641—7.11 (22) Iowa’s immunization registry.
	 7.11(1) The department shall maintain a statewide immunization registry. Enrolled users are responsible for purchasing and maintaining all computer hardware related to use of the registry and for providing an Internet connection to transfer information between the user’s computer and the registry.
	 7.11(2) Purpose and permitted uses of registry.
	  a.   	 The registry shall consist of immunization information, including identifying and demographic data, to allow enrolled users to maintain and access a database of immunization histories for purposes of ensuring that patients are fully immunized.
	  b.   	 The registry may be used to track inventory or utilization of pharmaceutical agents identified by the department to prepare for or respond to an emergency event.
	  c.   	 Enrolled users shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purpose other than those expressly provided in this rule.
	 7.11(3) Release of information to the registry. Enrolled users shall provide immunization information including identifying and demographic data to the registry. Information provided may include, but is not limited to, the following:
	  a.   	 Name of patient;
	  b.   	 Gender of patient;
	  c.   	 Date of birth;
	  d.   	 Race;
	  e.   	 Ethnicity;
	  f.   	 Birth state and birth country;
	  g.   	 Address;
	  h.   	 Parents’ names;
	  i.   	 Mother’s maiden name;
	  j.   	 Type of vaccination administered;
	  k.   	 Dose or series number of vaccine;
	  l.   	 Date vaccination was administered;
	  m.   	 Lot number;
	  n.   	 Contraindications, precautions;
	  o.   	 Provider name, license, and business address; and
	  p.   	 Patient history, including previously unreported doses.
	 7.11(4) Confidentiality of registry information. Immunization information, including identifying and demographic data maintained on the registry, is confidential and may not be disclosed except under the following limited circumstances:
	  a.   	 The department may release information from the registry to the following:
	 (1) 	 The person immunized or the parent or legal guardian of the person immunized;
	 (2) 	 Enrolled users of the registry who have completed an enrollment form that specifies the conditions under which the registry can be accessed and who have been issued an identification code and password by the department;
	 (3) 	 Persons or entities requesting immunization data in an aggregate form that does not identify an individual either directly or indirectly.
	 (4) 	 Agencies that complete an agreement with the department which specifies conditions for access to registry data and how that data will be used. Agencies shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purposes other than those expressly provided in this rule.
	 (5) 	 A representative of a state or federal agency, or entity bound by that state or federal agency, to the extent that the information is necessary to perform a legally authorized function of that agency or the department. The state or federal agency is subject to confidentiality regulations that are the same as or more stringent than those in the state of Iowa. State or federal agencies shall not use information obtained from the registry to market services to patients or nonpatients, to assist in bill collection services, or to locate or identify patients or nonpatients for any purposes other than those expressly provided in this rule.
	 (6) 	 The admitting official of a licensed child care center, elementary school, or secondary school; or medical or health care providers providing continuity of care.
	  b.   	 Enrolled users shall not release immunization data obtained from the registry except to the person immunized, the parent or legal guardian of the person immunized, admitting officials of licensed child care centers and schools, medical or health care providers providing continuity of care, and other enrolled users of the registry.
[ARC 8377B, IAB 12/16/09, effective 11/18/09; ARC 8658B, IAB 4/7/10, effective 5/12/10]