333-049-0010
Definitions

(1) All definitions of ORS 433.090 and 433.235 apply to OAR chapter 333, division 49.

(2) In addition to the definitions of ORS 433.090 and 433.235, the following definitions apply:

(a) "Authorized user" has the meaning as defined in ORS 433.090. Agents of the Centers for Disease Control and Prevention are considered authorized users when requesting information for investigation into adverse events reported to the Vaccine Adverse Events Reporting System.

(b) "Client" has the meaning as defined in ORS 433.090.

(c) "Exempt" means the special status of information on certain clients that will limit its disclosure.

(d) "Immunization Information System (IIS)" means a registry of client and vaccination records.

(e) "Manager" means the manager of the statewide IIS or their designee.

(f) "Oregon Immunization Program" means the Oregon Health Authority, Public Health Division, Immunization Program.

(g) "Public Health Division" means the Oregon Health Authority, Public Health Division.

(h) "State Public Health Division Timelines" means the schedule of reporting timelines shown in the Vaccine User Accountability Reporting Table (OAR 333-047-0050), detailing data elements required and when each element must be included for submission.

(i) "State supplied vaccine" means vaccine provided by the federal government or the Oregon Immunization Program.

Statutory/Other Authority: ORS 433.100
Statutes/Other Implemented: ORS 433.100
History:
PH 1-2025, amend filed 01/22/2025, effective 01/22/2025
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0100
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0020
Purpose and Intent

The purpose of these rules is to implement ORS 433.090 through 433.104, which:

(1) Authorizes the Public Health Division to develop an IIS for all children and adults born or living in Oregon; and

(2) Requires the Public Health Division to adopt rules to develop and implement the IIS, including a process by which a parent or guardian can control the transfer of information from the immunization record when such control is necessary to protect the health or safety of the family.

Statutory/Other Authority: ORS 433.100
Statutes/Other Implemented: ORS 433.092
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0105
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0030
Enrollment

(1) All children born in the state shall be enrolled in the IIS.

(2) Any person who receives an immunization in the state may be enrolled in the IIS.

(3) Nothing in these rules require the consent of a parent, guardian or client prior to enrollment in the IIS.

(4) For the purposes of enrolling children in the IIS, the manager may identify children born in the state from any birth record or abstract.

Statutory/Other Authority: ORS 433.094, 433.100 & 432.119
Statutes/Other Implemented: ORS 433.094 & 433.100
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0110
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0040
Collection and Release of Information

(1) The IIS may collect information for a client's immunization record from any authorized user. Such information to be collected shall be determined by the program and provided to the IIS in a format provided by the program.

(2) The IIS may collect information for a client's tracking and recall record from any authorized user. Information to be collected includes such information necessary to contact the client or the parent or the guardian of a client by electronic mail, phone or mail. Such information shall be determined by the program and provided to the tracking and recall system in a format provided by the program.

(3) The program may receive information from other Immunization Information Systems and may share information with other such IISs, provided that the manager determines that other IISs have confidentiality protection at least equivalent to those under ORS 433.090 through 433.102 and these rules. The manager shall prescribe the information that may be shared and the format for sharing information to and from other IISs.

(4) The program may release and publish information in the IIS in an aggregate form that does not identify a client.

Statutory/Other Authority: ORS 433.096, 433.094 & 432.119
Statutes/Other Implemented: ORS 433.096 & 433.094
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0115
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0050
Reporting to the Immunization Information System (IIS)

(1) Any provider who participates in the IIS and who administers immunizations shall report such immunization to the IIS within 14 calendar days of such immunization, or for COVID-19 immunizations, in accordance with OAR 333-047-1000.

(2) Any pharmacist who immunizes must report all immunizations administered to the IIS in accordance with OAR 855-019-0290, or for COVID-19 immunizations, in accordance with OAR 333-047-1000.

(3) Reports shall be submitted to the IIS in a manner as required by the program.

(4) Any authorized user may report immunizations, and other such information, permitted under ORS 433.090(3) and (5), as prescribed by the program, to the IIS without the consent of the client or the parent or guardian of the client. Reporting this information without the consent mentioned above shall not subject a person to liability or civil action.

(5) Any authorized user who administers state-supplied vaccine must report in a manner prescribed by the Oregon Health Authority the following data elements for all administered doses to the Statewide Immunization Information System in accordance with Public Health Division timelines in the Vaccine User Accountability Reporting Table (OAR 333-047-0050) and for COVID-19 vaccine, in accordance with OAR 333-047-1000:

(a) The name, address, phone number, gender, and date of birth of a client;

(b) The date of administration of the vaccine;

(c) The CPT, CVX, or NDC code of the vaccine administered;

(d) The dose-level vaccine eligibility code;

(e) The organizational identifier of the administering or reporting clinic or site;

(f) The lot number of the vaccine;

(g) The dose amount and manufacturer of the vaccine, when available; and

(h) Other data elements as specified by the Public Health Division.

