Title of Regulation: 12VAC5-115. Virginia Immunization Information System (adding 12VAC5-115-10 through 12VAC5-115-80).

Statutory Authority: § 32.1-46.01 of the Code of Virginia.

Public Hearing Information: No public hearings are scheduled.

Public Comment Deadline: January 18, 2013.

Agency Contact: James Farrell, Department of Health, 109 Governor St., Richmond, VA 23219, telephone (804) 864-8055, or email james.farrell@vdh.virginia.gov.

Basis: Section 32.1-46.01 of the Code of Virginia requires the Board of Health to establish the Virginia Immunization Information System (VIIS), a statewide immunization registry that consolidates patient immunization histories from birth to death into a complete, accurate, and definitive record that may be made available to participating health care providers throughout Virginia, to the extent funds are appropriated by the General Assembly or otherwise made available. Section 32.1-46.01 of the Code of Virginia further requires the Board of Health to promulgate regulations to implement the VIIS.

Purpose: Chapters 643 and 684 of the 2005 Acts of Assembly established the VIIS, a statewide immunization information system that contains birth-to-death immunization histories of participating clients and merges this data from all healthcare providers for that patient into one record. This consolidated record, which is available to participating health care providers in Virginia, will help providers identify appropriate immunizations to give their patients. It will help to increase immunization rates and protect the public health of all citizens of Virginia in the following ways: (i) ensure that children receive vaccines appropriately, as currently recommended by the Advisory Committee on Immunization Practices; (ii) prevent the under-immunization and over-immunization of children; (iii) generate parental reminders, recall notices, and manufacturer recalls; (iv) produce immunization coverage reports; (v) identify areas of under-immunized populations for educational purposes and other immunization rate improvement activities; and (vi) provide, in the event of a public health emergency, a mechanism for tracking the distribution and administration of immunizations, immune globulins, or other preventive medications or emergency treatments.

Substance: Regulations for VIIS cover five main areas: (i) authorized participants of VIIS and their registration procedure; (ii) data entry by participants either through user interface or data exchange; (iii) requirements for patient confidentiality and system security; (iv) approved and nonapproved use of VIIS data; and (v) use of VIIS in a public health emergency.

Issues: VIIS regulations will pose no disadvantage to the public or the Commonwealth. Many advantages will occur for both the general public and to the Commonwealth. An accurate patient immunization record allows health care providers to diagnose vaccine preventable diseases more effectively and to recommend immunizations that ensure patients receive all the age-appropriate vaccines recommended by ACIP. Accurate immunization information also decreases costs by preventing unnecessary duplicated immunizations, reminding clients of vaccines that are due or were recalled by the manufacturer, and identifying areas of need for increased education and other activities that may lead to improved immunization coverage rates.

There are also benefits to parents or guardians, which include the following:

1. Removes the need to provide their child's immunization record to the healthcare provider(s);

2. Prevents additional visits to the child's provider(s) by identifying all age-appropriate immunizations that may be given during the current visit;

3. Provides emergency department ability to assess the child's immunization status at the time of an injury;

4. Provides information needed to create reminder/recall notices for recommended immunizations that are due or overdue;

5. Simplifies the process for obtaining the child's immunization history for admission to schools, daycares, camps, etc.;

6. Enables identification of and recall notification to the child who received a vaccine that was later recalled or did not receive a recommended vaccine due to short supply;

7. Guarantees lifetime access to the clients immunization history even if the health care providers office is no longer in operation.

Department of Planning and Budget's Economic Impact Analysis:

Summary of the Proposed Amendments to Regulation. Pursuant to Section 32.1-46.01 of the Code of Virginia, the Board of Health proposes to establish regulations for the Virginia Immunization Information System.

Result of Analysis. The benefits likely exceed the costs for all proposed changes.

Estimated Economic Impact. SB 1132 and HB 2519 passed by the 2005 General Assembly mandated the Board of Health to establish the Virginia Immunization Information System (VIIS). A pilot system was initiated in 2006 and the VIIS became fully operational in 2009. Participation in VIIS is voluntary. Participants enter immunization histories of their clients into the system and share the information on consenting individuals with other healthcare providers or users. Even though VIIS is statewide, it is capable of interacting with immunization systems of other states.¹ In other words, it makes it possible to access immunization records nationwide. The web based information system is developed and provided by the federal government free of charge. The federal government also pays for the operation of the system. Thus, all the start up costs as well as operating costs of VIIS is paid 100% by federal funds.

