85R673 LED-F
	By: Howard	H.B. No. 243

	A BILL TO BE ENTITLED
	AN ACT
	relating to the immunization data included in and excluded from the
	immunization registry.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1.  Section 161.007, Health and Safety Code, is
	amended by amending Subsections (a), (a-2), (b), (b-1), (c), (d),
	and (e) and adding Subsections (e-1), (l), and (m) to read as
	follows:
	(a)  The department, for the primary purpose of establishing
	and maintaining a single repository of accurate, complete, and
	current immunization records to be used in aiding, coordinating,
	and promoting efficient and cost-effective communicable disease
	prevention and control efforts, shall establish and maintain an
	immunization registry.  The executive commissioner by rule shall
	develop guidelines to:
	(1)  protect the confidentiality of patients in
	accordance with Section 159.002, Occupations Code;
	(2)  inform the individual or the individual's legally
	authorized representative about the registry and that registry
	information may be released under Section 161.00735;
	(3)  [require the written or electronic consent of the
	individual or the individual's legally authorized representative
	before any information relating to the individual is included in
	the registry;
	[(4)]  permit the individual or the individual's
	legally authorized representative to request that the individual's
	information be removed from [withdraw consent for the individual to
	be included in] the registry;
	(4)  provide opportunities for the individual or the
	individual's legally authorized representative to request removal
	at any time, including:
	(A)  at the time of the individual's birth if
	attended by a health care provider who administers immunizations;
	(B)  each time the individual receives any
	immunization administered by a health care provider in this state;
	(C)  through electronic submission of a request
	for removal using a request for removal procedure available on the
	department's Internet website;
	(D)  through submission to the department of a
	written request for removal; and
	(E)  following a natural or man-made disaster;
	[and]
	(5)  ensure that an individual or the individual's
	legally authorized representative is not required to request
	removal from the registry more than one time and that, after a
	request for removal is made, the individual's immunization
	information will not be included in the registry unless the
	individual or the individual's legally authorized representative
	submits to the department a written request for inclusion of the
	individual's information in the registry; and
	(6)  include on each immunization record generated by
	the registry the procedures for requesting removal from the
	registry [determine the process by which consent is verified,
	including affirmation by a health care provider, birth registrar,
	regional health information exchange, or local immunization
	registry that consent has been obtained].
	(a-2)  [The written or electronic consent required by
	Subsection (a)(3) for an individual who is 18 years of age or older
	is required to be obtained only one time and must be received from
	the individual before the information may be released.]  An
	individual's legally authorized representative or the individual,
	after the individual has attained 18 years of age, may submit a
	request [consent] in writing or electronically for the individual's
	information to be removed from [remain in] the registry.  [The
	consent of the representative or individual is valid until the
	individual or the individual's legally authorized representative
	withdraws consent in writing or electronically.     The department
	may not include in the registry the immunization information of an
	individual who is 26 years of age or older until written or
	electronic consent has been obtained as provided by this
	subsection.]  The department shall coordinate with the Texas
	Education Agency to distribute materials described in Section
	161.0095(a)(2) to students and parents through local school
	districts.
	(b)  Except as provided by Section 161.0071, the
	immunization registry must contain information on the immunization
	history that is obtained by the department under:
	(1)  this section of each individual for whom
	immunization information [consent] has been obtained, unless the
	individual or the individual's legally authorized representative
	has requested that the individual's information be removed from the
	registry in accordance with guidelines adopted under Subsection
	(a);
	(2)  Section 161.00705 of persons immunized to prepare
	for or in response to a declared disaster, public health emergency,
	terrorist attack, hostile military or paramilitary action, or
	extraordinary law enforcement emergency;
	(3)  Section 161.00706 of first responders or their
	immediate family members; and
	(4)  Section 161.00735 of persons evacuated or
	relocated to this state because of a disaster.
	(b-1)  The department shall remove from the registry
	information for any individual for whom [consent has been
	withdrawn.   The department may not retain individually identifiable
	information about any individual:
	[(1)  for whom consent has been withdrawn;
	[(2)     for whom a consent for continued inclusion in the
	registry following the end of the declared disaster, public health
	emergency, terrorist attack, hostile military or paramilitary
	action, or extraordinary law enforcement emergency has not been
	received under Section 161.00705(f);
	[(3)     for whom a request to be removed from the registry
	has been received under Section 161.00706(e);
	[(4)     for whom consent for continued inclusion in the
	registry following the end of a disaster has not been received under
	Section 161.00735(f); or
	[(5)  for whom] a request to remove information from
	the registry has been received under this subchapter [Section
	161.00735(g)].
	(c)  A payor that receives data elements from a health care
	provider who administers an immunization to an individual younger
	than 18 years of age shall provide the data elements to the
	department.  A payor is required to provide the department with only
	the data elements the payor receives from a health care provider.  A
	payor that receives data elements from a health care provider who
	administers an immunization to an individual 18 years of age or
	older may provide the data elements to the department.  The data
	elements shall be submitted in a format prescribed by the
	department.  [The department shall verify consent before including
	the reported information in the immunization registry.     The
	department may not retain individually identifiable information
	about an individual for whom consent cannot be verified.]
