Howard Bill Flips Shot Registry To Opt-Out, Adds Research Use

The text as introduced · 3,271 words

89R337 SRA-F

By: Howard
H.B. No. 772

A BILL TO BE ENTITLED

AN ACT

relating to the immunization data included in and excluded from the

immunization registry.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 161.007, Health and Safety Code, is

amended by amending Subsections (a), (a-2), (b), (b-1), (c), (d),

and (e) and adding Subsections (e-1), (l), and (m) to read as

follows:

(a) The department, for the primary purpose of establishing

and maintaining a single repository of accurate, complete, and

current immunization records to be used in aiding, coordinating,

and promoting efficient and cost-effective communicable disease

prevention and control efforts, shall establish and maintain an

immunization registry. The executive commissioner by rule shall

develop guidelines to:

(1) protect the confidentiality of patients in

accordance with Section 159.002, Occupations Code;

(2) inform the individual or the individual's legally

authorized representative about the registry and that registry

information may be released under Section 161.00735;

(3) [ require the written or electronic consent of the

individual or the individual's legally authorized representative

before any information relating to the individual is included in

the registry;

[ (4) ] permit the individual or the individual's

legally authorized representative to request exclusion of the

individual's information from [ withdraw consent for the individual

to be included in ] the registry ;

(4) provide opportunities for the individual or the

individual's legally authorized representative to request

exclusion from the registry at any time, including:

(A) at the time of the individual's birth if

attended by a health care provider who administers immunizations;

(B) each time a health care provider in this

state administers any immunization to the individual;

(C) through electronic submission of a request

for exclusion using a procedure available on the department's

Internet website;

(D) through submission to the department of a

written request for exclusion; and

(E) following a natural or man-made disaster ;

[ and ]

(5) ensure the individual or the individual's legally

authorized representative is not required to request exclusion from

the registry more than one time and, following the department's

receipt of the request for exclusion, the individual's immunization

information is not included in the registry unless the individual

or the individual's legally authorized representative subsequently

submits to the department a written request for inclusion in the

registry; and

(6) include on each immunization record the registry

generates the procedure for requesting exclusion from the registry

[ determine the process by which consent is verified, including

affirmation by a health care provider, birth registrar, regional

health information exchange, or local immunization registry that

consent has been obtained ].

(a-2) [ The written or electronic consent required by

Subsection (a)(3) for an individual who is 18 years of age or older

is required to be obtained only one time and must be received from

the individual before the information may be released. ] An

individual's legally authorized representative or the individual,

after the individual has attained 18 years of age, may submit a

request [ consent ] in writing or electronically for exclusion of the

individual's information from [ to remain in ] the registry. [ The

consent of the representative or individual is valid until the

individual or the individual's legally authorized representative

withdraws consent in writing or electronically. The department may

not include in the registry the immunization information of an

individual who is 26 years of age or older until written or

electronic consent has been obtained as provided by this

subsection. ] The department shall coordinate with the Texas

Education Agency to distribute materials described in Section

161.0095(a)(2) to students and parents through local school

districts.

(b) Except as provided by Section 161.0071, the

immunization registry must contain information on the immunization

history that is obtained by the department under:

(1) this section of each individual for whom

immunization information [ consent ] has been obtained , unless the

individual or the individual's legally authorized representative

requested exclusion of the individual's information from the

registry in accordance with guidelines adopted under Subsection

(a);

(2) Section 161.00705 of individuals [ persons ]

immunized to prepare for or in response to a declared disaster,

public health emergency, terrorist attack, hostile military or

paramilitary action, or extraordinary law enforcement emergency;

(3) Section 161.00706 of first responders or their

immediate family members; and

(4) Section 161.00735 of individuals [ persons ]

evacuated or relocated to this state because of a disaster.

