88R573 SRA-F
 
  By: Howard H.B. No. 172
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to the immunization data included in and excluded from the
  immunization registry.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Section 161.007, Health and Safety Code, is
  amended by amending Subsections (a), (a-2), (b), (b-1), (c), (d),
  and (e) and adding Subsections (e-1), (l), and (m) to read as
  follows:
         (a)  The department, for the primary purpose of establishing
  and maintaining a single repository of accurate, complete, and
  current immunization records to be used in aiding, coordinating,
  and promoting efficient and cost-effective communicable disease
  prevention and control efforts, shall establish and maintain an
  immunization registry.  The executive commissioner by rule shall
  develop guidelines to:
               (1)  protect the confidentiality of patients in
  accordance with Section 159.002, Occupations Code;
               (2)  inform the individual or the individual's legally
  authorized representative about the registry and that registry
  information may be released under Section 161.00735;
               (3)  [require the written or electronic consent of the
  individual or the individual's legally authorized representative
  before any information relating to the individual is included in
  the registry;
               [(4)]  permit the individual or the individual's
  legally authorized representative to request that the individual's
  information be excluded from [withdraw consent for the individual
  to be included in] the registry;
               (4)  provide opportunities for the individual or the
  individual's legally authorized representative to request
  exclusion from the registry at any time, including:
                     (A)  at the time of the individual's birth if
  attended by a health care provider who administers immunizations;
                     (B)  each time the individual receives any
  immunization administered by a health care provider in this state;
                     (C)  through electronic submission of a request
  for exclusion using a request for exclusion procedure available on
  the department's Internet website;
                     (D)  through submission to the department of a
  written request for exclusion; and
                     (E)  following a natural or man-made disaster;
  [and]
               (5)  ensure that an individual or the individual's
  legally authorized representative is not required to request
  exclusion from the registry more than one time and that, after a
  request for exclusion is made, the individual's immunization
  information will not be included in the registry unless the
  individual or the individual's legally authorized representative
  submits to the department a written request for inclusion in the
  registry; and
               (6)  include on each immunization record generated by
  the registry the procedures for requesting exclusion from the
  registry [determine the process by which consent is verified,
  including affirmation by a health care provider, birth registrar,
  regional health information exchange, or local immunization
  registry that consent has been obtained].
         (a-2)  [The written or electronic consent required by
  Subsection (a)(3) for an individual who is 18 years of age or older
  is required to be obtained only one time and must be received from
  the individual before the information may be released.]  An
  individual's legally authorized representative or the individual,
  after the individual has attained 18 years of age, may submit a
  request [consent] in writing or electronically for the individual's
  information to be excluded from [remain in] the registry.  [The
  consent of the representative or individual is valid until the
  individual or the individual's legally authorized representative
  withdraws consent in writing or electronically. The department may
  not include in the registry the immunization information of an
  individual who is 26 years of age or older until written or
  electronic consent has been obtained as provided by this
  subsection.] The department shall coordinate with the Texas
  Education Agency to distribute materials described in Section
  161.0095(a)(2) to students and parents through local school
  districts.
         (b)  Except as provided by Section 161.0071, the
  immunization registry must contain information on the immunization
  history that is obtained by the department under:
               (1)  this section of each individual for whom
  immunization information [consent] has been obtained, unless the
  individual or the individual's legally authorized representative
  has requested the individual's information to be excluded from the
  registry in accordance with guidelines adopted under Subsection
  (a);
               (2)  Section 161.00705 of individuals [persons]
  immunized to prepare for or in response to a declared disaster,
  public health emergency, terrorist attack, hostile military or
  paramilitary action, or extraordinary law enforcement emergency;
               (3)  Section 161.00706 of first responders or their
  immediate family members; and
               (4)  Section 161.00735 of individuals [persons]
  evacuated or relocated to this state because of a disaster.