This analysis heavily borrows from a document titled "VIIS Economic Impact" which is authored by the Virginia Department of Health (VDH) to identify the costs and the benefits of VIIS. According to VDH, annual operation costs of VIIS are approximately $2.3 million per year. These costs include management of the system by an outside vendor; salaries of state employees necessary for program management, including the planning and performing of daily operations as well as quality assurance and improvement activities, and recruitment, training and monitoring of participants; supplies; hardware upgrades for the application's successful operation; and travel expenses for continuing education of staff and for necessary visits to the participant's offices.

Note that none of these costs are borne by the Commonwealth. Thus, the federal funds spent on VIIS represent a net economic gain for Virginia. The influx of these federal funds is expected to have an expansionary economic impact on the Commonwealth's economy by creating additional employment and additional demand for goods and services.

Participation in VIIS has some cost implications for the users. If an election to participate is made, the costs incurred by the users include a computer with internet access; staff time to complete registration and security forms for participation; training and customizing the application for their facility; adding users within their facility; and if they elect to do so, staff time for entering the previous immunization history of their clients. The web based application is available to the users free of charge. After VIIS access is granted to the provider, the staff must enter inventory into the system and when giving an immunization, register the client (if the client does not already exist in the system) and enter their immunization data. VDH estimates that although there is some initial setup staff time involved, the immunization information system will eventually save the practice time. According to VDH, other states using an immunization information system have seen that the users find it to be more efficient and cost-saving because their billing systems are improved and inventory is better managed. Also, participation may make users eligible for federal grants.²

VDH reports that the annual cost per child of using immunization registries varies according to the differences in study methods and the size of the patient population. A study of 16 immunization registries in the United States in 1997 estimated the average cost per child was $3.91 per year.³ This was similar to a Center for Disease Control (CDC) study from 1998 of three registries that estimated the cost per child was $3.38 to $6.15/year. Additionally CDC conducted another survey of 24 registries in 1999 with an estimate of $5.18 per child per year.⁴ However, it is worth noting that since the program is voluntary, by participating the users reveal that the expected benefits to them are greater than the expected costs.

The potential benefits of VIIS include following:

Providing accurate immunization records. According to VDH, national studies by CDC have indicated that participation in an immunization information system can provide a net benefit by improving the efficiency of the immunization delivery process. In the absence of an information system, when a child receives an immunization, the provider updates the information on an immunization card that is presented to the child's parent/guardian. Often this card is lost, forgotten or not kept up to date. Without official documentation, physicians are required to vaccinate children with the age-appropriate immunizations to assure that they are protected against disease. Thus, accurate immunization records help prevent under and over immunization of children. Also, an additional benefit would be that hospital emergency room patients would be able to quickly identify the vaccination status of the emergency patient and decide whether a vaccine dose is needed.

Identifying age-appropriate vaccines for specific client. Prior to VIIS, providers did not have a consistent method for accurately assessing their clients for age-appropriate vaccines recommended by Advisory Committee on Immunization Practices (ACIP). The childhood schedule for age-appropriate vaccines has become more complicated as additional vaccines are added to these recommendations each year. Most providers do not have time to learn all of the vaccines and their recommendations. Currently, 16 to 20 vaccine doses are recommended before a child is 18 months of age. There is an ACIP tracking schedule within VIIS that identifies the age-appropriate vaccines to give to the client at each visit. VIIS takes the date of birth for the specific client and looks at what the client has already received and lists what vaccines are recommended at the current visit and in the future. VIIS has the ability to remind or recall children who are due or overdue for vaccines.

Identifying and contacting recipients of recalled vaccines or vaccine shortages. In VIIS, patients can be identified and recalled for vaccines they received that are later recalled by a manufacturer (due to contamination, decreased potency, etc.) or, persons whose immunization was deferred due to vaccine shortages that has now been resolved.

Improving inventory management. VIIS has an inventory module which streamlines vaccine management and improves accountability of both public and private vaccine. The application displays expiring vaccine lots, preventing vaccine waste by allowing for transfer of these lots to other clinics that can use them. It also encourages the provider to order vaccine doses in quantities based on their real need, and therefore reducing vaccine wastage.

Identifying pockets of need. VIIS can also be used to compute immunization rates and identify pockets of need in the state, allowing identification of high-risk groups for targeted outreach. The application is capable of assessing specific vaccine and producing reports that monitor new vaccine uptake.