(6) Any authorized user who administers state-supplied vaccine shall utilize, in accordance with OAR 333-047-0050 and 333-047-1000:

(a) The ordering module for ordering state-supplied vaccines; and

(b) The inventory module for tracking public or public and private vaccine supply.

Statutory/Other Authority: ORS 433.096, 433.103 & 689.645
Statutes/Other Implemented: ORS 433.096, 433.103 & 689.645
History:
PH 30-2021, amend filed 07/12/2021, effective 07/12/2021
PH 5-2021, temporary amend filed 01/22/2021, effective 01/22/2021 through 07/20/2021
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 24-2010, f. & cert. ef. 9-30-10
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0120
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0060
Access to Immunization Records

(1) Clients, parents and guardians of children less than 18 years of age may request a copy of their, or their child's, immunization record by submitting a request for the record, as prescribed by the program.

(2) All other authorized users shall access such records in a manner prescribed by the program.

Statutory/Other Authority: ORS 433.094 & 433.096
Statutes/Other Implemented: ORS 433.094 & 433.096
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0125
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0065
Fees

For the purposes of implementing ORS 433.090 through 433.104 fees may be charged in accordance with this rule:

(1) Fees may be charged to authorized users including, but not limited to, the following: health plans, health provider associations, private or non-profit institutions, other state registries, federal health agencies or their contractors.

(2) Fees shall not be charged to the following users: individual health care providers and clinics, Oregon schools, Oregon children's facilities, Oregon hospitals or Oregon Health Authority, Oregon Health Plan.

(3) Fees may be waived or reduced at the discretion of the manager or Oregon Health Authority Immunization Program Manager in accordance with Immunization Policy.

(4) Unless waived or exempt under subsection (2) of this rule, a fee of up to $5 per client shall be charged to each authorized user for each client-specific immunization data request.

Statutory/Other Authority: ORS 433.100
Statutes/Other Implemented: ORS 433.100
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 6-2008, f. & cert. ef. 3-17-08
PH 6-2005, f. & cert. ef. 4-13-05

333-049-0070
Limitations on Access to Information in the Immunization Information System and Tracking and Recall System

(1) An authorized user may only access information in the IIS or Tracking and Recall System as follows:

(a) An authorized user may access information on a client who is presently under that authorized user’s care, or enrolled in the authorized user’s children's facility, school, post-secondary educational institution, program or health plan, except as otherwise provided by law.

(b) An authorized user that is a state or local public health authority may, in addition to accessing information described in subsection (1)(a) of this rule, access information on an individual within a public health entity’s jurisdiction for:

(A) Assessment, evaluation, surveillance and outreach related to immunization promotion and vaccine-preventable disease prevention; and

(B) The Pregnancy Risk Assessment Monitoring System (PRAMS).

(2) The program may monitor and audit all access to a client's record contained in the IIS.

(3) The program may require any person who has accessed a client's record to provide evidence that such client was under the care of the person or enrolled in the person's post-secondary educational institution, school, children's facility, program or health plan at the time the client's record was accessed.

(4) Requests for client-specific data from entities other than authorized users, or requests from authorized users for data beyond that listed in subsection (1)(a) or (1)(b) of this rule, will be considered on a case by case basis in the interests of public health practice.

(5) If a request for client-specific data is denied, aggregate/de-identified data may be provided at the discretion of the IIS manager.

(6) The Public Health Division may report violations of these rules by any authorized user who has accessed a client's record to the appropriate licensing or regulatory authority.

Statutory/Other Authority: ORS 433.098
Statutes/Other Implemented: ORS 433.098
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0130
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0080
Limitations on the Transfer of Information from the Immunization Information System

(1) Any parent or guardian of a child who has a disease or condition that may preclude administration of some or all immunizations may request a limitation on the child's information that may be transferred from the Immunization Information System (IIS) by providing a written request to the Oregon Immunization Program (program).

(2) Upon verification of the information in the request, the program shall cause the IIS to flag the client's record and to limit transfer of the information on the client. The program shall also notify the parent or guardian of such action. No information on such children will be disclosed in response to inquiries to the IIS.

(3) Any parent or guardian of a client may request a limitation on the transfer of child’s information by providing a written request to the program when the parent or guardian reasonably believes there is a risk of harm to the child, or other family members, where such person could be located through information from the IIS, and the child or other family members may be harmed if located.