         (b-1)  The department shall exclude [remove] from the
  registry information for any individual for whom [consent has been
  withdrawn.  The department may not retain individually identifiable
  information about any individual:
               [(1)  for whom consent has been withdrawn;
               [(2)  for whom a consent for continued inclusion in the
  registry following the end of the declared disaster, public health
  emergency, terrorist attack, hostile military or paramilitary
  action, or extraordinary law enforcement emergency has not been
  received under Section 161.00705(f);
               [(3)  for whom a request to be removed from the registry
  has been received under Section 161.00706(e);
               [(4)  for whom consent for continued inclusion in the
  registry following the end of a disaster has not been received under
  Section 161.00735(f); or
               [(5)  for whom] a request to exclude [remove]
  information from the registry has been received under this
  subchapter [Section 161.00735(g)].
         (c)  A payor that receives data elements from a health care
  provider who administers an immunization to an individual younger
  than 18 years of age shall provide the data elements to the
  department.  A payor is required to provide the department with only
  the data elements the payor receives from a health care provider.  A
  payor that receives data elements from a health care provider who
  administers an immunization to an individual 18 years of age or
  older may provide the data elements to the department.  The data
  elements shall be submitted in a format prescribed by the
  department. [The department shall verify consent before including
  the reported information in the immunization registry.  The
  department may not retain individually identifiable information
  about an individual for whom consent cannot be verified.]
         (d)  A health care provider who administers an immunization
  to an individual younger than 18 years of age shall provide data
  elements regarding an immunization to the department.  A health
  care provider who administers an immunization to an individual 18
  years of age or older may submit data elements regarding an
  immunization to the department.  At the request and with the
  authorization of the health care provider, the data elements may be
  submitted through a health information exchange as defined by
  Section 182.151.  The data elements shall be submitted in a format
  prescribed by the department. A health care provider who
  administers an immunization to any individual and provides data
  elements to the department shall notify the individual or the
  individual's legally authorized representative of:
               (1)  the inclusion in the registry of the individual's
  immunization information unless exclusion from the registry is
  requested in accordance with the guidelines adopted under
  Subsection (a); and
               (2)  the procedures for requesting exclusion from the
  registry  [The department shall verify consent before including the
  information in the immunization registry. The department may not
  retain individually identifiable information about an individual
  for whom consent cannot be verified].
         (e)  The department shall:
               (1)  make available on the department's Internet
  website a printable form that:
                     (A)  states an individual's immunization
  information will be included in the registry unless exclusion from
  the registry is requested; and
                     (B)  details the procedures for submitting an
  electronic or written request for exclusion from the registry
  [provide notice to a health care provider that submits an
  immunization history for an individual for whom consent cannot be
  verified. The notice shall contain instructions for obtaining
  consent] in accordance with guidelines adopted under Subsection
  (a); and
               (2)  make the form described by Subdivision (1)
  available for distribution to health care providers [and
  resubmitting the immunization history to the department].
         (e-1)  A health care provider may use the printable form
  described by Subsection (e) to provide the notification required
  under Subsection (d).
         (l)  Registry information may not be used to exclude any
  individual from the receipt of any service during a natural or
  man-made disaster unless the service is withheld because of a
  medical contraindication.
         (m)  The department may not sell registry information to any
  public or private entity.
         SECTION 2.  Section 161.00705(f), Health and Safety Code, is
  amended to read as follows:
         (f)  Unless an individual or the individual's legally
  authorized representative [consents] in writing or electronically
  requests that [to continued inclusion of] the individual's
  information be excluded from [in] the registry, the department
  shall include [remove] the immunization records collected under
  this section in [from] the registry [on expiration of the period
  prescribed under Subsection (e)].
         SECTION 3.  Sections 161.00706(e) and (f), Health and Safety
  Code, are amended to read as follows:
         (e)  A person whose immunization records are included in the
  immunization registry as authorized by this section may request in
  writing or electronically that the department exclude [remove] that
  information from the registry. Not later than the 10th day after
  receiving a request under this subsection, the department shall
  exclude [remove] the person's immunization records from the
  registry.
         (f)  The report required under Section 161.0074 must also
  include the number of complaints received by the department related
  to the department's failure to comply with requests for exclusion
  [removal] of information from the registry under Subsection (e).
