Section 641.7.11. Statewide registry.

         7.11(1) Statewide registry. The department shall maintain a statewide immunization and health screening registry. Enrolled users are responsible for purchasing and maintaining all computer hardware related to use of the registry and for providing an Internet connection to transfer information between the user’s computer and the registry.

         7.11(2) Purpose and permitted uses of registry.

            a.                The registry shall contain immunization and health screening information, including identifying and demographic data, to allow enrolled users to maintain and access a database of immunization and health screening histories for purposes of ensuring that patients are fully immunized and screened.

            b.                The registry may be used to track inventory or utilization of pharmaceutical agents identified by the department to prepare for or respond to an emergency event.

            c.                Enrolled users shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purpose other than those expressly provided in this rule.

            d.                The registry shall contain health screening data, including screening results and follow-up information.

         7.11(3) Release of information to the registry. Enrolled users shall provide immunization and health screening information, including identifying and demographic data, to the registry. Information provided may include, but is not limited to, the following:

            a.                Name of patient;

            b.                Gender of patient;

            c.                Date of birth;

            d.                Race;

            e.                Ethnicity;

            f.                 Birth state and birth country;

            g.                Address;

            h.                Parents’ names;

            i.                 Mother’s maiden name;

            j.                 Type of vaccination administered;

            k.                Dose or series number of vaccine;

            l.                 Date vaccination was administered;

            m.               Lot number;

            n.                Date of health screening;

            o.                Health screening results;

            p.                Source of health screening;

            q.                Health screening follow-up information;

            r.                 Patient comments;

            s.                 Provider name, license, and business address; and

            t.                 Patient history, including previously unreported doses.

         7.11(4) Confidentiality of registry information. Immunization and health screening information, including identifying and demographic data maintained on the registry, is confidential and may not be disclosed except under the following limited circumstances:

            a.                The department may release information from the registry to the following:

             (1)              The person or the parent or legal guardian of the person immunized or screened.

             (2)              Enrolled users of the registry who have completed an enrollment form that specifies the conditions under which the registry can be accessed and who have been issued an organization code and user name by the department;

             (3)              Persons or entities requesting immunization or health screening data in an aggregate form that does not identify an individual either directly or indirectly.

             (4)              Agencies that complete an agreement with the department which specifies conditions for access to registry data and how that data will be used. Agencies shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purposes other than those expressly provided in this rule.

             (5)              A representative of a state or federal agency, or entity bound by that state or federal agency, to the extent that the information is necessary to perform a legally authorized function of that agency or the department. The state or federal agency is subject to confidentiality regulations that are the same as or more stringent than those in the state of Iowa. State or federal agencies shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purposes other than those expressly provided in this rule.

             (6)              The admitting official of a licensed child care center, elementary school, secondary school, or postsecondary school; or medical or health care providers providing continuity of care.

             (7)              Enrolled users from other states or jurisdictions who have signed and completed enrollment in the state’s or jurisdiction’s immunization registry.

            b.                Enrolled users shall not release data obtained from the registry except to the person or the parent or legal guardian of the person immunized or screened, admitting officials of licensed child care centers and schools, medical or health care providers providing continuity of care, and other enrolled users of the registry.

         7.11(5) Suspend or terminate access. The department may suspend or terminate an enrolled user’s access consistent with department policy if the user violates this chapter, the IRIS Authorized Site Agreement-Organization, the IRIS Authorized Individual User Agreement, or the IRIS Security and Confidentiality Policy. The department shall approve, suspend, terminate, and reinstate user access in accordance with this chapter and department policy.

[ ARC 8377B , IAB 12/16/09, effective 11/18/09;    ARC 8658B , IAB 4/7/10, effective 5/12/10;    ARC 0481C , IAB 12/12/12, effective 1/16/13;    ARC 1477C , IAB 6/11/14, effective 7/16/14;    ARC 2836C , IAB 12/7/16, effective 1/11/17]