(a) The request for limitation must include a statement and evidence that supports the request. Such evidence may include any evidence accepted under ORS 192.445(2)(b)(A)–(E).

(b) Upon receipt of any request under this section, the manager may cause the IIS to flag the child's record for a period of 30 days until the request can be approved.

(c) Upon receipt of acceptable evidence to support the request, the manager shall cause the IIS to flag the child's record and to limit transfer of the information on the child. The manager shall also notify the parent or guardian of such action.

(d) After approval of a request under this section, such request will remain in effect until the program receives a written request from the parent or guardian, or upon reaching 18 years, the client, to remove the flag from the record.

Statutory/Other Authority: ORS 433.100
Statutes/Other Implemented: ORS 433.100
History:
PH 1-2025, amend filed 01/22/2025, effective 01/22/2025
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0135
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0090
Notification of Needed Immunizations, Hearing Screening, or Lead Screening

(1) The program, authorized user, or public health entity may contact or provide notice to clients or parents and guardians of clients less than 18 years of age when the tracking and recall system indicates that a client has missed:

(a) A scheduled immunization;

(b) Lead screening; or

(c) Hearing screening for clients zero through 12 years of age.

(2) The program, authorized user, or public health entity may also notify the client’s provider of last record of the client’s needed immunizations, hearing screening, or lead screening.

Statutory/Other Authority: ORS 433.096
Statutes/Other Implemented: ORS 433.096
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 14-2011, f. 12-28-11, cert. ef. 1-1-12
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0140
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0100
Confidentiality

(1) Personal identifying information from the IIS shall only be disclosed to authorized users.

(2) An authorized user shall not disclose information from the IIS except to another authorized user.

(3) Any request for the limitations on the transfer of information from the immunization record or the immunization tracking and recall record shall be confidential.

(4) All providers with access to the IIS shall provide to the program an agreement signed by such providers or their authorized agent. The agreement shall be in a form prescribed by the program and may include provisions to maintain the confidentiality of the information in the IIS, and to only access information on clients under the care of such persons.

Statutory/Other Authority: ORS 433.098
Statutes/Other Implemented: ORS 433.098
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0145
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0120
Deletion of Information in the Immunization Information System and Tracking and Recall System

A client who is 18 years of age or older may request to have their record sealed or removed from the IIS. The election of whether to seal the record or remove the record is at the sole discretion of the client.

(1) Process. A client requesting sealing or removal of their IIS record must submit a form approved by the program for that purpose. The client may elect to have their record sealed or removed from the IIS. If the client does not elect either option, then their record will be removed from the IIS.

(2) The request for sealing or removal of a client’s record must also include a legible photocopy of one piece of photo identification. Acceptable identification includes any of the following:

(a) A valid state-issued driver’s license or identification card;

(b) A passport; or

(c) A U.S. military identification card.

(3) If a client elects to have their IIS record sealed, the information will remain in the IIS but will not be released to authorized users. In the case of a declared public health emergency, the program may release the information to public health officials for the sole purpose of responding to the declared emergency. A client may request that their record be unsealed by submitting the form approved by the program along with a photocopy of an approved document that verifies the client’s identity. A record that is removed from the IIS cannot be recovered.

(4) When an immunization record is removed from the IIS, certain pieces of demographic information, including a client’s name and date of birth, must be kept on file to keep the immunization record from being repopulated.

Statutory/Other Authority: ORS 433.098
Statutes/Other Implemented: ORS 433.098
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
PH 6-2008, f. & cert. ef. 3-17-08
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0155
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96

333-049-0130
Security

(1) All authorized users shall abide by such security policies and procedures to safeguard information in the IIS deemed necessary by the program. Such policies and procedures may include, but are not limited to, confidentiality agreements, the use of computer passwords, and user identification numbers. The program shall provide copies of the policies and procedures to all authorized users who participate in either or both the IIS or tracking and recall system.

(2) The program shall develop security standards to safeguard the information in the IIS. The standards will address, but not be limited to, the collection, transfer, storage, and processing of information in the IIS and tracking and recall system.

(3) The program shall review the security policies, procedures, and standards at least once each year and shall revise such policies, procedures, and standards as necessary.

Statutory/Other Authority: ORS 433.098
Statutes/Other Implemented: ORS 433.098
History:
PH 256-2018, amend filed 11/02/2018, effective 11/12/2018
OHD 13-2001, f. & cert. ef. 7-12-01, Renumbered from 333-019-0160
HD 4-1997, f. & cert. ef. 2-24-97
HD 6-1996(Temp), f. & cert. ef. 11-26-96