(b-1) The department shall exclude [ remove ] from the

registry information for any individual for whom [ consent has been

withdrawn. The department may not retain individually identifiable

information about any individual:

[ (1) for whom consent has been withdrawn;

[ (2) for whom a consent for continued inclusion in the

registry following the end of the declared disaster, public health

emergency, terrorist attack, hostile military or paramilitary

action, or extraordinary law enforcement emergency has not been

received under Section 161.00705(f);

[ (3) for whom a request to be removed from the registry

has been received under Section 161.00706(e);

[ (4) for whom consent for continued inclusion in the

registry following the end of a disaster has not been received under

Section 161.00735(f); or

[ (5) for whom ] a request to exclude [ remove ]

information from the registry has been received under this

subchapter [ Section 161.00735(g) ].

(c) A payor that receives data elements from a health care

provider who administers an immunization to an individual younger

than 18 years of age shall provide the data elements to the

department. A payor is required to provide the department with only

the data elements the payor receives from a health care provider. A

payor that receives data elements from a health care provider who

administers an immunization to an individual 18 years of age or

older may provide the data elements to the department. The data

elements shall be submitted in a format prescribed by the

department. [ The department shall verify consent before including

the reported information in the immunization registry. The

department may not retain individually identifiable information

about an individual for whom consent cannot be verified. ]

(d) A health care provider who administers an immunization

to an individual younger than 18 years of age shall provide data

elements regarding an immunization to the department. A health

care provider who administers an immunization to an individual 18

years of age or older may submit data elements regarding an

immunization to the department. At the request and with the

authorization of the health care provider, the data elements may be

submitted through a health information exchange as defined by

Section 182.151. The data elements shall be submitted in a format

prescribed by the department. A health care provider who

administers an immunization to any individual and provides data

elements to the department shall notify the individual or the

individual's legally authorized representative of:

(1) the inclusion in the registry of the individual's

immunization information unless exclusion from the registry is

requested in accordance with the guidelines adopted under

Subsection (a); and

(2) the procedure for requesting exclusion from the

registry [ The department shall verify consent before including the

information in the immunization registry. The department may not

retain individually identifiable information about an individual

for whom consent cannot be verified ].

(e) The department shall :

(1) post on the department's Internet website a

printable form that:

(A) states an individual's immunization

information will be included in the registry unless exclusion from

the registry is requested; and

(B) details the procedure for submitting an

electronic or written request for exclusion from the registry

[ provide notice to a health care provider that submits an

immunization history for an individual for whom consent cannot be

verified. The notice shall contain instructions for obtaining

consent ] in accordance with guidelines adopted under Subsection

(a) ; and

(2) make the form described by Subdivision (1)

available for distribution to health care providers [ and

resubmitting the immunization history to the department ].

(e-1) A health care provider may use the printable form

described by Subsection (e) to provide the notification required

under Subsection (d).

(l) Registry information may not be used to exclude any

individual from the receipt of any service during a natural or

man-made disaster unless the service is withheld because of a

medical contraindication.

(m) The department may not sell registry information to any

public or private entity.

SECTION 2. Section 161.00705(f), Health and Safety Code, is

amended to read as follows:

(f) Unless an individual or the individual's legally

authorized representative [ consents ] in writing or electronically

requests exclusion [ to continued inclusion ] of the individual's

information from [ in ] the registry, the department shall include

[ remove ] the immunization records collected under this section in

[ from ] the registry [ on expiration of the period prescribed under

Subsection (e) ].

SECTION 3. Sections 161.00706(e) and (f), Health and Safety

Code, are amended to read as follows:

(e) A person whose immunization records are included in the

immunization registry as authorized by this section may request in

writing or electronically that the department exclude [ remove ] that

information from the registry. Not later than the 10th day after

receiving a request under this subsection, the department shall

exclude [ remove ] the person's immunization records from the

registry.

(f) The report required under Section 161.0074 must also

include the number of complaints received by the department related

to the department's failure to comply with requests for exclusion

[ removal ] of information from the registry under Subsection (e).

