Each state’s public school system has a child vaccination requirement. Under these requirements, children enrolled in public schools must submit immunization or vaccination records, showing immunization against diseases such as measles, mumps, and polio.
HIPAA vaccine records law addresses the issue of when covered entities may share vaccination records with public schools.
Children typically receive their vaccinations from their own healthcare providers. To encourage vaccination, the Centers for Disease Control and Prevention (CDC) has developed a Vaccines for Children (VFC) program. This program enhances the ability of physicians to provide government-purchased vaccines to children. Through its Immunization Quality Improvement Program (IQIP), the CDC promotes and supports timely vaccination of children and adolescents. HIPAA vaccine records law also dictates when providers may share immunization records with public health officials administering the VFC program.
What Does HIPAA Vaccine Records Law Permit?
HIPAA vaccine records law is found within the HIPAA Privacy Rule. Under the Privacy Rule, VFC providers may share patient PHI with public health authorities. The Privacy Rule permits disclosures to public health authorities for the purpose of preventing or controlling disease, injury, or disability. To ensure quality vaccinations have been timely administered, public health authorities may review VFC provider immunization records. You can also learn more about HIPAA violations at work & testing, plus learn if violating HIPAA during COVID is a crime.
Do you have an effective HIPAA compliance program? Find out now by completing the HIPAA compliance checklist.
HIPAA Vaccine Records Law: What Information Can be Shared?
As a condition of participation in the VFC program, providers must share immunization records with health officials to verify compliance with VFC program requirements, including:
◈ Screening of all children in their practice to determine VFC eligibility;
◈ To determine provider compliance with the VFC immunization schedule regarding the appropriate timing and dosage of vaccinations;
◈ To determine provider compliance with applicable state laws, including state laws regarding religious or other vaccination exemptions; and
◈ To verify that VFC vaccine-eligible children are not being charged for the cost of the vaccine.
HIPAA Vaccine Records Law: When Else May Vaccine Information be Shared?
Under a separate provision of the Privacy Rule, a covered entity may disclose vaccine-related PHI to a school, about an individual who is a student or prospective student of the school, if:
◈ The protected health information that is disclosed is limited to proof of immunization;
◈ The school is required by state or other law to have such proof of immunization prior to admitting the individual; and
◈ The covered entity obtains and documents the agreement to the disclosure from either:
◆ A parent, guardian, or other person acting in loco parentis (in place of the parents) of the individual, if the individual is an unemancipated minor; or
◆ The individual, if the individual is an adult or emancipated minor.