Use in a public health emergency. VIIS is already being used to record H1N1 influenza vaccine given in the state of Virginia. The application is capable of posting messages or alerts on the main page for all users to view. It also can be used to link to other states immunization information systems to find immunization records.

Providing official immunization records for parents/guardians. For enrollment in camps, daycares, schools, colleges, employment in the health care field, and other circumstances, it is necessary to present an official immunization record. VIIS can provide these reports to parents and guardians.

Adding to the use of health information technology. According to VDH, much attention in health care has been devoted to the development and use of an electronic health records (EHR); however this process has been slow in its development. Many of the modules that are included in an EHR are stand-alone systems such as laboratory, scheduling, transcription and immunization registries. They all need to be integrated into one system to improve the quality and efficiency of health care.⁵ An IIS has been described as the first step in creating such systems.⁶ VIIS plays an important role in advancing the development of health information technology.

Improving immunization rates. The ultimate goal of VIIS is to improve the immunization rates in all citizens of Virginia. Reports vary about whether an immunization information system does improve immunization rates nationally.⁷ However, many studies indicate an improvement in immunization rates, comprehensive care and accuracy of data. Oregon improved its coverage rates from 32% to 36% as a result of having more accurate, up-to-date immunization data, Minnesota from 88.2% to 95.7% within one year of implementation of its immunization information system and Arizona from 45% to 90% through a combination of better records and additional immunizations.^{8 9}

Estimated direct savings to the Commonwealth by changing existing programs. Currently, five million Virginians are enrolled in VIIS and 4 million of these have at least one immunization recorded as of January 5, 2010 (as of September 27, 2010, 4.6 million Virginians have at least one immunization of the 30 million immunizations in VIIS). Once VIIS is fully populated with both demographic and immunization data from the users or data exchange, there would be significant savings due to changes for many existing state programs. These savings are discussed below:

Eliminating duplicate Hep B doses. By having a complete immunization record from multiple providers, duplicate immunizations can be eliminated or greatly reduced. Every year, approximately 100,000 children are born in Virginia and are given the Hepatitis B vaccine. This vaccine is a 3-dose series, but often because of poor documentation, a child receives an extra dose. The federal contract cost of Hep B is $9.75. Using a conservative rate of 10% of children receiving an extra dose, the cost savings achieved by eliminating this extra dose is $97,500.

Eliminating duplicate vaccines. A 2000 study by Feikema et al¹⁰ reported that up to 21% of all children received at least one extra immunization before their third birthday. An unpublished study by CDC¹¹, performed from 2000-2006, found the rate in children to be about 10%. Although there are no studies documenting the number of duplicates in adolescents, a similar rate of 10% is assumed. Based on the assumed 10% extra immunization rate and according to a 2009 report from webVISION, the VDH information system, the annual cost of 8 vaccines¹² given by VDH at the federal contract prices is estimated to be $585,920.

Vaccine audits of public vaccine inventory. The federal granting agency (CDC) mandates that each state conduct accountability audits of vaccine usage. Currently each user must submit manual reports of their vaccine inventory on a periodic basis. Then the state staff must aggregate the reports manually to account for public vaccine. VIIS will automatically calculate and produce this report on a provider level and the staff will be capable of exporting the information into a spreadsheet for further analysis. A 2007 study performed by the CDC¹³ at the Utah Department of Health found that the median cost savings to the state health department to process these reports could be as much as $11,740 annually. Utah has 72 practices using public vaccine. The Virginia has 900 practices or 12.5 times that of Utah. Having this aggregate report automated represents a cost savings of $146,750.

Automatic reporting of spoilage, mishandling or waste of public vaccine. In addition, providers using public vaccine prepare manual accountability reports of their vaccine wastage, spoilage and mishandling. This information is then entered into a worksheet to produce aggregate numbers for the state. With VIIS, information for each participant can be assessed from the application. Approximately 1,140 hours of staff time per year valued at $22,500 is estimated to be saved statewide.

Reducing orders of public vaccine by VDH. Through VIIS, providers could more accurately determine the doses of public vaccine that are needed in their practice by viewing what they have used in the past. This greater efficiency reduces wastage of public vaccine and eliminates any unnecessary orders by the staff to the national vaccine distribution center. In 2008, there were 167 orders per week. Assuming that the reduction is 10%, 17 orders/week, or 884 orders/year could be eliminated. It takes approximately 15 minutes to process an order. Using a rate of $20/hour for staff, $5 is saved for each order that is eliminated at a total cost savings of $4,420.