SECTION 4. Sections 161.0071(a) and (b), Health and Safety

Code, are amended to read as follows:

(a) The first time the department receives registry data for

an individual [ for whom the department has received consent ] to be

included in the registry, the department shall send notice to the

individual or the individual's legally authorized representative

disclosing:

(1) that providers and payors may be sending the

individual's immunization information to the department;

(2) the information that is included in the registry;

(3) the persons to whom the information may be

released under Sections 161.00735(b) and 161.008(d);

(4) the purpose and use of the registry;

(5) the procedure to request exclusion of an

individual's information [ exclude an individual ] from the

registry; and

(6) the procedure to report a violation if an

individual's information is included in the registry after

exclusion has been requested [ or consent has been withdrawn ].

(b) The [ On discovering that consent to be included in the

registry has not been granted or has been withdrawn, the ]

department shall exclude [ the individual's immunization records ]

from the registry and any other registry-related department record

that individually identifies the individual the immunization

record of any individual from whom the department receives a

request for exclusion .

SECTION 5. Section 161.0073, Health and Safety Code, is

amended by amending Subsection (a) and adding Subsections (e), (f),

(g), and (h) to read as follows:

(a) Except as provided by this section and Sections 161.007,

161.00705 , 161.00706, [ and ] 161.00735, and 161.008, information

that individually identifies an individual that is received by the

department for the immunization registry is confidential and may be

used by the department for registry purposes only.

(e) The department may use registry information for

internal public health research on approval of the department's

institutional review board.

(f) The department may release registry information for

external public health research if:

(1) the individual or the individual's legally

authorized representative submits to the department a written

authorization for release of the individual's registry data;

(2) the department does not disclose individually

identifiable information; or

(3) subject to Subsection (g), the department's

institutional review board approves the release of individually

identifiable information.

(g) The department's institutional review board may not

approve the release of individually identifiable information for a

research proposal unless the proposal includes a provision

requiring the proposal's researchers to obtain informed consent

from each individual or the individual's legally authorized

representative before the department releases the individual's

registry data to the researchers.

(h) The executive commissioner shall adopt rules to ensure

the use or release of registry information under this subchapter

complies with all state and federal laws relating to the privacy,

protection, confidentiality, and transmission of health

information, including the Health Insurance Portability and

Accountability Act of 1996 (Pub. L. No. 104-191) and rules adopted

under that Act.

SECTION 6. Sections 161.00735(c), (g), and (h), Health and

Safety Code, are amended to read as follows:

(c) The department may receive immunization information

from a health authority of another state or from a local health

authority in another state if the department determines that

residents of that state have evacuated or relocated to this state in

response to a disaster. The department shall include information

received under this subsection in the registry. [ Notwithstanding

Section 161.007, the department is not required to obtain written

consent for the inclusion in the registry of information received

under this subsection. ]

(g) If an individual or, if a child, the child's parent,

managing conservator, or guardian requests in writing that the

individual's or child's information obtained under Subsection (c)

be excluded [ removed ] from the registry, the department shall

exclude [ remove ] that information from the registry.

(h) The executive commissioner shall make every effort to

enter into a memorandum of agreement with each state to which

residents of this state are likely to evacuate in a disaster on:

(1) the release to and use by [ of registry information

under this section to ] the appropriate health authority or local

health authority of that state of registry information under this

section [ , including the length of time the information may be

retained by that state ]; and

(2) the receipt and use of information submitted by

the health authority or local health authority of that state for

inclusion in the registry under this section.

SECTION 7. Sections 161.008(c) and (e), Health and Safety

Code, are amended to read as follows:

(c) The department may obtain the data constituting an

immunization record for an individual from a public health

district, a local health department, the individual or the

individual's legally authorized representative, a physician to the

individual, a payor, or any health care provider licensed or

otherwise authorized to administer vaccines. [ The department shall

verify consent before including the reported information in the

immunization registry. The department may not retain individually

identifiable information about an individual for whom consent

cannot be verified. ]

(e) An individual or the individual's legally authorized

representative may obtain and on request to the department shall be

provided with all individually identifiable immunization registry

information concerning the individual and information on the

procedure for requesting exclusion from the registry .

