in accordance with guidelines adopted under Subsection (a);

(2) Section 161.00705 of persons immunized to prepare for or in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state; and

(3) Section 161.00706 of first responders or their immediate family members.

(b-1) The department shall remove from the registry information for any individual [person] for whom consent has been withdrawn. The department may not retain individually identifiable information about any individual [person]:

(1) for whom consent has been withdrawn;

(2) for whom a consent for continued inclusion in the registry following the end of the declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency has not been received under Section 161.00705(f); or

(3) for whom a request to be removed from the registry has been received under Section 161.00706(e).

(c) A payor that receives data elements from a health care provider who administers an immunization to an individual [a person] younger than 18 years of age shall provide the data elements to the department. A payor is required to provide the department with only the data elements the payor receives from a health care provider. A payor that receives data elements from a health care provider who administers an immunization to an individual 18 years of age or older may provide the data elements to the department. The data elements shall be submitted in a format prescribed by the department. Except as provided by this subchapter, the [The] department shall verify consent before disclosing [including] the reported information to other users of [in] the immunization registry. The department may [not] retain individually identifiable information about an individual obtained under this subsection [a person] for whom consent cannot be verified. The department may not disclose the information to other users of the registry until consent is verified, except that the department may disclose the information to public health officials or health authorities during a disaster, emergency, attack, or action described by Section 161.00705(a).

(d) A health care provider who administers an immunization to an individual [a person] younger than 18 years of age shall provide data elements regarding an immunization to the department. A health care provider who administers an immunization to an individual 18 years of age or older may submit data elements regarding an immunization to the department. The data elements shall be submitted in a format prescribed by the department. Except as provided by this subchapter, the [The] department shall verify consent before disclosing [including] the information to other users of [in] the immunization registry. The department may [not] retain individually identifiable information about an individual obtained under this subsection [a person] for whom consent cannot be verified. The department may not disclose the information to other users of the registry until consent is verified, except that the department may disclose the information to public health officials or health authorities during a disaster, emergency, attack, or action described by Section 161.00705(a).

(e) The department shall provide notice to a health care provider that submits an immunization history for an individual [a person] for whom consent cannot be verified. The notice shall contain instructions for obtaining consent in accordance with guidelines adopted under Subsection (a) and resubmitting the immunization history to the department.

(f) The department and health care providers may use the registry to provide notices by mail, telephone, personal contact, or other means to an individual or the individual's legally authorized representative [a parent, managing conservator, or guardian] regarding an individual [his or her child or ward] who is due or overdue for a particular type of immunization according to the department's immunization schedule for minors or another analogous schedule recognized by the department for individuals 18 years of age or older. The department shall consult with health care providers to determine the most efficient and cost-effective manner of using the registry to provide those notices.

(j) Except as provided by Sections 161.00705, 161.00706, and 161.008, information obtained by the department for the immunization registry is confidential and may be disclosed only with the written consent of the individual or the individual's legally authorized representative [, if a child, the child's parent, managing conservator, or guardian].

(k) The executive commissioner of the Health and Human Services Commission [board] shall adopt rules to implement this section.

SECTION 3. Section 161.00705, Health and Safety Code, is amended by amending Subsections (a), (c), (e), (f), and (g) and adding Subsections (a-1) and (j) to read as follows:

(a) The department shall maintain a registry of persons who receive an immunization, antiviral, and other medication administered to prepare for a potential disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state or in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or in another state. A health care provider who administers an immunization, antiviral, or other medication to a resident of this state or to a resident of another state that has relocated or evacuated to this state shall provide the data elements to the department.

(a-1) The department may accept from a health authority in another state or a local health authority in another state immunization information for inclusion in the registry under this section if the department determines that:

(1) residents of that state have evacuated or relocated to this state in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in that state; or

(2) residents of this state have evacuated or relocated to that state in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state.

(c) The department shall track adverse reactions to an immunization, antiviral, and other medication administered to prepare for a potential disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state or in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state. A health care provider who administers an immunization, antiviral, or other medication to a resident of this state or to a resident of another state that has relocated or evacuated to this state may provide data related to adverse reactions to the department.