Providing immunization assessment reports to participants. Currently the staff must perform manual assessments of the immunization coverage levels of their participants. This requires a visit to the practice or health department, pulling medical records, entering the immunization information onto their laptop, and re-filing the charts. During 2008, there were 360 assessment visits performed. VIIS is capable of producing assessment reports for each provider. By doing this, not only is travel sometimes eliminated (if this is the only purpose of the visit), but approximately 2 to 3 hours of work per visit will be prevented. At a rate of $20/hour, the cost savings is 720 hours or $14,400.

Savings in annual state immunization rate assessment survey. VDH performs an annual assessment of the immunization rates of children entering kindergarten (KG). Currently, VDH randomly selects schools with KGs from lists provided by Department of Education and Virginia Council of Private Education. VDH then notifies the selected schools and their corresponding health districts. The immunization nurse from the local health department contacts the assigned school and schedules a time to select immunization records of 25 students. The immunizations of these children are then entered using a laptop computer and the records are re-filed. In Virginia, there are 1,142 public and 334 private schools that have kindergartens for a total of 98,139 students. The current sample size is 4,500 children, which represents only 5% of children entering school. VIIS will compute the immunization rate for all VIIS clients entering kindergarten (children who are 56-64 months of age).

Legislation also requires that all persons entering the 6^th grade have received a dose of TDaP (if it has been over 5 years since the last dose of tetanus-containing vaccine). This immunization assessment is also part of the Annual Survey by VDH. The same procedure is followed as was used for the KGs.

It is estimated that VIIS will reduce approximately 1,560 hours of staff time per year saving VDH approximately $41,000 annually. In addition, VIIF is expected to greatly increase the accuracy of the KG survey by enlarging the sample size.

Contacting previous providers for immunization records by VDH staff. Currently webVISION¹⁴, allows for the entry of both active vaccines given to a client at VDH and historical vaccines received in the past, and listed on an immunization shot record. Often the parent has lost the record or does not bring it to VDH, and the VDH staff must contact the private providers for additional vaccine history. In 2007, VDH conducted a survey of each local health district and learned that on the average, it spent 30 minutes contacting a past provider. In 2008, there were 81,159 unduplicated clients less than 19 years of age who received immunization services.¹⁵ Assuming that the hourly rate of the immunization nurse is $25/hour, it costs $12.50 per incomplete record. Also assuming that 5% or 4,058 clients have incomplete immunization records requiring the nurse to contact the past provider, the cost savings in using VIIS (which provides complete immunization information from both the private and public health sectors) is $50,724.

Generating recall list. One of the most important public health functions at VDH is the ability to generate a Recall List to identify children who are due for immunizations or are not up-to-date with their age-appropriate immunizations. This allows the health department to notify the parents of these children to make an appointment to receive the necessary vaccines.

A 2002 study from Boston found that performing this task manually cost $7,520 for 5,333 children seen at 13 sites within the city and approximated that three minutes of staff time were necessary to identify children who were not up-to-date. In contrast, they found that their immunization information system could generate this list of all children who were not up-to-date at a cost of only $0.49. Historically at VDH, 40% of clients are not up-to-date and need to be recalled to receive vaccines. Again using the webVISION count of 81,159 unduplicated clients less than 19 years of age seen at VDH, 32,464 children needed to be recalled. This represents 3 minutes of staff time per child or approximately 2000 hours total. Using $25/hr. for staff, this is a cost savings of $40,580.

Elimination of vaccine waste. In 2008, the expired vaccine returned by the local Health Departments was valued at $57,889.53.¹⁶ Although all of this wasted vaccine could not be eliminated by using VIIS for vaccine management, perhaps 50% could be transferred to other health districts to avoid wastage. Therefore, the cost savings to the state would be approximately $28,945. This figure does not include the shipping and handling cost for returning the vaccine.

