Oregon ALERT Immunization Registry
Administrative Rules

IMMUNIZATION REGISTRY

333-049-0010
Definitions

1. All definitions of ORS 433.090 et seq. and ORS 433.235 apply to these rules.
   
   
2. In addition to the definitions of ORS 433.090 et.seq. and ORS 433.235, the following definitions apply:
   
   
   1. "Authorized user" means any person or entity authorized to provide or receive information from an immunization registry and tracking and recall system under ORS 433.090 to 433.102, including providers, parents and guardians, schools and children's facilities, and local health departments the Health Services and their agents.
      
      
   2. "Client" means, in addition to the meaning under ORS 433.090(2), any person registered with or enrolled in any immunization registry or immunization tracking and recall system in Oregon or any other state.
      
      
   3. "Director" means the Assistant Director of the Health Services or his/her designee.
      
      
   4. "Exempt" means the special status of information on certain clients that will limit its disclosure.
      
      
   5. "Registry" means, in addition to the meaning under ORS 433.090(4), any immunization registry or immunization tracking and recall system.

Stat. Auth.: ORS 433.100


Stats. Implemented: ORS 433.100

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0100

333-049-0020
Purpose and Intent

1. The purpose of these rules is to implement ORS 433.090 et.seq., which:
   
   
   1. Authorizes the Health Services to develop a registry for all children and young adults born or living in Oregon; and
      
      
   2. Requires the Health Services to adopt rules to develop and implement the registry, including a process by which a parent or guardian can control the transfer of information from the immunization record when such control is necessary to protect the health or safety of the family.
      
      
2. In order to increase appropriate immunizations among preschool age children, it is the intent that, as soon as practical, all children born in the state will be automatically enrolled in the registry using information derived from birth certificates, and that all children from birth through 35 months of age, who are not enrolled from birth certificates, will receive priority for enrollment in the registry.

Stat. Auth.: ORS 433.100


Stats. Implemented: ORS 433.092

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97, f. & cert. ef. 7-12-01; OHS 13-2001, Renumbered from 333-019-0105

333-049-0030
Enrollment

1. All children born in the state shall be enrolled in the registry.
   
   
2. All children who live with a parent or guardian in the state for any period of time, and who receive an immunization, may be enrolled in the registry.
   
   
3. Any person who receives an immunization in the state may be enrolled in the registry.
   
   
4. The enrollment of clients in the registry shall be in a manner and on such forms as prescribed by the Director.
   
   
5. Nothing in these rules require the consent of a parent or guardian prior to enrolling a child in the registry.
   
   
6. For the purposes of enrolling children in the registry, the Director may identify children born in the state from any birth record or abstract.

Stat. Auth.: ORS 433.094, ORS 433.100 & ORS 432.119


Stats. Implemented: ORS 433.094 & ORS 433.100

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0110

333-049-0040
Collection and Release of Information

1. The Director may collect information for a client's immunization record from any authorized user. Such information to be collected shall be determined by the Director and provided to the registry on forms provided by the Director.
   
   
2. The Director may collect information for a client's tracking and recall record from any authorized user. Information to be collected includes such information necessary to send reminder cards to, place telephone calls to, or personally contact the client or the parent or the guardian of a client. Such information shall be determined by the Director and provided to the tracking and recall system on forms provided by the Director.
   
   
3. The Director may receive information from other registries and may share information with other such registries, provided however that the Director makes a determination that other registries have confidentiality protection at least equivalent to those under ORS 433.090 to 433.102 and these rules. The Director shall prescribe the information that may be shared and the forms for sharing information to and from other registries.
   
   
4. The Director may request information to determine the name of any person under 18 years of age and information on contacting such person's parent or guardian in order to notify the parent or guardian about the existence of the registry. The Director may seek information on persons in the state who have not enrolled in the registry through contacting other state agencies, and other appropriate organizations that have access to such information.
   
   
5. The Director may release and publish information in the registry in an aggregate form that does not identify a client.