	(d)  A health care provider who administers an immunization
	to an individual younger than 18 years of age shall provide data
	elements regarding an immunization to the department.  A health
	care provider who administers an immunization to an individual 18
	years of age or older may submit data elements regarding an
	immunization to the department.  At the request and with the
	authorization of the health care provider, the data elements may be
	submitted through a health information exchange as defined by
	Section 182.151.  The data elements shall be submitted in a format
	prescribed by the department.  A health care provider who
	administers an immunization to any individual and provides data
	elements to the department shall notify the individual or the
	individual's legally authorized representative:
	(1)  that the individual's immunization information
	will be included in the registry unless removal from the registry is
	requested in accordance with the guidelines adopted under
	Subsection (a); and
	(2)  of the procedures for requesting removal from the
	registry.  [The department shall verify consent before including
	the information in the immunization registry.     The department may
	not retain individually identifiable information about an
	individual for whom consent cannot be verified.]
	(e)  The department shall:
	(1)  make available on the department's Internet
	website a printable form that states an individual's immunization
	information will be included in the registry unless removal from
	the registry is requested and that details the procedures for
	submitting an electronic or written request for removal from the
	registry [provide notice to a health care provider that submits an
	immunization history for an individual for whom consent cannot be
	verified.   The notice shall contain instructions for obtaining
	consent] in accordance with guidelines adopted under Subsection
	(a); and
	(2)  make the form described by Subdivision (1)
	available for distribution to health care providers [and
	resubmitting the immunization history to the department].
	(e-1)  A health care provider may use the printable form
	described by Subsection (e) to provide the notification required
	under Subsection (d).
	(l)  Registry information may not be used to exclude any
	individual from the receipt of any service during a natural or
	man-made disaster unless the service is withheld because of a
	medical contraindication.
	(m)  The department may not sell registry information to any
	public or private entity.
	SECTION 2.  Section 161.00705(f), Health and Safety Code, is
	amended to read as follows:
	(f)  Unless an individual or the individual's legally
	authorized representative [consents] in writing or electronically
	requests that [to continued inclusion of] the individual's
	information be removed from [in] the registry, the department shall
	include [remove] the immunization records collected under this
	section in [from] the registry [on expiration of the period
	prescribed under Subsection (e)].
	SECTION 3.  Sections 161.0071(a) and (b), Health and Safety
	Code, are amended to read as follows:
	(a)  The first time the department receives registry data for
	an individual [for whom the department has received consent] to be
	included in the registry, the department shall send notice to the
	individual or the individual's legally authorized representative
	disclosing:
	(1)  that providers and payors may be sending the
	individual's immunization information to the department;
	(2)  the information that is included in the registry;
	(3)  the persons to whom the information may be
	released under Sections 161.00735(b) and 161.008(d);
	(4)  the purpose and use of the registry;
	(5)  the procedure to exclude an individual from the
	registry; and
	(6)  the procedure to report a violation if an
	individual's information is included in the registry after
	exclusion has been requested [or consent has been withdrawn].
	(b)  The [On discovering that consent to be included in the
	registry has not been granted or has been withdrawn, the]
	department shall exclude [the individual's immunization records]
	from the registry and any other registry-related department record
	that individually identifies the individual the immunization
	record of any individual from whom a request for exclusion has been
	received by the department.
	SECTION 4.  Section 161.0073, Health and Safety Code, is
	amended by amending Subsection (a) and adding Subsections (e), (f),
	(g), and (h) to read as follows:
	(a)  Except as provided by this section and Sections 161.007,
	161.00705, 161.00706, [and] 161.00735, and 161.008, information
	that individually identifies an individual that is received by the
	department for the immunization registry is confidential and may be
	used by the department for registry purposes only.
	(e)  The department may use registry information for
	internal public health research on approval of the department's
	institutional review board.
	(f)  The department may release registry information for
	external public health research if:
	(1)  the individual or the individual's legally
	authorized representative submits a written authorization to the
	department for release of the individual's registry data;
	(2)  the department does not disclose individually
	identifiable information; or
	(3)  the department's institutional review board
	approves the release of individually identifiable information
	subject to Subsection (g).
	(g)  The department's institutional review board may not
	approve the release of individually identifiable information for a
	research proposal unless the proposal includes a provision
	requiring the proposal's researchers to obtain informed consent
	from each individual or the individual's legally authorized
	representative before the department releases the individual's
	registry data to the researchers.
	(h)  The executive commissioner shall adopt rules to ensure
	that the use or release of registry information under this
	subchapter complies with all state and federal laws relating to the
	privacy, protection, confidentiality, and transmission of health
	information, including the Health Insurance Portability and
	Accountability Act of 1996 (Pub. L. No. 104-191) and rules adopted
	under that Act.
