105 CMR 222.00 — Massachusetts immunization information system

105 CMR: DEPARTMENT OF PUBLIC HEALTH 105 CMR 222.000: MASSACHUSETTS IMMUNIZATION INFORMATION SYSTEM Section

105 CMR 222.00 Massachusetts immunization information system

222.001 Purpose

222.001: Purpose

222.002 Scope

222.002: Scope

222.003 Definitions

222.003: Definitions

222.100 Immunization Information Reporting

222.100: Immunization Information Reporting

222.105 Duty to Inform

222.105: Duty to Inform

222.200 MIIS Site and MIIS User Registration

222.200: MIIS Site and MIIS User Registration

222.205 System Access and Confidentiality

222.205: System Access and Confidentiality

222.206 Protection from Subpoena and Public Records Requests

222.206: Protection from Subpoena and Public Records Requests

222.300 Requests to Amend Records and Access Records by Individuals

222.300: Requests to Amend Records and Access Records by Individuals

222.305 Requests for List of Those Who Have Accessed Records

222.305: Requests for List of Those Who Have Accessed Records

222.410 Collaborative Agreements with Registries in Other States

222.410: Collaborative Agreements with Registries in Other States 222. 001: Purpose The purpose of 105 CMR 222.000 is to facilitate and promote the use of the Massachusetts Immunization Information System (MIIS) to help improve immunization coverage among all individuals in the Commonwealth.

222.002 Scope

222.002: Scope 105 CMR 222.000 applies to all authorized recipients and authorized users that access the MIIS.

222.003 Definitions

222.003: Definitions Authorized Recipient means an individual or agency the Department may release immunization information to for specified purposes without further express consent of the Immunization Recipient or legally authorized representative of the Immunization Recipient. An authorized recipient may not access the MIIS until the authorized recipient becomes a MIIS site or MIIS user. Data Sharing Objection or Objection to Data Sharing means a patient's indication of an objection to sharing the patient's immunization information across MIIS users. A data sharing objection shall not limit the Department's access to and use of immunization information. Data Sharing Objection Form means a mechanism as determined by the Department by which an Immunization Recipient or legally authorized representative of the Immunization Recipient may indicate a data sharing objection. The indication of an objection to data sharing via a Data Sharing Objection Form shall not limit the Department's access to and use of immunization information. Department means the Massachusetts Department of Public Health. EHR means an electronic health record. Electronic Data Exchange means the electronic interchange of information or data using a standardized format that allows one entity to send information to another electronically rather than with paper. GUI means a web-based graphical user interface as designated by the department for authorized users to access the MIIS. Health Care Provider means a licensed health care provider who is legally authorized to administer immunizations in Massachusetts. Health Plans means commercial health insurers, Blue Cross and Blue Shield of Massachusetts, Inc., health maintenance organizations offering or renewing insured health products in Massachusetts, to Massachusetts residents, and MassHealth. 8/16/24 105 CMR - 1202.1 (Mass. Register #1528, 8/16/2024)

105 CMR: DEPARTMENT OF PUBLIC HEALTH

222.003 continued

222.003: continued Immunization means a vaccine or immunoglobulin, or other antibody preparation, that introduces active or passive immunity to a specific disease or group of diseases. Immunization Information means any data contained in the MIIS that relate to an individual immunization recipient or that may, in the determination of the Department, be used to identify an individual immunization recipient. Immunization Recipient means an individual who received or will receive an immunization. Legally Authorized Representative means a parent, guardian, or person or agency legally authorized to act on behalf of the legally authorized representative in the event the legally authorized representative is not legally able to act on their own behalf. MIIS means the Massachusetts Immunization Information System. MIIS User means an individual who is an Authorized Recipient and has registered and agreed to comply with all terms and conditions developed and set forth by the Department, which may include, but not be limited to, user and confidentiality agreements. MIIS Site means a fixed or mobile location with MIIS users that has registered and agreed to comply with all terms and conditions developed and set forth by the Department, which may include, but not be limited to, user and confidentiality agreements. VIS means Vaccine Information Statements, which are information sheets produced by the U.S. Centers for Disease Control and Prevention (CDC) that explain to vaccine recipients, their parents, or their legal representatives the risks and benefits of a vaccine and may also include fact sheets or other information required by the CDC or U.S. Food and Drug Administration (FDA). VFC means the federal Vaccines For Children Program.

