The Oregon Administrative Rules contain OARs filed through November 15, 2015

 

QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY,

PUBLIC HEALTH DIVISION

 

DIVISION 49
IMMUNIZATION REGISTRY

333-049-0010
Definitions
(1) All definitions of ORS 433.090
and 433.235 apply to these rules.
(2) In addition to the definitions
of ORS 433.090 and 433.235, the following definitions apply:
(a) "Authorized user" has the
meaning as defined in ORS 433.090(1).
(b) "Client" has the meaning
as defined in ORS 433.090(3).
(c) "Exempt" means the special
status of information on certain clients that will limit its disclosure.
(d) “Manager” means
the manager of the statewide immunization registry or his/her designee.
(e) “Oregon Immunization
Program” means the Oregon Health Authority, Public Health Division, Immunization
Program.
(f) "Public Health Division"
means the Oregon Health Authority, Public Health Division.
(g) “State Public Health
Division Timelines” means the schedule of reporting timelines shown in the
Vaccine User Accountability Reporting Table (OAR 333-047-0050), detailing data elements
required and when each element must be included for submission.
(h) “State supplied vaccine”
means vaccine provided by the federal government or the Oregon Immunization Program.
Stat. Auth.: ORS 433.100

Stats. Implemented: ORS 433.100

Hist.: HD 6-1996(Temp), f. &
cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. &
cert. ef. 7-12-01, Renumbered from 333-019-0100; PH 6-2008, f. & cert. ef. 3-17-08;
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
333-049-0020
Purpose and Intent
(1) The purpose of these rules is to implement ORS 433.090 et seq., which:
(a) Authorizes the Public Health Division to develop a registry for all children and adults born or living in Oregon; and
(b) Requires the Public Health Division to adopt rules to develop and implement the registry, including a process by which a parent or guardian can control the transfer of information from the immunization record when such control is necessary to protect the health or safety of the family.
(2) In order to increase appropriate immunizations among preschool age children, it is the intent that, as soon as practical, all children born in the state will be automatically enrolled in the registry using information derived from birth certificates, and that all children from birth through 35 months of age, who are not enrolled from birth certificates, will receive priority for enrollment in the registry.
Stat. Auth.: ORS 433.100

Stats. Implemented: ORS 433.092

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97, f. & cert. ef. 7-12-01; OHD 13-2001, Renumbered from 333-019-0105; PH 6-2008, f. & cert. ef. 3-17-08
333-049-0030
Enrollment
(1) All children born in the state shall be enrolled in the registry.
(2) All children who live with a parent or guardian in the state for any period of time, and who receive an immunization, may be enrolled in the registry.
(3) Any person who receives an immunization in the state may be enrolled in the registry.
(4) The enrollment of clients in the registry shall be in a manner and on such forms as prescribed by the Manager.
(5) Nothing in these rules require the consent of a parent, guardian or client prior to enrollment in the registry.
(6) For the purposes of enrolling children in the registry, the Manager may identify children born in the state from any birth record or abstract.
Stat. Auth.: ORS 433.094, 433.100 & 432.119

Stats. Implemented: ORS 433.094 & 433.100

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0110; PH 6-2008, f. & cert. ef. 3-17-08
333-049-0040
Collection and Release of Information
(1) The manager may collect
information for a client's immunization record from any authorized user. Such information
to be collected shall be determined by the manager and provided to the registry
on forms or in a format provided by the manager.
(2) The manager may collect
information for a client's tracking and recall record from any authorized user.
Information to be collected includes such information necessary to send reminder
cards to, place telephone calls to, or personally contact the client or the parent
or the guardian of a client. Such information shall be determined by the manager
and provided to the tracking and recall system on forms or in a format provided
by the manager.
(3) The manager may receive
information from other registries and may share information with other such registries,
provided that the manager makes a determination that other registries have confidentiality
protection at least equivalent to those under ORS 433.090 through 433.102 and these
rules. The manager shall prescribe the information that may be shared and the forms
for sharing information to and from other registries.
(4) The manager may request
information to determine the name of any person and information on contacting the
person or such person's parent or guardian
in order to notify them about the existence of the registry. The manager may seek
information on persons in the state who have not enrolled in the registry through
contacting other state agencies, and other appropriate organizations that have access
to such information.
(5) The manager may release and publish
information in the registry in an aggregate form that does not identify a client.
Stat. Auth.: ORS 433.096, 433.094
& 432.119