Stat. Auth.: ORS 433.096, ORS 433.094 & ORS 432.119


Stats. Implemented: ORS 433.096 & ORS 433.094

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0115

333-049-0050
Reporting to the Immunization Registry

1. Any provider who participates in the registry and who administers childhood or adolescent immunizations identified by the Director shall report such immunization to the registry within fourteen (14) calendar days of such immunization.
   
   
2. Reports shall be submitted to the registry in a manner and on such forms as required by the Director. Such forms shall be provided by the Director.
   
   
3. Any authorized user may report immunizations, and other such information, permitted under ORS 433.090(3) and (5), as prescribed by the Director, to the registry without the consent of the client or the parent or guardian of the client. Reporting this information without the consent mentioned above shall not subject a person to liability or civil action.

Stat. Auth.: ORS 433.096


Stats. Implemented: ORS 433.096

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0120

333-049-0060
Access to Immunization Records

1. Parents and guardians:
   
   
   1. Parents or guardians may request a copy of their child's immunization record by submitting a request for the record, asprescribed by the Director.
      
      
   2. The Director may provide a maximum of four (4) copies of any client's immunization record without charge, within one calendar year, pursuant to the request from a parent or guardian. Additional copies of the immunization record may be provided based on a fee established by the Director that is reasonably calculated to reimburse the registry for the actual cost in making such records available.
   
   
2. Other authorized users: All other authorized users shall access such records in a manner prescribed by the Director.

Stat. Auth.: ORS 433.094 & ORS 433.096


Stats. Implemented: ORS 433.094 & ORS 433.096

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0125


333-049-0065
Fees
For the purpose of implementing ORS Chapter 433.090 through 433.104 fees may be charged in accordance with this rule:

1. Fees may be charged to authorized users including, but not limited to, the following: health plans, health provider associations, private or non-profit institutions, other state registries, federal health agencies or their contractors.
2. Fees shall not be charged to the following users: individual health care providers and clinics, Oregon schools, Oregon children's facilities, Oregon hospitals or OMAP.
3. Fees may be waived at the discretion of the ALERT Director or the DHS Immunization Program Manager.
4. Unless waived, or exempt under subsection (2) of this rule, a fee of $10 per client shall be charged to each authorized user for each client specific immunization data request.
5. A request for client specific data shall be responded to only when made by an authorized user for information about a client under its care. Requests from persons other than authorized users or from authorized users for data beyond that of a specific patient(s) under its care will be considered on a case by case basis in the interests of public health practice and may be responded to only with aggregate/de-identified data.
   

1. No authorized user shall access information on a client who is not presently under their care, or enrolled in their school, children's facility, or health plan, except as otherwise provided by law.
   
   
2. The Director may monitor and audit all access to a client's record contained in the registry.
   
   
3. The Director may require any person who has accessed a client's record to provide evidence that such client was under the care of the person or enrolled in the person's school, children's facility, or health plan at the time the client's record was accessed.
   
   
4. The Health Services may report violations of these rules by any authorized user who has accessed a client's record to the appropriate licensing or regulatory authority.

Stat. Auth.: ORS 433.098


Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0130

333-049-0080
Limitations on the Transfer of Information from the Immunization Registry

1. Any parent or guardian may request a limitation on the transfer of information pertaining to a client enrolled in a registry if necessary to protect the health or safety of the family.
   
   
2. Health. A parent or guardian may request a limitation on the transfer of information pertaining to a child enrolled in a registry when such child has a disease or condition that precludes administration of some or all immunizations. No information on such clients will be disclosed in response to inquiries to the registry.
   
   
3. Safety. A parent or guardian may request a limitation on the transfer of information pertaining to a client enrolled in a registry when a third party could use the information in the record to locate the client, or other family members who reside with the client, and who the parent or guardian reasonably believes presents a risk of harm to the client or other family members.

Process.

1. Health.
   
   
   1. Any parent or guardian of a client who has a disease or condition that may preclude administration of some or all immunizations may request a limitation on the child's information that may be transferred from the registry by providing a written request to the Director.
      
      
   2. Upon verification of the information in the request, the Director shall cause the registry to place the client's record in the exempt category and to limit transfer of the information on the client. The Director shall also notify the parent or guardian of such action.
   
