HB2872 - Relating to the release or disclosure of vaccination or immunization information; providing a civil penalty.

  89R4966 KRM-F     By: Olcott H.B. No. 2872       A BILL TO BE ENTITLED   AN ACT   relating to the release or disclosure of vaccination or   immunization information; providing a civil penalty.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Subchapter A, Chapter 161, Health and Safety   Code, is amended by adding Section 161.0093 to read as follows:           Sec.   161.0093.     PROHIBITED RELEASE OR DISCLOSURE OF   VACCINATION OR IMMUNIZATION INFORMATION; EXCEPTIONS; CIVIL   PENALTY. (a) In this section, "health authority" has the meaning   assigned by Section 81.003.           (b)     An employee or agent of the department or a health   authority may not release or otherwise disclose to any person an   individual's vaccination or immunization information the   department or health authority receives unless:                 (1)     the department or health authority, as applicable,   obtains the written or electronic consent of the individual or the   individual's legally authorized representative;                 (2)     the employee or agent releases or discloses the   information to a health care provider in accordance with applicable   state and federal laws relating to the privacy, protection,   confidentiality, and transmission of health information; or                 (3)     the release or disclosure is otherwise authorized   by this subchapter.           (c)     A person who obtains an individual's vaccination or   immunization information under this subchapter may not release or   otherwise disclose the information to a third party, including   under a contract or subcontract, for the purpose of encouraging   individuals to obtain a vaccine or to provide educational materials   on a vaccine.           (d)     A person who releases or discloses vaccination or   immunization information in violation of Subsection (b) or (c) is   liable to this state for a civil penalty in an amount of not less   than $2,000 and not more than $50,000 for each violation. The   attorney general may bring an action to collect the civil penalty   imposed under this subsection.          SECTION 2.  Sections 161.007(a) and (j), Health and Safety   Code, are amended to read as follows:          (a)  The department, for the primary purpose of establishing   and maintaining a single repository of accurate, complete, and   current immunization records to be used in aiding, coordinating,   and promoting efficient and cost-effective communicable disease   prevention and control efforts, shall establish and maintain an   immunization registry. The executive commissioner by rule shall   develop guidelines to:                (1)  protect the confidentiality of patients in   accordance with Section 159.002, Occupations Code;                (2)  inform the individual or the individual's legally   authorized representative about the registry [ and that registry   information may be released under Section 161.00735 ];                (3)  require the written or electronic consent of the   individual or the individual's legally authorized representative   before any information relating to the individual is included in   the registry;                (4)  permit the individual or the individual's legally   authorized representative to withdraw consent for the individual to   be included in the registry; and                (5)  determine the process by which consent is   verified, including affirmation by a health care provider, birth   registrar, regional health information exchange, or local   immunization registry that consent has been obtained.          (j)  Except as provided by Sections 161.00705, 161.00706,   [ 161.00735(b), ] and 161.008, information obtained by the   department for the immunization registry is confidential and may be   disclosed only with the written or electronic consent of the   individual or the individual's legally authorized representative.          SECTION 3.  Section 161.00705(g), Health and Safety Code, is   amended to read as follows:          (g)  The immunization information of a child or other   individual received by the department under this section, including   individually identifiable information, may be released only:                (1)  on consent of the individual or, if a child, the   child's parent, managing conservator, or guardian; or                (2)  to a [ state agency or ] health care provider   consistent with the purposes of this subchapter or the purposes of   aiding or coordinating communicable disease prevention and control   efforts during a declared disaster, public health emergency,   terrorist attack, hostile military or paramilitary action, or   extraordinary law enforcement emergency.          SECTION 4.  Sections 161.00706(c) and (d), Health and Safety   Code, are amended to read as follows:          (c)  The executive commissioner shall:                (1)  develop rules to ensure that immunization history   submitted under Subsection (a)(2) is medically verified   immunization information;                (2)  develop guidelines for use by the department in   informing first responders about the registry [ and that registry   information may be released under Section 161.00735 ]; and                (3)  adopt rules necessary for the implementation of   this section.          (d)   A [ Except as provided by Section 161.00735, a ] person's   immunization history or data received by the department under this   section may be released only on consent of the person or to any   health care provider licensed or otherwise authorized to administer   vaccines.          SECTION 5.  Section 161.0071(a), Health and Safety Code, is   amended to read as follows:          (a)  The first time the department receives registry data for   an individual for whom the department has received consent to be   included in the registry, the department shall send notice to the   individual or the individual's legally authorized representative   disclosing:                (1)  that providers and payors may be sending the   individual's immunization information to the department;                (2)  the information that is included in the registry;                (3)  the persons to whom the information may be   released under Section [ Sections 161.00735(b) and ] 161.008(d);                (4)  the purpose and use of the registry;                (5)  the procedure to exclude an individual from the   registry; and                (6)  the procedure to report a violation if an   individual's information is included in the registry after   exclusion has been requested or consent has been withdrawn.          SECTION 6.  Section 161.0073(a), Health and Safety Code, is   amended to read as follows:          (a)  Except as provided by Section [ Sections ] 161.00705 [ and   161.00735 ], information that individually identifies an individual   that is received by the department for the immunization registry is   confidential and may be used by the department for registry   purposes only.          SECTION 7.  The heading to Section 161.00735, Health and   Safety Code, is amended to read as follows:          Sec. 161.00735.  [ RELEASE AND ] RECEIPT OF REGISTRY DATA IN   DISASTER.          SECTION 8.  Section 161.00735(h), Health and Safety Code, is   amended to read as follows:          (h)  The executive commissioner shall make every effort to   enter into a memorandum of agreement with each state from [ to ] which   residents of that [ this ] state are likely to evacuate to this state   in a disaster on[ :                [ (1)     the release and use of registry information under   this section to the appropriate health authority or local health   authority of that state, including the length of time the   information may be retained by that state; and                [ (2) ]  the receipt and use of information submitted by   the health authority or local health authority of that state for   inclusion in the registry under this section.          SECTION 9.  Section 161.0075, Health and Safety Code, is   amended to read as follows:          Sec. 161.0075.  IMMUNITY FROM LIABILITY. Except as provided   by Sections [ Section ] 161.009 and 161.0093 , the following persons   subject to this subchapter that act in compliance with Sections   161.007, 161.00705, 161.00706, 161.0071, 161.0073, 161.0074, and   161.008 are not civilly or criminally liable for furnishing the   information required under this subchapter:                (1)  a payor;                (2)  a health care provider who administers   immunizations; and                (3)  an employee of the department.          SECTION 10.  Section 161.008(d), Health and Safety Code, is   amended to read as follows:          (d)  The department may release the data constituting an   immunization record for the individual to:                (1)   a health care provider treating the individual or   an organization of which the individual is a member [ any entity that   is described by Subsection (c) ]; or                (2)  [ a school or child care facility in which the   individual is enrolled;                [ (3)     a state agency having legal custody of the   individual; or                [ (4) ]  an employer of a first responder or a first   responder in accordance with Section 161.00708.          SECTION 11.  Section 161.00735(b), Health and Safety Code,   is repealed.          SECTION 12.  The changes in law made by this Act apply only   to the release or disclosure of information on or after the   effective date of this Act. The release or disclosure of   information before the effective date of this Act is governed by the   law in effect when the release or disclosure was made, and the   former law is continued in effect for that purpose.          SECTION 13.  This Act takes effect September 1, 2025.