Stats. Implemented: ORS 433.096
& 433.094

Hist.: HD 6-1996(Temp), f. &
cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. &
cert. ef. 7-12-01, Renumbered from 333-019-0115; PH 6-2008, f. & cert. ef. 3-17-08;
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
333-049-0050
Reporting to the Immunization Registry
(1) Any provider who participates
in the registry and who administers immunizations identified by the manager shall
report such immunization to the registry within 14 calendar days of such immunization.
(2) Any pharmacist who immunizes
must report all immunizations administered to the registry.
(3) Reports shall be submitted
to the registry in a manner and on such forms as required by the manager. Such forms
shall be provided by the manager.
(4) Any authorized user may
report immunizations, and other such information, permitted under ORS 433.090(3)
and (5), as prescribed by the manager, to the registry without the consent of the
client or the parent or guardian of the client. Reporting this information without
the consent mentioned above shall not subject a person to liability or civil action.
(5) Any authorized user who
administers state-supplied vaccine must report in a manner prescribed by the Authority
the following data elements for all administered doses to the Statewide Immunization
Registry in accordance with Public Health Division timelines in the Vaccine User
Accountability Reporting Table (OAR 333-047-0050):
(a) The name, address, phone
number, gender, and date of birth of a client;
(b) The date of administration
of the vaccine;
(c) The CPT, CVX, or NDC code
of the vaccine administered;
(d) The dose-level vaccine eligibility
code;
(e) The organizational identifier
of the administering or reporting clinic or site;
(f) The lot number of the vaccine;
(g) The dose amount and manufacturer
of the vaccine, when available; and
(h) Other data elements as specified
by the Public Health Division.
(6) Any authorized user who
administers state-supplied vaccine shall utilize, in accordance with OAR 333-047-0050:
(a) The ordering module for
ordering state-supplied vaccines; and
(b) The inventory module for
tracking public or public and private vaccine supply.
[ED. NOTE: Tables referenced
are available from the agency.]
Stat. Auth.: ORS 433.096, 433.103,
689.645

Stats. Implemented: ORS 433.096, 433.103,
689.645

Hist.: HD 6-1996(Temp), f. &
cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. &
cert. ef. 7-12-01, Renumbered from 333-019-0120; PH 6-2008, f. & cert. ef. 3-17-08;
PH 24-2010, f. & cert. ef. 9-30-10; PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
333-049-0060
Access to Immunization Records
(1) Clients, parents and guardians:
(a) Clients and parents or guardians of children less than 18 years of age may request a copy of their, or their child's, immunization record by submitting a request for the record, as prescribed by the Manager.
(b) The Manager may provide a maximum of four (4) copies of any client's immunization record without charge, within one calendar year, pursuant to the request from a client, parent or guardian. Additional copies of the immunization record may be provided based on a fee established by the Manager that is reasonably calculated to reimburse the registry for the actual cost in making such records available.
(2) Other authorized users: All other authorized users shall access such records in a manner prescribed by the Manager.
Stat. Auth.: ORS 433.094 & 433.096

