Olcott Bill Fines Unauthorized Vaccine Record Sharing Up To $50K

The text as introduced · 1,382 words

89R4966 KRM-F

By: Olcott
H.B. No. 2872

A BILL TO BE ENTITLED

AN ACT

relating to the release or disclosure of vaccination or

immunization information; providing a civil penalty.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subchapter A, Chapter 161, Health and Safety

Code, is amended by adding Section 161.0093 to read as follows:

Sec. 161.0093. PROHIBITED RELEASE OR DISCLOSURE OF

VACCINATION OR IMMUNIZATION INFORMATION; EXCEPTIONS; CIVIL

PENALTY. (a) In this section, "health authority" has the meaning

assigned by Section 81.003.

(b) An employee or agent of the department or a health

authority may not release or otherwise disclose to any person an

individual's vaccination or immunization information the

department or health authority receives unless:

(1) the department or health authority, as applicable,

obtains the written or electronic consent of the individual or the

individual's legally authorized representative;

(2) the employee or agent releases or discloses the

information to a health care provider in accordance with applicable

state and federal laws relating to the privacy, protection,

confidentiality, and transmission of health information; or

(3) the release or disclosure is otherwise authorized

by this subchapter.

(c) A person who obtains an individual's vaccination or

immunization information under this subchapter may not release or

otherwise disclose the information to a third party, including

under a contract or subcontract, for the purpose of encouraging

individuals to obtain a vaccine or to provide educational materials

on a vaccine.

(d) A person who releases or discloses vaccination or

immunization information in violation of Subsection (b) or (c) is

liable to this state for a civil penalty in an amount of not less

than $2,000 and not more than $50,000 for each violation. The

attorney general may bring an action to collect the civil penalty

imposed under this subsection.

SECTION 2. Sections 161.007(a) and (j), Health and Safety

Code, are amended to read as follows:

(a) The department, for the primary purpose of establishing

and maintaining a single repository of accurate, complete, and

current immunization records to be used in aiding, coordinating,

and promoting efficient and cost-effective communicable disease

prevention and control efforts, shall establish and maintain an

immunization registry. The executive commissioner by rule shall

develop guidelines to:

(1) protect the confidentiality of patients in

accordance with Section 159.002, Occupations Code;

(2) inform the individual or the individual's legally

authorized representative about the registry [ and that registry

information may be released under Section 161.00735 ];

(3) require the written or electronic consent of the

individual or the individual's legally authorized representative

before any information relating to the individual is included in

the registry;

(4) permit the individual or the individual's legally

authorized representative to withdraw consent for the individual to

be included in the registry; and

(5) determine the process by which consent is

verified, including affirmation by a health care provider, birth

registrar, regional health information exchange, or local

immunization registry that consent has been obtained.

(j) Except as provided by Sections 161.00705, 161.00706,

[ 161.00735(b), ] and 161.008, information obtained by the

department for the immunization registry is confidential and may be

disclosed only with the written or electronic consent of the

individual or the individual's legally authorized representative.

SECTION 3. Section 161.00705(g), Health and Safety Code, is

amended to read as follows:

(g) The immunization information of a child or other

individual received by the department under this section, including

individually identifiable information, may be released only:

(1) on consent of the individual or, if a child, the

child's parent, managing conservator, or guardian; or

(2) to a [ state agency or ] health care provider

consistent with the purposes of this subchapter or the purposes of

aiding or coordinating communicable disease prevention and control

efforts during a declared disaster, public health emergency,

terrorist attack, hostile military or paramilitary action, or

extraordinary law enforcement emergency.

SECTION 4. Sections 161.00706(c) and (d), Health and Safety

Code, are amended to read as follows:

(c) The executive commissioner shall:

(1) develop rules to ensure that immunization history

submitted under Subsection (a)(2) is medically verified

immunization information;

(2) develop guidelines for use by the department in

informing first responders about the registry [ and that registry

information may be released under Section 161.00735 ]; and

(3) adopt rules necessary for the implementation of

this section.

(d) A [ Except as provided by Section 161.00735, a ] person's

immunization history or data received by the department under this

section may be released only on consent of the person or to any

health care provider licensed or otherwise authorized to administer

vaccines.

SECTION 5. Section 161.0071(a), Health and Safety Code, is

amended to read as follows:

(a) The first time the department receives registry data for

an individual for whom the department has received consent to be

included in the registry, the department shall send notice to the

individual or the individual's legally authorized representative

disclosing:

(1) that providers and payors may be sending the

individual's immunization information to the department;

(2) the information that is included in the registry;

(3) the persons to whom the information may be

released under Section [ Sections 161.00735(b) and ] 161.008(d);

(4) the purpose and use of the registry;

(5) the procedure to exclude an individual from the

registry; and

(6) the procedure to report a violation if an

individual's information is included in the registry after

exclusion has been requested or consent has been withdrawn.

SECTION 6. Section 161.0073(a), Health and Safety Code, is

amended to read as follows:

(a) Except as provided by Section [ Sections ] 161.00705 [ and

161.00735 ], information that individually identifies an individual

that is received by the department for the immunization registry is

confidential and may be used by the department for registry

purposes only.

SECTION 7. The heading to Section 161.00735, Health and

Safety Code, is amended to read as follows:

Sec. 161.00735. [ RELEASE AND ] RECEIPT OF REGISTRY DATA IN

DISASTER.

SECTION 8. Section 161.00735(h), Health and Safety Code, is

amended to read as follows:

(h) The executive commissioner shall make every effort to

enter into a memorandum of agreement with each state from [ to ] which

residents of that [ this ] state are likely to evacuate to this state

in a disaster on[ :

[ (1) the release and use of registry information under

this section to the appropriate health authority or local health

authority of that state, including the length of time the

information may be retained by that state; and

[ (2) ] the receipt and use of information submitted by

the health authority or local health authority of that state for

inclusion in the registry under this section.

SECTION 9. Section 161.0075, Health and Safety Code, is

amended to read as follows:

Sec. 161.0075. IMMUNITY FROM LIABILITY. Except as provided

by Sections [ Section ] 161.009 and 161.0093 , the following persons

subject to this subchapter that act in compliance with Sections

161.007, 161.00705, 161.00706, 161.0071, 161.0073, 161.0074, and

161.008 are not civilly or criminally liable for furnishing the

information required under this subchapter:

(1) a payor;

(2) a health care provider who administers

immunizations; and

(3) an employee of the department.

SECTION 10. Section 161.008(d), Health and Safety Code, is

amended to read as follows:

(d) The department may release the data constituting an

immunization record for the individual to:

(1) a health care provider treating the individual or

an organization of which the individual is a member [ any entity that

is described by Subsection (c) ]; or

(2) [ a school or child care facility in which the

individual is enrolled;

[ (3) a state agency having legal custody of the

individual; or

[ (4) ] an employer of a first responder or a first

responder in accordance with Section 161.00708.

SECTION 11. Section 161.00735(b), Health and Safety Code,

is repealed.

SECTION 12. The changes in law made by this Act apply only

to the release or disclosure of information on or after the

effective date of this Act. The release or disclosure of

information before the effective date of this Act is governed by the

law in effect when the release or disclosure was made, and the

former law is continued in effect for that purpose.

SECTION 13. This Act takes effect September 1, 2025.