88R12223 MPF-F
 
  By: Tinderholt H.B. No. 4730
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to the release or disclosure of vaccination or
  immunization information to certain persons; providing a civil
  penalty.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Subchapter A, Chapter 161, Health and Safety
  Code, is amended by adding Section 161.0093 to read as follows:
         Sec. 161.0093.  PROHIBITED RELEASE OR DISCLOSURE OF
  VACCINATION OR IMMUNIZATION INFORMATION TO CERTAIN PERSONS; CIVIL
  PENALTY. (a) In this section, "health authority" has the meaning
  assigned by Section 81.003.
         (b)  An employee or agent of the department or a health
  authority may not release or otherwise disclose to any person an
  individual's vaccination or immunization information received by
  the department or health authority unless:
               (1)  the department or health authority, as applicable,
  obtains the written or electronic consent of the individual or the
  individual's legally authorized representative;
               (2)  the employee or agent releases or discloses the
  information to a health care provider in accordance with applicable
  state and federal laws relating to the privacy, protection,
  confidentiality, and transmission of health information; or
               (3)  the release or disclosure is otherwise authorized
  by this subchapter.
         (c)  A person who obtains an individual's vaccination or
  immunization information under this subchapter may not release or
  otherwise disclose the information to a third party, including
  under a contract or subcontract, for the purpose of encouraging
  individuals to obtain a vaccine or to provide educational materials
  on a vaccine.
         (d)  A person who releases or discloses vaccination or
  immunization information in violation of Subsection (b) or (c) is
  liable to this state for a civil penalty in an amount of not less
  than $2,000 and not more than $50,000 for each violation. The
  attorney general may bring an action to collect the civil penalty
  imposed under this subsection.
         SECTION 2.  Sections 161.007(a) and (j), Health and Safety
  Code, are amended to read as follows:
         (a)  The department, for the primary purpose of establishing
  and maintaining a single repository of accurate, complete, and
  current immunization records to be used in aiding, coordinating,
  and promoting efficient and cost-effective communicable disease
  prevention and control efforts, shall establish and maintain an
  immunization registry. The executive commissioner by rule shall
  develop guidelines to:
               (1)  protect the confidentiality of patients in
  accordance with Section 159.002, Occupations Code;
               (2)  inform the individual or the individual's legally
  authorized representative about the registry [and that registry
  information may be released under Section 161.00735];
               (3)  require the written or electronic consent of the
  individual or the individual's legally authorized representative
  before any information relating to the individual is included in
  the registry;
               (4)  permit the individual or the individual's legally
  authorized representative to withdraw consent for the individual to
  be included in the registry; and
               (5)  determine the process by which consent is
  verified, including affirmation by a health care provider, birth
  registrar, regional health information exchange, or local
  immunization registry that consent has been obtained.
         (j)  Except as provided by Sections 161.00705, 161.00706,
  [161.00735(b),] and 161.008, information obtained by the
  department for the immunization registry is confidential and may be
  disclosed only with the written or electronic consent of the
  individual or the individual's legally authorized representative.
         SECTION 3.  Section 161.00705(g), Health and Safety Code, is
  amended to read as follows:
         (g)  The immunization information of a child or other
  individual received by the department under this section, including
  individually identifiable information, may be released only:
               (1)  on consent of the individual or, if a child, the
  child's parent, managing conservator, or guardian; or
               (2)  to a [state agency or] health care provider
  consistent with the purposes of this subchapter or the purposes of
  aiding or coordinating communicable disease prevention and control
  efforts during a declared disaster, public health emergency,
  terrorist attack, hostile military or paramilitary action, or
  extraordinary law enforcement emergency.
         SECTION 4.  Sections 161.00706(c) and (d), Health and Safety
  Code, are amended to read as follows:
         (c)  The executive commissioner shall:
               (1)  develop rules to ensure that immunization history
  submitted under Subsection (a)(2) is medically verified
  immunization information;
               (2)  develop guidelines for use by the department in
  informing first responders about the registry [and that registry
  information may be released under Section 161.00735]; and
               (3)  adopt rules necessary for the implementation of
  this section.
         (d)  A [Except as provided by Section 161.00735, a] person's
  immunization history or data received by the department under this
  section may be released only on consent of the person or to any
  health care provider licensed or otherwise authorized to administer
  vaccines.
         SECTION 5.  Section 161.0071(a), Health and Safety Code, is
  amended to read as follows:
         (a)  The first time the department receives registry data for
  an individual for whom the department has received consent to be
  included in the registry, the department shall send notice to the
  individual or the individual's legally authorized representative
  disclosing:
               (1)  that providers and payors may be sending the
  individual's immunization information to the department;
               (2)  the information that is included in the registry;
               (3)  the persons to whom the information may be
  released under Section [Sections 161.00735(b) and] 161.008(d);
               (4)  the purpose and use of the registry;
               (5)  the procedure to exclude an individual from the
  registry; and
               (6)  the procedure to report a violation if an
  individual's information is included in the registry after
  exclusion has been requested or consent has been withdrawn.
         SECTION 6.  Section 161.0073(a), Health and Safety Code, is
  amended to read as follows:
         (a)  Except as provided by Section [Sections] 161.00705 [and
  161.00735], information that individually identifies an individual
  that is received by the department for the immunization registry is
  confidential and may be used by the department for registry
  purposes only.
         SECTION 7.  The heading to Section 161.00735, Health and
  Safety Code, is amended to read as follows:
         Sec. 161.00735.  [RELEASE AND] RECEIPT OF REGISTRY DATA IN
  DISASTER.
         SECTION 8.  Section 161.00735(h), Health and Safety Code, is
  amended to read as follows:
         (h)  The executive commissioner shall make every effort to
  enter into a memorandum of agreement with each state from [to] which
  residents of that [this] state are likely to evacuate to this state
  in a disaster on[:
               [(1)  the release and use of registry information under
  this section to the appropriate health authority or local health
  authority of that state, including the length of time the
  information may be retained by that state; and
               [(2)]  the receipt and use of information submitted by
  the health authority or local health authority of that state for
  inclusion in the registry under this section.
         SECTION 9.  Section 161.0075, Health and Safety Code, is
  amended to read as follows:
         Sec. 161.0075.  IMMUNITY FROM LIABILITY. Except as provided
  by Sections [Section] 161.009 and 161.0093, the following persons
  subject to this subchapter that act in compliance with Sections
  161.007, 161.00705, 161.00706, 161.0071, 161.0073, 161.0074, and
  161.008 are not civilly or criminally liable for furnishing the
  information required under this subchapter:
               (1)  a payor;
               (2)  a health care provider who administers
  immunizations; and
               (3)  an employee of the department.
         SECTION 10.  Section 161.008(d), Health and Safety Code, is
  amended to read as follows:
         (d)  The department may release the data constituting an
  immunization record for the individual to:
               (1)  a health care provider treating the individual or
  an organization to which the individual is a member [any entity that
  is described by Subsection (c)]; or
               (2)  [a school or child care facility in which the
  individual is enrolled;
               [(3)  a state agency having legal custody of the
  individual; or
               [(4)]  an employer of a first responder or a first
  responder in accordance with Section 161.00708.
         SECTION 11.  Section 161.00735(b), Health and Safety Code,
  is repealed.
         SECTION 12.  The changes in law made by this Act apply only
  to the release or disclosure of information on or after the
  effective date of this Act. The release or disclosure of
  information before the effective date of this Act is governed by the
  law in effect when the release or disclosure was made, and the
  former law is continued in effect for that purpose.
         SECTION 13.  This Act takes effect September 1, 2023.