	SECTION 5.  Sections 161.00735(c) and (h), Health and Safety
	Code, are amended to read as follows:
	(c)  The department may receive immunization information
	from a health authority of another state or from a local health
	authority in another state if the department determines that
	residents of that state have evacuated or relocated to this state in
	response to a disaster.  The department shall include information
	received under this subsection in the registry.  [Notwithstanding
	Section 161.007, the department is not required to obtain written
	consent for the inclusion in the registry of information received
	under this subsection.]
	(h)  The executive commissioner shall make every effort to
	enter into a memorandum of agreement with each state to which
	residents of this state are likely to evacuate in a disaster on:
	(1)  the release to and use by [of registry information
	under this section to] the appropriate health authority or local
	health authority of that state of registry information under this
	section[, including the length of time the information may be
	retained by that state]; and
	(2)  the receipt and use of information submitted by
	the health authority or local health authority of that state for
	inclusion in the registry under this section.
	SECTION 6.  Sections 161.008(c) and (e), Health and Safety
	Code, are amended to read as follows:
	(c)  The department may obtain the data constituting an
	immunization record for an individual from a public health
	district, a local health department, the individual or the
	individual's legally authorized representative, a physician to the
	individual, a payor, or any health care provider licensed or
	otherwise authorized to administer vaccines.  [The department shall
	verify consent before including the reported information in the
	immunization registry.   The department may not retain individually
	identifiable information about an individual for whom consent
	cannot be verified.]
	(e)  An individual or the individual's legally authorized
	representative may obtain and on request to the department shall be
	provided with all individually identifiable immunization registry
	information concerning the individual and information on the
	procedure for requesting removal from the registry.
	SECTION 7.  Section 161.0095(a), Health and Safety Code, is
	amended to read as follows:
	(a)  The department shall develop:
	(1)  continuing education programs for health care
	providers relating to immunizations and the vaccines for children
	program operated by the department under authority of 42 U.S.C.
	Section 1396s; and
	(2)  educational information, for health care
	providers, health care clinics, hospitals, and any other health
	care facility that provides health care to children 14 to 18 years
	of age, relating to the immunization registry and the option for an
	individual or the individual's legally authorized representative
	to request removal [who is 18 years of age or older to consent to
	submission and retention] of the individual's information from [in]
	the immunization registry.
	SECTION 8.  Section 161.0107(c), Health and Safety Code, is
	amended to read as follows:
	(c)  The executive commissioner by rule shall specify:
	(1)  the fields necessary to populate the immunization
	registry[, including a field that indicates the patient's consent
	to be listed in the immunization registry has been obtained]; and
	(2)  the data standards that must be used for
	electronic submission of immunization information.
	SECTION 9.  The following provisions of the Health and
	Safety Code are repealed:
	(1)  Sections 161.007(a-1), (a-3), (a-4), (a-5), and
	(a-6);
	(2)  Sections 161.00705(e) and (h); and
	(3)  Sections 161.00735(e) and (f).
	SECTION 10.  (a)  The changes in law made by this Act to
	Subchapter A, Chapter 161, Health and Safety Code, apply to
	immunization information received by the Department of State Health
	Services before, on, or after January 1, 2019. An individual whose
	immunization information was included immediately before January
	1, 2019, in the immunization registry established under Subchapter
	A, Chapter 161, Health and Safety Code, is subject to the changes in
	law made by this Act to that subchapter, including the procedures
	established by that subchapter as amended by this Act.
	(b)  The changes in law made by this Act do not authorize the
	Department of State Health Services to include in the immunization
	registry established under Subchapter A, Chapter 161, Health and
	Safety Code, immunization information of an individual who is 18
	years of age or older and whose immunization information was not
	included in the registry on or before January 1, 2019, unless the
	department receives immunization data from a health care provider
	who:
	(1)  administers an immunization to the individual
	after that date and elects to provide the individual's immunization
	information to the department; and
	(2)  notifies the individual before submission of the
	information to the department:
	(A)  that the health care provider is providing
	the information to the department for inclusion in the registry;
	(B)  that the information will remain in the
	registry until removal is requested by the individual or the
	individual's legally authorized representative; and
	(C)  of the procedures for requesting removal from
	the registry under Subchapter A, Chapter 161, Health and Safety
	Code, as amended by this Act.
	SECTION 11.  (a)  As soon as practicable after the effective
	date of this section, the Department of State Health Services shall
	conduct a public awareness campaign to educate health care
	providers, parents, payors, schools, and the public about the
	changes in law made by this Act.
	(b)  As soon as practicable after the effective date of this
	section, the executive commissioner of the Health and Human
	Services Commission shall adopt the rules required by Section
	161.0073(h), Health and Safety Code, as added by this Act.
	SECTION 12.  (a) Except as provided by Subsection (b) of this
	section, this Act takes effect January 1, 2019.
	(b)  Section 11 of this Act takes effect September 1, 2017.