Assessing immunization records of children entering public kindergarten. Currently, the Department of Education assesses the immunization status of all children entering kindergarten in the state (89,930 children in 2009). A study by All Kids Count¹⁷ found that it costs approximately $14.50 for every record that is manually retrieved, reviewed, and re-filed and other studies show that it costs from $6 to almost $19 to manually pull a patient chart for review.¹⁸ This represents a cost of $1,303,985. Another study by McKenna⁶ found this cost to be $14.70 or an additional $17,986 to the state cost. Assessing an electronic record in VIIS takes seconds and the application prints out missing immunizations for that specific client at a cost of $0.49 according to her study. Although no figures have been reported dealing with the savings at the state level, it is estimated by CDC that $58 million would be saved on the national level by eliminating the manual pulling of records for all children entering kindergarten.¹⁹ A 1999 study in Wisconsin²⁰ documented that 95 hours were spent by a county school system generating non-compliance letters to parents before the use of the IIS. In the fall of 2000 the schools linked to the local immunization registry, and reduced the 95 hour task to one hour. This reduction in staff time would represent an additional savings to the state.

Functionality in public health emergency. An article following Hurricane Katrina reported the successful use of two immunization information systems during a public health emergency.²¹ Shortly after Katrina, the Houston-Harris County information system and the Louisiana information system were connected to look for missing immunization records for children in those areas. The linking of these two information system applications allowed for 18,900 immunization records to be found, representing an estimated cost savings of more than $1.6 million for vaccine alone and $3 million for vaccine plus administration fees. A CDC assessment of more than 21,000 records found, estimated that more than $4.6 million was saved in revaccination expenses.²²

Businesses and Entities Affected. The users of VIIS include approximately 4,500 doctors within 1,700 sites that may be large or small medical practices, 200 Community Health Centers, Rural Health Clinics, and Federally Qualified Health Clinics, 5 mobile vans, 135 local health departments and clinics, 200 hospitals, 1,000 pharmacies providing immunizations, 4,000 schools, colleges, and universities, and 100 health care plans. Also, approximately 5 million Virginians are enrolled in VIIF.

Localities Particularly Affected. The proposed regulations apply throughout the Commonwealth.

Projected Impact on Employment. The operation and maintenance of VIIS is accomplished by three employees employed by a private contractor and 8.5 full time equivalent positions at VDH. Thus, VIIS raised the demand for labor in the Commonwealth. However, it is also estimated that VIIS has provided its users and VDH some staff time savings offsetting some of the increase in the demand for labor elsewhere.

Effects on the Use and Value of Private Property. VIIS is not anticipated to have a direct impact on the use and value of private property. However, it is expected to provide its users some savings and create additional demand for hardware, software, and supplies. The anticipated savings and demand for goods and services are expected to add to the asset values of private users and suppliers of goods and services.

Small Businesses: Costs and Other Effects. Of the affected entities, most of the doctors offices, private clinics, and pharmacies are believed to be small businesses. The costs and other effects of VIIS on small businesses are the same as the ones discussed above for all users. Since participation is voluntary, the costs and other effects may be avoided if desired.

Small Businesses: Alternative Method that Minimizes Adverse Impact. There is no alternative method that minimizes adverse impact on small businesses while accomplishing the same goals. Since participation is voluntary, the costs and other effects may be avoided if desired.

Real Estate Development Costs. No real estate development costs are expected.

Legal Mandate. The Department of Planning and Budget (DPB) has analyzed the economic impact of this proposed regulation in accordance with § 2.2-4007.04 of the Administrative Process Act and Executive Order Number 107 (09). Section 2.2-4007.04 requires that such economic impact analyses include, but need not be limited to, the projected number of businesses or other entities to whom the regulation would apply, the identity of any localities and types of businesses or other entities particularly affected, the projected number of persons and employment positions to be affected, the projected costs to affected businesses or entities to implement or comply with the regulation, and the impact on the use and value of private property. Further, if the proposed regulation has adverse effect on small businesses, § 2.2-4007.04 requires that such economic impact analyses include (i) an identification and estimate of the number of small businesses subject to the regulation; (ii) the projected reporting, recordkeeping, and other administrative costs required for small businesses to comply with the regulation, including the type of professional skills necessary for preparing required reports and other documents; (iii) a statement of the probable effect of the regulation on affected small businesses; and (iv) a description of any less intrusive or less costly alternative methods of achieving the purpose of the regulation. The analysis presented above represents DPB's best estimate of these economic impacts.

_______________________________________________

¹ According to VDH, 25 states are using the same system used in Virginia, and all of the remaining states have some type of immunization information system in place.

² VDH believes that physician offices participating are eligible to receive up to $120,000 in federal grants.

³ Horne PR, Saarlas KN, Hinman AR. Costs of immunization registries: experiences from the All Kids Count II projects. Am J Prev Med 2000; 19:94-8.