Stats. Implemented: ORS 433.094 & 433.096

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0125; PH 6-2008, f. & cert. ef. 3-17-08
333-049-0065
Fees
For the purpose of implementing
ORS 433.090 through 433.104 fees may be charged in accordance with this rule:
(1) Fees may be charged to authorized
users including, but not limited to, the following: health plans, health provider
associations, private or non-profit institutions, other state registries, federal
health agencies or their contractors.
(2) Fees shall not be charged
to the following users: individual health care providers and clinics, Oregon schools,
Oregon children's facilities, Oregon hospitals or the Oregon Health Authority, Division
of Medical Assistance Programs.
(3) Fees may be waived at the
discretion of the ALERT Manager or the Oregon Health Authority Immunization Program
Manager in accordance with Immunization Policy.
(4) Unless waived, or exempt
under subsection (2) of this rule, a fee of $10 per client shall be charged to each
authorized user for each client specific immunization data request.
(5) A request for client specific
data shall be responded to only when made by an authorized user for information
about a client under its care or by a public health entity for clients within its
jurisdiction. Requests from persons other than authorized users or from authorized
users for data beyond that of a specific patient(s) under its care or within the
public health entity’s jurisdiction will be considered on a case by case basis
in the interests of public health practice and may be responded to only with aggregate/de-identified
data.
Stat. Auth.: ORS 433.100

Stats. Implemented: ORS 433.100

Hist.: PH 6-2005, f. & cert.
ef. 4-13-05; PH 6-2008, f. & cert. ef. 3-17-08; PH 14-2011, f. 12-28-11, cert.
ef. 1-1-12
333-049-0070
Limitations on Access to Information in the Immunization Registry and Tracking and Recall System
(1) An authorized user may only
access information in the Registry or Tracking and Recall System as follows:
(a) An authorized user may access
information on a client who is presently under that authorized user’s care,
or enrolled in the authorized user’s children's facility, school, post-secondary
educational institution, program or health plan, except as otherwise provided by
law.
(b) An authorized user that
is a state or local public health authority may, in addition to accessing information
described in subsection (1)(a) of this rule, access information on an individual
within a public health entity’s jurisdiction for:
(A) Assessment, evaluation,
surveillance and outreach related to immunization promotion and vaccine-preventable
disease prevention; and
(B) The Pregnancy Risk Assessment
Monitoring System (PRAMS).
(2) The manager may monitor
and audit all access to a client's record contained in the registry.
(3) The manager may require
any person who has accessed a client's record to provide evidence that such client
was under the care of the person or enrolled in the person's post-secondary educational
institution, school, children's facility, program or health plan at the time the
client's record was accessed.
(4) The Public Health Division
may report violations of these rules by any authorized user who has accessed a client's
record to the appropriate licensing or regulatory authority.
Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. &
cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. &
cert. ef. 7-12-01, Renumbered from 333-019-0130; PH 6-2008, f. & cert. ef. 3-17-08;
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
333-049-0080
Limitations on the Transfer of Information from the Immunization Registry
(1) A parent or guardian may request a limitation on the transfer of information pertaining to a child enrolled in a registry when such child has a disease or condition that precludes administration of some or all immunizations. No information on such children will be disclosed in response to inquiries to the registry.
(a) Any parent or guardian of a child who has a disease or condition that may preclude administration of some or all immunizations may request a limitation on the child's information that may be transferred from the registry by providing a written request to the Manager.
(b) Upon verification of the information in the request, the Manager shall cause the registry to flag the client's record and to limit transfer of the information on the client. The Manager shall also notify the parent or guardian of such action.
(2) Safety. A parent or guardian may request a limitation on the transfer of information pertaining to a child enrolled in a registry when a third party could use the information in the record to locate the child, or other family members who reside with the child, and who the parent or guardian reasonably believes presents a risk of harm to the child or other family members.
(a) Any parent or guardian of a client may request a limitation on the transfer of child’s information by providing a written request to the Manager when the parent or guardian reasonably believes there is a risk of harm to the child, or other family members, where such person could be located through information from the registry, and the child or other family members may be harmed if located.
(b) The request for limitation must also include a statement and evidence that supports the request. Such evidence may include any evidence accepted under ORS 192.445(2)(b)(A)-(E).
(c) Upon receipt of acceptable evidence to support the request, the Manager shall cause the registry to flag the child's record and to limit transfer of the information on the child. The Manager shall also notify the parent or guardian of such action.
(3) Upon receipt of any request under this section, the Manager may cause the registry to flag the child's record for a period of 30 days until the request can be approved.
(4) After approval of a request under this section, such request will remain in effect until the Manager receives a written request from the parent or guardian to remove the flag from the child’s record.
Stat. Auth.: ORS 433.100