         SECTION 4.  Sections 161.0071(a) and (b), Health and Safety
  Code, are amended to read as follows:
         (a)  The first time the department receives registry data for
  an individual [for whom the department has received consent] to be
  included in the registry, the department shall send notice to the
  individual or the individual's legally authorized representative
  disclosing:
               (1)  that providers and payors may be sending the
  individual's immunization information to the department;
               (2)  the information that is included in the registry;
               (3)  the persons to whom the information may be
  released under Sections 161.00735(b) and 161.008(d);
               (4)  the purpose and use of the registry;
               (5)  the procedure to request exclusion of an
  individual's information [exclude an individual] from the
  registry; and
               (6)  the procedure to report a violation if an
  individual's information is included in the registry after
  exclusion has been requested [or consent has been withdrawn].
         (b)  The [On discovering that consent to be included in the
  registry has not been granted or has been withdrawn, the]
  department shall exclude [the individual's immunization records]
  from the registry and any other registry-related department record
  that individually identifies the individual the immunization
  record of any individual from whom a request for exclusion has been
  received by the department.
         SECTION 5.  Section 161.0073, Health and Safety Code, is
  amended by amending Subsection (a) and adding Subsections (e), (f),
  (g), and (h) to read as follows:
         (a)  Except as provided by this section and Sections 161.007, 
  161.00705, 161.00706, [and] 161.00735, and 161.008, information
  that individually identifies an individual that is received by the
  department for the immunization registry is confidential and may be
  used by the department for registry purposes only.
         (e)  The department may use registry information for
  internal public health research on approval of the department's
  institutional review board.
         (f)  The department may release registry information for
  external public health research if:
               (1)  the individual or the individual's legally
  authorized representative submits a written authorization to the
  department for release of the individual's registry data;
               (2)  the department does not disclose individually
  identifiable information; or
               (3)  subject to Subsection (g), the department's
  institutional review board approves the release of individually
  identifiable information.
         (g)  The department's institutional review board may not
  approve the release of individually identifiable information for a
  research proposal unless the proposal includes a provision
  requiring the proposal's researchers to obtain informed consent
  from each individual or the individual's legally authorized
  representative before the department releases the individual's
  registry data to the researchers.
         (h)  The executive commissioner shall adopt rules to ensure
  that the use or release of registry information under this
  subchapter complies with all state and federal laws relating to the
  privacy, protection, confidentiality, and transmission of health
  information, including the Health Insurance Portability and
  Accountability Act of 1996 (Pub. L. No. 104-191) and rules adopted
  under that Act.
         SECTION 6.  Sections 161.00735(c), (g), and (h), Health and
  Safety Code, are amended to read as follows:
         (c)  The department may receive immunization information
  from a health authority of another state or from a local health
  authority in another state if the department determines that
  residents of that state have evacuated or relocated to this state in
  response to a disaster.  The department shall include information
  received under this subsection in the registry.  [Notwithstanding
  Section 161.007, the department is not required to obtain written
  consent for the inclusion in the registry of information received
  under this subsection.]
         (g)  If an individual or, if a child, the child's parent,
  managing conservator, or guardian requests in writing that the
  individual's or child's information obtained under Subsection (c)
  be excluded [removed] from the registry, the department shall
  exclude [remove] that information from the registry.
         (h)  The executive commissioner shall make every effort to
  enter into a memorandum of agreement with each state to which
  residents of this state are likely to evacuate in a disaster on:
               (1)  the release to and use by [of registry information
  under this section to] the appropriate health authority or local
  health authority of that state of registry information under this
  section[, including the length of time the information may be
  retained by that state]; and
               (2)  the receipt and use of information submitted by
  the health authority or local health authority of that state for
  inclusion in the registry under this section.
         SECTION 7.  Sections 161.008(c) and (e), Health and Safety
  Code, are amended to read as follows:
         (c)  The department may obtain the data constituting an
  immunization record for an individual from a public health
  district, a local health department, the individual or the
  individual's legally authorized representative, a physician to the
  individual, a payor, or any health care provider licensed or
  otherwise authorized to administer vaccines. [The department shall
  verify consent before including the reported information in the
  immunization registry.  The department may not retain individually
  identifiable information about an individual for whom consent
  cannot be verified.]
         (e)  An individual or the individual's legally authorized
  representative may obtain and on request to the department shall be
  provided with all individually identifiable immunization registry
  information concerning the individual and information on the
  procedure for requesting exclusion from the registry.