(e) The executive commissioner of the Health and Human Services Commission by rule shall determine the period during which the information collected under this section must remain in the immunization registry following the end of the disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state.

(f) Unless an individual or, if a minor [child], the minor's [child's] parent, managing conservator, or guardian consents in writing to continued inclusion of the minor's [child's] or other individual's information in the registry, the department shall remove the immunization records collected under this section from the registry on expiration of the period prescribed under Subsection (e).

(g) The immunization information of a minor [child] or other individual received by the department under this section, including individually identifiable information, may be released only:

(1) on consent of the individual or, if a minor [child], the minor's [child's] parent, managing conservator, or guardian; [or]

(2) to a state agency or health care provider in this state consistent with the purposes of this subchapter or the purposes of aiding or coordinating communicable disease prevention and control efforts during a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency in this state or another state; or

(3) to an appropriate health authority or local health authority of another state to which residents of this state have evacuated or relocated in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency consistent with the purposes of this subchapter or the purposes of aiding or coordinating communicable disease prevention and control efforts during a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency.

(j) The executive commissioner of the Health and Human Services Commission may enter into a memorandum of agreement with another state on:

(1) the release and use of registry information under this section to the appropriate health authority or local health authority of that state; or

(2) the receipt and use of information submitted by the health authority or local health authority of that state for inclusion in the registry under this section.

SECTION 4. Sections 161.00706(c) and (d), Health and Safety Code, are amended to read as follows:

(c) The executive commissioner of the Health and Human Services Commission shall:

(1) develop rules to ensure that immunization history submitted under Subsection (a)(2) is medically verified immunization information;

(2) develop guidelines for use by the department in informing first responders about the registry and that registry information may be released under Section 161.00705 in the event of certain disasters, emergencies, attacks, or actions; and

(3) adopt rules necessary for the implementation of this section.

(d) Except as provided by Section 161.00705, in the event of certain disasters, emergencies, attacks, or actions, a [A] person's immunization history or data received by the department under this section may be released only:

(1) on consent of the person; or

(2) to any health care provider licensed or otherwise authorized to administer vaccines.

SECTION 5. Section 161.0071, Health and Safety Code, is amended to read as follows:

Sec. 161.0071. NOTICE OF RECEIPT OF REGISTRY DATA; EXCLUSION FROM REGISTRY. (a) The first time the department receives registry data for an individual [a child] for whom the department has received consent to be included in the registry, [from a person other than the child's parent, managing conservator, or guardian,] the department shall send a written notice to the individual or the individual's legally authorized representative [child's parent, managing conservator, or guardian] disclosing:

(1) that providers and payors may be sending the individual's [child's] immunization information to the department;

(2) the information that is included in the registry;

(3) the persons to whom the information may be released under Section 161.00705(g)(2) or (3) and Section 161.008(d);

(4) the purpose and use of the registry;

(5) the procedure to exclude an individual [a child] from the registry; and

(6) the procedure to report a violation if an individual [a parent, managing conservator, or guardian discovers a child] is included in the registry after exclusion has been requested or consent has been withdrawn.

(b) On discovering that consent to be included in the registry has not been granted or has been withdrawn, the department shall exclude the individual's [child's] immunization records from the registry and any other registry-related department record that individually identifies the individual [child].

(c) On receipt of a written request to exclude an individual's [a child's] immunization records from the registry, the department shall send to the individual or the individual's legally authorized representative [a parent, managing conservator, or guardian] who makes the request a written confirmation of receipt of the request for exclusion and shall exclude the individual's [child's] records from the registry.

(d) The department commits a violation if the department fails to exclude an individual's [a child's] immunization information from the registry as required by Subsection (b) or (c).

(e) The department shall accept a written statement from an individual or the individual's legally authorized representative [a parent, managing conservator, or guardian] communicating to the department that an individual's information [a child] should be excluded from the registry, including a statement on a minor's [the child's] birth certificate, as a request for exclusion under Subsection (c). The written statement may include the electronic signature on the minor's [child's] birth certificate.