Stats. Implemented: ORS 433.100

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0135; PH 6-2008, f. & cert. ef. 3-17-08
333-049-0090
Notification of Needed Immunizations,
Hearing Screening, or Lead Screening
(1) The manager, authorized
user, or public health entity may contact or provide notice to clients or parents
and guardians of clients less than 18 years of age when the tracking and recall
system indicates that a client has missed:
(a) A scheduled immunization;
(b) Lead screening; or
(c) Hearing screening for clients
zero through 12 years of age.
(2) The manager, authorized
user, or public health entity may also notify the client’s provider of last
record of the client’s needed
immunizations, hearing screening, or lead screening. Notification shall be in such
form as prescribed by the manager.
Stat. Auth.: ORS 433.096

Stats. Implemented: ORS 433.096

Hist.: HD 6-1996(Temp), f. &
cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. &
cert. ef. 7-12-01, Renumbered from 333-019-0140; PH 6-2008, f. & cert. ef. 3-17-08;
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
333-049-0100
Confidentiality
(1) Personal identifying information from the registry shall only be disclosed to authorized users.
(2) An authorized user shall not disclose information from the registry except to another authorized user.
(3) Any request for the limitations on the transfer of information from the immunization record or the immunization tracking and recall record shall be confidential.
(4) All providers with access to the registry shall provide to the Director an agreement signed by such providers or their authorized agent. The agreement shall be in a form prescribed by the Director, and may include provisions to maintain the confidentiality of the information in the registry, and to only access information on clients under the care of such persons.
Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0145
333-049-0120
Deletion of Information in the Registry and Tracking and Recall System
A client who is 18 years of age or older may request to have their record sealed or removed from the registry. The election of whether to seal the record or remove the record is at the sole discretion of the client.
(1) Process. A client requesting sealing or removal of their registry record must submit a form approved by the Manager for that purpose. The client may elect to have their record sealed or removed from the registry. If the client does not elect either option then their record will be removed from the registry.
(2) The request for sealing or removal of a client’s record must also include a legible photocopy of one piece of photo identification. Acceptable identification includes any of the following: a valid state-issued driver’s license or identification card; a passport; or a U.S. military identification card.
(3) If a client elects to have their registry record sealed, the information will remain in the registry but will not be released to authorized users. In the case of a declared public health emergency, the Manager may release the information to public health officials for the sole purpose of responding to the declared emergency. A client may request that their record be unsealed by submitting the form approved by the Manager along with a photocopy of an approved document that verifies the client’s identity. A record that is removed from the registry cannot be recovered.
(4) When an immunization record is removed from the registry, certain pieces of demographic information, including a client’s name and date of birth, must be kept on file in order to keep the immunization record from being repopulated.
Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0155; PH 6-2008, f. & cert. ef. 3-17-08
333-049-0130
Security
(1) All authorized users shall abide by such security policies and procedures to safeguard information in the registry deemed necessary by the Director. Such policies and procedures may include, but are not limited to, confidentiality agreements, the use of computer passwords, and user identification numbers. The Director shall provide copies of the policies and procedures to all authorized users who participate in either or both the immunization registry or tracking and recall system.
(2) The Director shall develop security standards to safeguard the information in the registry. The standards will address, but not be limited to, the collection, transfer, storage, and processing of information in the registry and tracking and recall system.
(3) The Director shall review the security policies, procedures, and standards at least once each year and shall revise such policies, procedures, and standards as necessary.
Stat. Auth.: ORS 433.098

Stats. Implemented: ORS 433.098

Hist.: HD 6-1996(Temp), f. & cert. ef. 11-26-96; HD 4-1997, f. & cert. ef. 2-24-97; OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0160

The official copy of an Oregon Administrative Rule is
contained in the Administrative Order filed at the Archives Division,
800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the
published version are satisfied in favor of the Administrative Order.
The Oregon Administrative Rules and the Oregon Bulletin are
copyrighted by the Oregon Secretary of State. Terms
and Conditions of Use