⁴ Horne PR et al. An All Kids Count cost study on immunization registries. Paper presented at the All Kids Count Immunization Registry Conference; 1999 Apr 27-29; St. Paul, MN.

⁵ Fairbrother G et al. It is Time! Accelerating the use of child health information systems to improve child health. Pediatrics. January 2009; 123 (2): S61-S63.

⁶ Linkins RW. Immunization Registries: Progress and Challenges in Reaching the 2010 National Objective. J Public Health Management Practice. 2001; 7 (6): 67-74.

⁷ Committee on Practice and Ambulatory Medicine Policy Statement: Immunization Information Systems. Pediatrics. September 2006; 118 (3): 1293-1294.

⁸ National Vaccine Advisory Committee. Immunization Registries Progress Report. December 4, 2000. Washington, DC; 1-11.

⁹ All Kids Count, Immunization Registries: Improving Health and Health Care, Internet Data.

¹⁰ Feikema SM et al. Extra immunization among US children. JAMA. 2000; 283:1311-1317.

¹¹ Urquhart G, CDC/CCIS/NCIRD. Personal communication.

¹² These vaccines are Hepatitis B, MCV4, MMR, Pneumococcus, TdaP, Td, Varicella, and HPV.

¹³ Bartlett DL et al. Cost Savings Associated with Using Immunization Information Systems for Vaccines for Children Administrative Tasks. J Public Health Management Practice. Nov-Dec 2007; 13(6): 559-66.

¹⁴ WebVISION immunization data is uploaded into VIIS from VDH Public Health Information System.

¹⁵ WebVISION data from 2007, VDH Public Health Information System.

¹⁶ VDH Communication with Virginia Vaccine For Children program manager.

¹⁷ All Kids Count Newsletter. Focus on Immunization Registries, Winter 2000.

¹⁸ All Kids Count: Registries Save Time and Money.

¹⁹ Horne PR et al. Update on Immunization Registries. Amer J Prev Med. 2001; 20:174.

²⁰ June 2006 Newsletter of the National Association of School Nurses.

²¹ Boom JA et al. The Success of an Immunization Information System in the Wake of Hurricane Katrina. Pediatrics. 2007; 19 (6): 1213-1217.

²² Urquhart G. Current Status of Immunization Information Systems in the U.S. Presentation at CDC Immunization Program Managers Meeting, November 2008; New Orleans, LA.

Agency's Response to Economic Impact Analysis: The agency concurs with the results of the Department of Planning and Budget's economic analysis of the Virginia Immunization Information System (12VAC5-115).

Summary:

The proposed regulations implement the Virginia Immunization Information System (VIIS). VIIS is a voluntary, statewide immunization registry that consolidates patient immunization histories from birth to death into a complete, accurate, and definitive record that is available to Virginia's participating health care providers. The proposed regulations (i) define who is allowed access to VIIS; (ii) specify access requirement; (iii) ensure compatibility with current state and federal guidelines in the areas of patient data confidentiality and system security; (iv) address the security features of the application; (v) define the data to be collected; (vi) state the mechanisms for populating and capturing data; (vii) define the approved use of data, the authorized recipients, and the procedure for obtaining the data; and (viii) address the use of VIIS in a public health emergency.

CHAPTER 115
VIRGINIA IMMUNIZATION INFORMATION SYSTEM

12VAC5-115-10. Definitions.

The following words and terms when used in this chapter shall have the following meanings unless the context clearly indicates otherwise:

"Commissioner" means the State Health Commissioner or his designee.

"Data exchange" means electronically sending immunization information from an existing information system to VIIS and being able to retrieve information from VIIS.

"De-duplication" means the process in information systems that matches incoming data with existing client records and merges those identified as the same client.

"Health care entity" means any health care provider, health plan, or health care clearinghouse.

"Health care provider" means those entities listed in § 8.01-581.1 of the Code of Virginia, except that state-operated facilities shall also be considered health care providers for the purposes of this section. Health care provider shall also include all persons who are licensed, certified, registered, or permitted or who hold a multistate licensure privilege issued by any of the health regulatory boards within the Department of Health Professions, except persons regulated by the Board of Funeral Directors and Embalmers or the Board of Veterinary Medicine.

"Health plan" means an individual or group plan that provides or pays the cost of medical care and shall include any entity included in such definition as set out in 45 CFR 160.103.