222.100 Immunization Information Reporting

222.100: Immunization Information Reporting (A) Health care providers shall report all new immunizations either through the GUI or by data exchange within 72 hours of immunization administration. In the event of administration of a birth dose of an immunization to a newborn that is not yet named in the relevant health record, the healthcare provider shall report the immunization administration within 24 hours of the immunization recipient being so named. (B) MIIS users and MIIS sites that perform data exchange shall comply with all electronic data exchange specifications required by the Department. (C) Data reported pursuant to 105 CMR 222.000 shall include at a minimum: (1) For both current and historical immunizations, the full first and last name and date of birth of the Immunization Recipient, immunization type, and date of immunization administration; (2) For current immunizations: the Immunization Recipient's VFC status, current home address, sex, gender, race, ethnicity, preferred language, immunization manufacturer and lot number, name, address, and title of the person administering the immunization, edition date printed on the appropriate VIS, and date the VIS was given to the Immunization Recipient or the Immunization Recipient's legally authorized representative; and (3) Any other information as determined by the Department.

222.105 Duty to Inform

222.105: Duty to Inform (A) Health care providers shall explain to Immunization Recipients, or the Immunization Recipient's legally authorized representative, the MIIS reporting procedures and requirements for immunization information for all Immunization Recipients to the MIIS, including the right to object to data sharing, as described in 105 CMR 222.105(B). (B) Objection to or Withdrawal of Objection to Data Sharing Procedures. 8/16/24 105 CMR - 1202.2

105 CMR: DEPARTMENT OF PUBLIC HEALTH

222.105 continued

222.105: continued (1) If an Immunization Recipient, or the Immunization Recipient's legally authorized representative, chooses to object to data sharing (or, in the alternative, to withdraw a previously filed objection to data sharing) in the MIIS, the individual must complete the appropriate form designated by the Department and submit it either to the Immunization Recipient's health care provider or directly to the Department. (2) If a form as described in 105 CMR 222.105(B)(1) is received directly by a health care provider, the health care provider must return the form to the Department within 24 hours of receipt, in a manner determined by the Department. Health care providers must also change the data sharing status of the Immunization Recipient in the GUI in order to ensure the objection or withdrawal of objection is implemented within the MIIS. (3) The records of an Immunization Recipient whose data sharing is changed from "Yes" or "Unknown" to "No" will be accessible in the MIIS only by the MIIS site that entered the immunization information and the Department. (4) An Immunization Recipient who has objected to data sharing, but whose name is not yet in the MIIS, will be added to the system and will have data sharing status set to "No" by the Department.

222.200 MIIS Site and MIIS User Registration

222.200: MIIS Site and MIIS User Registration (A) Authorized Recipients that wish to become MIIS sites shall register with the Department and agree to comply with all terms and conditions of registration developed and set forth by the Department, which may include, but not be limited to, site and confidentiality agreements. MIIS sites must be registered prior to registering individual MIIS users at their site in the MIIS. (B) Authorized Recipients that wish to become MIIS users shall register with the Department and agree to comply with all terms and conditions of registration developed and set forth by the Department, which may include, but not be limited to, user and confidentiality agreements. (C) MIIS sites and MIIS users registered in accordance with 105 CMR 222.200 and approved by the Department to access the MIIS shall be considered to have been designated by the Department to access only that immunization information and for those purposes described in M.G.L. c. 111, § 24M and 105 CMR 222.205. Revocation of MIIS access privileges in accordance with 105 CMR 222.200(D) shall terminate such designation for the period of revocation. (D) The Department may revoke MIIS access privileges from MIIS sites and or MIIS users for just cause. Just cause shall include the failure to comply with the terms detailed in 105 CMR 222.000. An MIIS site or MIIS user may contest the revocation of access privileges, in writing, and request further review.