SECTION 8. Section 161.009(a), Health and Safety Code, is

amended to read as follows:

(a) A person commits an offense if the person:

(1) negligently releases or discloses immunization

registry information in violation of Section 161.007, 161.0071,

161.0073, or 161.008;

(2) fails to exclude an individual's immunization

information in violation of Section 161.0071;

(3) fails to exclude an individual's [ remove a

person's ] immunization information in violation of Section

161.00705, 161.00706, or 161.00735; or

(4) negligently uses information in the immunization

registry to solicit new patients or clients or for other purposes

that are not associated with immunization or quality-of-care

purposes, unless authorized under this section.

SECTION 9. Section 161.0095(a), Health and Safety Code, is

amended to read as follows:

(a) The department shall develop:

(1) continuing education programs for health care

providers relating to immunizations and the vaccines for children

program operated by the department under authority of 42 U.S.C.

Section 1396s; and

(2) educational information, for health care

providers, health care clinics, hospitals, and any other health

care facility that provides health care to children 14 to 18 years

of age, relating to the immunization registry and the option for an

individual or the individual's legally authorized representative

to request exclusion [ who is 18 years of age or older to consent to

submission and retention ] of the individual's information from [ in ]

the immunization registry.

SECTION 10. Section 161.0107(c), Health and Safety Code, is

amended to read as follows:

(c) The executive commissioner by rule shall specify:

(1) the fields necessary to populate the immunization

registry[ , including a field that indicates the patient's consent

to be listed in the immunization registry has been obtained ]; and

(2) the data standards that must be used for

electronic submission of immunization information.

SECTION 11. The following provisions of the Health and

Safety Code are repealed:

(1) Sections 161.007(a-1), (a-3), (a-4), (a-5), and

(a-6);

(2) Sections 161.00705(e) and (h); and

(3) Sections 161.00735(e) and (f).

SECTION 12. (a) The changes in law made by this Act to

Subchapter A, Chapter 161, Health and Safety Code, apply to

immunization information received by the Department of State Health

Services before, on, or after January 1, 2027. An individual whose

immunization information was included immediately before January

1, 2027, in the immunization registry established under Subchapter

A, Chapter 161, Health and Safety Code, is subject to the changes in

law made by this Act to that subchapter, including the procedures

established by that subchapter as amended by this Act.

(b) The changes in law made by this Act do not authorize the

Department of State Health Services to include in the immunization

registry established under Subchapter A, Chapter 161, Health and

Safety Code, immunization information of an individual who is 18

years of age or older and whose immunization information was not

included in the registry on or before January 1, 2027, unless the

department receives immunization data from a health care provider

who:

(1) administers an immunization to the individual

after that date and elects to provide the individual's immunization

information to the department; and

(2) notifies the individual before submission of the

information to the department:

(A) that the health care provider is providing

the information to the department for inclusion in the registry;

(B) that the information will remain in the

registry until exclusion is requested by the individual or the

individual's legally authorized representative; and

(C) of the procedures for requesting exclusion

from the registry under Subchapter A, Chapter 161, Health and

Safety Code, as amended by this Act.

(c) The changes in law made by this Act apply only to an

offense committed on or after the effective date of this Act. An

offense committed before the effective date of this Act is governed

by the law in effect on the date the offense was committed, and the

former law is continued in effect for that purpose. For purposes of

this subsection, an offense was committed before the effective date

of this Act if any element of the offense occurred before that date.

SECTION 13. (a) As soon as practicable after the effective

date of this section, the Department of State Health Services shall

conduct a public awareness campaign to educate health care

providers, parents, payors, schools, and the public about the

changes in law made by this Act.

(b) As soon as practicable after the effective date of this

section, the executive commissioner of the Health and Human

Services Commission shall adopt the rules required by Section

161.0073(h), Health and Safety Code, as added by this Act.

SECTION 14. (a) Except as provided by Subsection (b) of this

section, this Act takes effect January 1, 2027.

(b) Section 13 of this Act takes effect September 1, 2025.