"Participant" means a person or organization with a VIIS account.

"Patient" means the client who is receiving health services or his parent or guardian.

"Public health emergency" means any (i) public health event caused by an act of bio-terrorism or vaccine-preventable disease outbreak or (ii) other public health event resulting from natural or human cause.

"Security role" means the level of security assigned to a participant that determines what information the individual may access in the application and what system functions may be performed.

"VDH" or "Department of Health" means the Division of Immunization within the Virginia Department of Health.

"Virginia Immunization Information System" or "VIIS" means the statewide immunization registry.

"VITA" means the Virginia Information Technologies Agency.

12VAC5-115-20. Authorized participants.

A. Health care providers, including but not necessarily limited to any physician, physician assistant, nurse practitioner, registered nurse, school nurse, pharmacist, or any entity listed in the definition of "health care provider" in § 8.01-581.1 of the Code of Virginia, are authorized to participate in VIIS.

B. Any health care entity may participate as long as it is licensed or certified in Virginia to deliver or support health care services or public health, requires immunization data to perform the health service function, and uses VIIS only for exchanging information on persons for whom it provides services.

C. Other state or regional immunization registries may exchange data with VIIS. They may share data and have access to data by contacting the VIIS program manager and complying with the registration procedure discussed in 12VAC5-115-30.

D. VDH shall give access to VIIS under the condition that having access to immunization information is required to perform the job function of the participant. The VIIS program manager or designee shall assign the security role of the participant based on his needs and job responsibilities.

E. Access to VIIS requires only Internet access and is free to participants.

12VAC5-115-30. Registration procedures.

A. Participation in VIIS is voluntary.

B. Completed registration forms from authorized participants must be processed and approved by VDH before access to the system is allowed. Registration will require the participant to assure compliance with necessary confidentiality and security access provisions that specify security procedures to ensure that VIIS data are protected from unauthorized view and access. The participant shall update and submit the forms to VDH every year.

C. Once the participant is approved, VDH will provide training and activate the participant in the VIIS system.

D. Qualifying participant organizations shall designate an administrator for their organization. The administrator may then allow VIIS access by an employee in his organization and, in doing so, shall assume responsibility for registering that person, obtaining the most recent security forms that specify VITA or VDH security requirements, retaining all completed user forms, assigning the security role of the user, accepting legal responsibility for his proper use of VIIS, and terminating access to VIIS if the employee is noncompliant with VIIS requirements or no longer requires access.

E. An administrator may terminate his organization's participation at any time by notifying VDH in writing. All data entered by that organization shall remain in the system.

12VAC5-115-40. Patient confidentiality.

A. Access to VIIS information is authorized only under the condition that access to individual immunization information is required to perform the participant's job function.

B. Participants shall not conduct any activity that jeopardizes the proper function or security of VIIS. They shall use patient data only as authorized by law and this chapter and must immediately notify the patient and VDH of any breach of personal privacy or confidentiality.

C. Patients shall have the opportunity to opt-out of VIIS by doing one of the following:

1. Contacting their healthcare provider to allow the viewing of their immunizations only by that provider who administered them; or

2. Contacting VDH in writing requesting to be taken out of VIIS and have their record no longer viewable.

D. Patient immunization records shall not be copied except for authorized use. These copies shall not be left where they are visible by unauthorized personnel and shall be shredded before disposal.

E. VIIS records shall be treated with the same confidentiality and privacy as any other patient record. Any inappropriate use of VIIS records shall result in immediate suspension of participant privileges and an investigation conducted by VDH. Additional actions may be taken pursuant to § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges.

F. Nothing in this chapter alters the provision in 45 CFR Part 164 that permits covered healthcare entities to disclose protected health information to a public health authority without individual authorization.

12VAC5-115-50. Security.

A. After VDH gives access to a VIIS participant, a secure connection is established between his browser and VIIS. The system is password protected.

B. Participants must ensure that employees with authorized access do not disclose their user identification code or password to anyone, have physical security and password-enabled screen savers on computers accessing VIIS, make every effort to protect VIIS screens from unauthorized view, and log off the system whenever leaving the VIIS workstation.

C. The VIIS system, which is maintained on a secure website, automatically inactivates a user session after a predetermined period of inactivity. The inactivation period is determined by VITA security policy.

D. The VIIS system inactivates user accounts, denying access to the system when participants have not logged into the system after a predetermined period of time. This inactivation period is determined by VITA security policy. The administrator must reactivate the account.