SECTION 6. Section 161.0072, Health and Safety Code, is amended to read as follows:

Sec. 161.0072. PROVIDING IMMUNIZATION INFORMATION TO DEPARTMENT. (a) If the individual or the individual's legally authorized representative [parent, managing conservator, or guardian of a child] has reasonable concern that the individual's [child's] health care provider is not submitting the immunization history to the department [and the parent, managing conservator, or guardian wants the child included in the registry], the individual or the individual's legally authorized representative [parent, managing conservator, or guardian] may provide the individual's [child's] immunization history directly to the department to be included in the immunization registry.

(b) The individual or the individual's legally authorized representative [parent, managing conservator, or guardian of a child] may send evidence of the individual's [child's] immunization history to the department by facsimile transmission or by mail. The evidence may include a copy of:

(1) the individual's [child's] medical record indicating the immunization history;

(2) an invoice from a health care provider for the immunization; or

(3) documentation showing that a claim for the immunization was paid by a payor.

(c) The board shall develop rules to ensure that the immunization history submitted by an individual or the individual's legally authorized representative [a parent, managing conservator, or guardian] is medically verified immunization information.

SECTION 7. Sections 161.0073(a), (b), and (c), Health and Safety Code, are amended to read as follows:

(a) Except as provided by Section 161.00705, information that individually identifies an [a child or other] individual that is received by the department for the immunization registry is confidential and may be used by the department for registry purposes only.

(b) Unless specifically authorized under this subchapter, the department may not release registry information to any individual or entity without the consent of the individual or the individual's legally authorized representative [person or, if a minor, the parent, managing conservator, or guardian of the child].

(c) A person required to report information to the department for registry purposes or authorized to receive information from the registry may not disclose the individually identifiable information of an [a child or other] individual to any other person without written consent of the individual or the individual's legally authorized representative [, if a child, the parent, managing conservator, or guardian of the child], except as provided by this subchapter, Chapter 159, Occupations Code, or Section 602.053, Insurance Code.

SECTION 8. Sections 161.008(c), (d), (e), (g), and (h), Health and Safety Code, are amended to read as follows:

(c) The department may obtain the data constituting an immunization record for an individual [a child] from a public health district, a local health department, the individual or the individual's legally authorized representative [child's parent, managing conservator, or guardian], a physician to the individual [child], a payor, or any health care provider licensed or otherwise authorized to administer vaccines. Except as provided by this subchapter, the [The] department shall verify consent before disclosing [including] the reported information in the immunization registry. The department may [not] retain individually identifiable information about an individual obtained under this subsection [a person] for whom consent cannot be verified. The department may not disclose the information to other users of the registry until consent is verified, except that the department may disclose the information to public health officials or health authorities during a disaster, emergency, attack, or action described by Section 161.00705 in accordance with that section.

(d) The department may release the data constituting an immunization record for the individual [child] to:

(1) any entity that is described by Subsection (c);

(2) [, to] a school or child care facility in which the individual [child] is enrolled;

(3) [, or to] a state agency having legal custody of the individual; or

(4) any entity as necessary to verify an immunization required for:

(A) admittance in a professional school, college, or university;

(B) certification in a health care profession;

(C) enlistment in the United States armed forces; or

(D) any other purpose at the request of the individual [child].

(e) An individual or the individual's legally authorized representative [A parent, managing conservator, or legal guardian] may obtain and on request to the department shall be provided with all individually identifiable immunization registry information concerning the individual [his or her child or ward].

(g) The department may release nonidentifying summary statistics related to the registry that do not individually identify an individual [a child].

(h) The executive commissioner of the Health and Human Services Commission [board] shall adopt rules to implement this section.

SECTION 9. Section 161.009(a), Health and Safety Code, is amended to read as follows:

(a) A person commits an offense if the person:

(1) negligently releases or discloses immunization registry information in violation of Section 161.007, 161.0071, 161.0073, or 161.008;

(2) fails to exclude an individual's [a child's] immunization information in violation of Section 161.0071;

(3) fails to remove a person's immunization information in violation of Section 161.00705 or 161.00706; or

(4) negligently uses information in the immunization registry to solicit new patients or clients or for other purposes that are not associated with immunization or quality-of-care purposes, unless authorized under this section.

SECTION 10. This Act takes effect September 1, 2009.