   
   
2. Safety.
   
   
   1. Any parent or guardian of a client may request a limitation on the transfer of client's information by providing a written request to the Director when the parent or guardian reasonably believes there is a risk of harm to the client, or other family members, where such person could be located through information from the registry, and the client or other family members may be harmed if located.
      
      
   2. The request for limitation must also include a statement and evidence that supports the request. Such evidence may include any evidence accepted under ORS 192.445(2)(b)(A)-(E).(See note.)
      
      
   3. Upon receipt of acceptable evidence to support the request, the Director shall cause the registry to place the client's record in the exempt category and to limit transfer of the information on the client. The Director shall also notify the parent or guardian of such action.
   
   
   
3. Upon receipt of any request under this section, the Director may cause the registry to place the client's record in the exempt category for a period of 30 days until the request can be approved.
   
   
4. After approval of a request under this section, such request will remain in effect until the Director receives a written request from the parent or guardian to remove the client from the exempt category.

NOTE: Evidence under ORS 192.445(2)(b) includes evidence that the client or a family member residing with the client has:

1. Been a victim of domestic violence;
   
   
2. Obtained an order issued under ORS 133.055;
   
   
3. Contacted a law enforcement officer involving domestic violence or other physical abuse;
   
   
4. Obtained a temporary restraining order or other no contact order to protect the individual from future physical abuse; or
   
   
5. Filed other criminal or civil legal proceedings regarding physical protection.

Stat. Auth.: ORS 433.100


Stats. Implemented: ORS 433.100

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0135

333-049-0090
Notification of Parents and Guardians

1. The Director may provide written notice to parents and guardians of clients when the tracking and recall system indicates that a client has missed a scheduled immunization. Notification shall be in such form as prescribed by the Director.
   
   
2. The Director may personally contact the parent or guardian of a client after the parent or guardian has been sent two notifications that the client has missed an immunization and the registry has not received information that the client has been immunized within two weeks after the second notification was sent.

Stat. Auth.: ORS 433.096


Stats. Implemented: ORS 433.096

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0140

333-049-0100
Confidentiality

1. Personal identifying information from the registry shall only be disclosed to authorized users.
   
   
2. An authorized user shall not disclose information from the registry except to another authorized user.
   
   
3. Any request for the limitations on the transfer of information from the immunization record or the immunization tracking and recall record shall be confidential.
   
   
4. All providers with access to the registry shall provide to the Director an agreement signed by such providers or their authorized agent. The agreement shall be in a form prescribed by the Director, and may include provisions to maintain the confidentiality of the information in the registry, and to only access information on clients under the care of such persons.

Stat. Auth.: ORS 433.098


Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0145

333-049-0110
Consent

1. Whenever a client attains 18 years of age, no information in the registry shall be released without the consent of the client, unless the requester shows a public health need for the information, and submits a written request for the information to the Director.
   
   
2. Upon the receipt of a request for information under this section, the Director shall determine whether there is a public health need for the information. Such a determination shall be based on whether the release of the information to the requestor is necessary to protect the public's health from a vaccine-preventable disease.

Stat. Auth.: ORS 433.098


Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0150

333-049-0120
Deletion of Information in the Registry and Tracking and Recall System

Upon the written request to the Director from any client at least 18 years of age, the Director shall delete that client's immunization record and tracking and recall record from the registry.


Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098


Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0155

333-049-0130
Security

1. All authorized users shall abide by such security policies and procedures to safeguard information in the registry deemed necessary by the Director. Such policies and procedures may include, but are not limited to, confidentiality agreements, the use of computer passwords, and user identification numbers. The Director shall provide copies of the policies and procedures to all authorized users who participate in either or both the immunization registry or tracking and recall system.
   
   
2. The Director shall develop security standards to safeguard the information in the registry. The standards will address, but not be limited to, the collection, transfer, storage, and processing of information in the registry and tracking and recall system.
   
   
3. The Director shall review the security policies, procedures, and standards at least once each year and shall revise suchpolicies, procedures, and standards as necessary.

Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHS 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0160