222.205 System Access and Confidentiality

222.205: System Access and Confidentiality (A) The following individuals and agencies are Authorized Recipients: (1) Health care providers and their staff providing direct care to the individual patient; (2) Elementary and secondary school nurses and registration officials who require proof of immunization for school enrollment and disease control; (3) Local boards of health for disease prevention and control; (4) Women Infants and Children (WIC) nutrition program staff who administer WIC benefits to eligible infants and children; (5) Staff of state agencies or state programs whose duties include education and outreach related to the improvement of immunization coverage rates among their clients; and (6) Health plans for immunization rate improvement and quality improvement efforts. (B) Authorized Recipients, MIIS sites, and MIIS users may receive and have access to immunization information solely for the purposes delineated in M.G.L. c. 111, § 24M and 105 CMR 222.205(A). (C) Access by department staff . Designated Department staff may have access to immunization information for any purpose authorized by law. 8/16/24 105 CMR - 1203

105 CMR: DEPARTMENT OF PUBLIC HEALTH

222.205 continued

222.205: continued (D) Access by researchers. Research requests shall be submitted in writing and follow any applicable procedure pursuant to M.G.L. c. 111, § 24A, including the execution of any agreement deemed by the Department to be necessary and which may include confidentiality and MIIS user agreements. (E) Recipients authorized by 105 CMR 222.205(A)(2) through 105 CMR 222.205(A)(6) who are MIIS sites or MIIS users shall have "view only" and/or report generating privileges only, unless otherwise designated pursuant to 105 CMR 222.205(F). (F) Access by Designated Users . The Department may designate other appropriate MIIS users. Such designation shall specify the terms, limits, and conditions of such access. Users so designated may not access or use immunization information in any manner other than is specified in the Department's designation.

222.206 Protection from Subpoena and Public Record Requests

222.206: Protection from Subpoena and Public Record Requests Information contained in the MIIS does not constitute a public record, is not subject to subpoena or court order, and is not admissible as evidence in any action of any kind before a court, tribunal, agency, board, or person.

222.300 Requests to Amend Records and Access Records by Individuals

222.300: Requests to Amend Records and Access Records by Individuals (A) A health care provider may update MIIS Information upon the Immunization Recipient's or, as applicable, Immunization Recipient's legally authorized representative's request. (B) Requests for record amendments may also be made directly to the Department in writing in a form and manner determined by the Department. (C) An Immunization Recipient, or as applicable, an Immunization Recipient's legally authorized representative, may request copies of the Immunization Recipient's records from the Immunization Recipient's health care provider. The health care provider fulfilling the request shall validate the identity of the individual receiving the record in a manner consistent with the disclosure of medical records and M.G.L. c. 111, § 24M and 105 CMR 222.000. Requests may also be made directly to the Department in writing in a form and manner determined by the Department. (D) Individuals may access MIIS Information they are legally entitled to access through a form and manner specified by the Department.

222.305 Requests for List of Those Who Have Accessed Records

222.305: Requests for List of Those Who Have Accessed Records Requests for a record of all MIIS users that have accessed an individual's immunization information shall be made in writing in a form and manner determined by the Department.

222.410 Collaborative Agreements with Registries in Other States

222.410: Collaborative Agreements with Registries in Other States The Department may enter into agreements with other states to facilitate the exchange of immunization information, provided that such agreements protect the confidentiality of the immunization information under the applicable state law. REGULATORY AUTHORITY 105 CMR 222.000: M.G.L. c. 111, §§ 3 and 24M. 8/16/24 105 CMR - 1204