         SECTION 8.  Section 161.009(a), Health and Safety Code, is
  amended to read as follows:
         (a)  A person commits an offense if the person:
               (1)  negligently releases or discloses immunization
  registry information in violation of Section 161.007, 161.0071,
  161.0073, or 161.008;
               (2)  fails to exclude an individual's immunization
  information in violation of Section 161.0071;
               (3)  fails to exclude an individual's [remove a
  person's] immunization information in violation of Section
  161.00705, 161.00706, or 161.00735; or
               (4)  negligently uses information in the immunization
  registry to solicit new patients or clients or for other purposes
  that are not associated with immunization or quality-of-care
  purposes, unless authorized under this section.
         SECTION 9.  Section 161.0095(a), Health and Safety Code, is
  amended to read as follows:
         (a)  The department shall develop:
               (1)  continuing education programs for health care
  providers relating to immunizations and the vaccines for children
  program operated by the department under authority of 42 U.S.C.
  Section 1396s; and
               (2)  educational information, for health care
  providers, health care clinics, hospitals, and any other health
  care facility that provides health care to children 14 to 18 years
  of age, relating to the immunization registry and the option for an
  individual or the individual's legally authorized representative
  to request exclusion [who is 18 years of age or older to consent to
  submission and retention] of the individual's information from [in]
  the immunization registry.
         SECTION 10.  Section 161.0107(c), Health and Safety Code, is
  amended to read as follows:
         (c)  The executive commissioner by rule shall specify:
               (1)  the fields necessary to populate the immunization
  registry[, including a field that indicates the patient's consent
  to be listed in the immunization registry has been obtained]; and
               (2)  the data standards that must be used for
  electronic submission of immunization information.
         SECTION 11.  The following provisions of the Health and
  Safety Code are repealed:
               (1)  Sections 161.007(a-1), (a-3), (a-4), (a-5), and
  (a-6);
               (2)  Sections 161.00705(e) and (h); and
               (3)  Sections 161.00735(e) and (f).
         SECTION 12.  (a)  The changes in law made by this Act to
  Subchapter A, Chapter 161, Health and Safety Code, apply to
  immunization information received by the Department of State Health
  Services before, on, or after January 1, 2025. An individual whose
  immunization information was included immediately before January
  1, 2025, in the immunization registry established under Subchapter
  A, Chapter 161, Health and Safety Code, is subject to the changes in
  law made by this Act to that subchapter, including the procedures
  established by that subchapter as amended by this Act.
         (b)  The changes in law made by this Act do not authorize the
  Department of State Health Services to include in the immunization
  registry established under Subchapter A, Chapter 161, Health and
  Safety Code, immunization information of an individual who is 18
  years of age or older and whose immunization information was not
  included in the registry on or before January 1, 2025, unless the
  department receives immunization data from a health care provider
  who:
               (1)  administers an immunization to the individual
  after that date and elects to provide the individual's immunization
  information to the department; and
               (2)  notifies the individual before submission of the
  information to the department:
                     (A)  that the health care provider is providing
  the information to the department for inclusion in the registry;
                     (B)  that the information will remain in the
  registry until exclusion is requested by the individual or the
  individual's legally authorized representative; and
                     (C)  of the procedures for requesting exclusion
  from the registry under Subchapter A, Chapter 161, Health and
  Safety Code, as amended by this Act.
         (c)  The changes in law made by this Act apply only to an
  offense committed on or after the effective date of this Act. An
  offense committed before the effective date of this Act is governed
  by the law in effect on the date the offense was committed, and the
  former law is continued in effect for that purpose. For purposes of
  this section, an offense was committed before the effective date of
  this Act if any element of the offense occurred before that date.
         SECTION 13.  (a) As soon as practicable after the effective
  date of this section, the Department of State Health Services shall
  conduct a public awareness campaign to educate health care
  providers, parents, payors, schools, and the public about the
  changes in law made by this Act.
         (b)  As soon as practicable after the effective date of this
  section, the executive commissioner of the Health and Human
  Services Commission shall adopt the rules required by Section
  161.0073(h), Health and Safety Code, as added by this Act.
         SECTION 14.  (a) Except as provided by Subsection (b) of this
  section, this Act takes effect January 1, 2025.
         (b)  Section 13 of this Act takes effect September 1, 2023.