E. There shall be a secure encrypted connection between VIIS and the participating organization sending or receiving data if data exchange is performed. The encryption process will be determined by VITA or VDH or both.

12VAC5-115-60. Population of VIIS.

A. The VDH Divisions of Immunization and Vital Records have an agreement to populate demographic information in VIIS with birth certificate data. Death certificate data are used to make the VIIS record no longer viewable. Data exchange shall be performed on a periodic basis, but at least monthly.

B. Each participant shall make every effort to ensure the accuracy of all immunization and demographic information and shall include enough identifying information to allow for de-duplication of clients.

C. Data shall be reported in VIIS either by online data entry or by data exchange of files from other information systems. The health care provider or the designated health plan billed for the immunization shall report. Reporting shall occur within seven days of vaccine administration for online data entry participants. For data exchange participants, reporting shall occur within seven days of receipt of the information.

D. Both demographic and immunization data shall be reported by the participant.

1. Patient demographic information shall include, but is not limited to, patient's name, date of birth, gender, telephone number, home address, birth place, and mother's maiden name. The social security number, if provided, is encrypted by the application, appears as asterisks, and does not print out on reports for that client. The application allows only exact matches when the social security number is used for search purposes.

2. Patient immunization information shall include, but is not limited to, the type of immunization administered using industry standards such as vaccine groups, Health Level 7 codes, or Current Procedural Terminology codes; date the immunization was administered; identity of the health care provider who administered the vaccine; manufacturer; trade name; lot number; and, if present, any contraindications or religious or medical exemptions.

E. Participants in data exchange shall provide an acceptable level of data quality, such as correct data fields, data accuracy, and enough information to correctly merge with existing clients. Upon initial data delivery, and periodically thereafter, data shall be reviewed to determine data quality. Any rejected records shall be resolved by the participant in a timely way. VDH may suspend system privileges and refer to § 32.1-27 of the Code of Virginia for additional action for any organization that submits inaccurate data.

F. If insufficient information is reported to allow de-duplication of clients, incoming data will be placed in a pending file and must be manually merged, if appropriate. All participants shall identify a contact to work with VDH on pending files.

G. VDH shall incorporate immunization data pursuant to subsection E of § 32.1-46 of the Code of Virginia into VIIS by data exchange from other immunization systems, patient care management billing systems, or information systems to the extent possible.

12VAC5-115-70. Release of VIIS data.

A. Specific patient data shall be disclosed to the extent required or permitted by state and federal law or regulations, after contacting VDH who will verify the source of the request.

B. Specific patient data may be disclosed to health care entities to the extent required or permitted by state and federal law or regulations. See § 32.1-127.1:03 of the Code of Virginia.

C. Patient data shall be erased when no longer needed or when the computer is being terminated due to the replacement of the computer or the resignation, retirement, or dismissal of the participant.

D. Aggregate data from which personal identifying data has been removed or redacted may be released for the purposes of statistical analysis, research, or reporting only after approval by VDH.

E. Any inappropriate use of VIIS data shall result in immediate suspension of user privileges and result in an investigation conducted by VDH. Additional actions may be taken in accordance with § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges upon satisfactory completion of required remedial actions and guarantee of proper use of VIIS in the future.

12VAC5-115-80. Data access in public health emergency.

A. In the event of an epidemic or an outbreak of a vaccine-preventable disease or any disease of public health significance or threat, the commissioner may access VIIS in accordance with § 32.1-40 of the Code of Virginia by contacting the Division of Immunization. The commissioner may release VIIS data in accordance with § 32.1-41 of the Code of Virginia.

B. The commissioner may designate additional persons to view VIIS information during a public health emergency. VDH shall contact designated authorized users, provide instruction for those who are not current participants, and activate an account.

C. The commissioner, by notifying the Division of Immunization, may include public health emergency announcements and notices or guidelines on the main screen that may be viewed immediately by the VIIS participants.

FORMS (12VAC5-115)

Administrator Information, VIISADM (eff. 10/12).

Electronic Data Exchange With VIIS (eff. 10/12).

Information Systems Security Access Agreement (eff. 10/12).

Organization Information, VIISORG (eff. 10/12).

VIIS Security Policy and User Confidentiality Agreement.

Memorandum of Agreement between Virginia Department of Health/Division of Immunization (VDH/DOI) and VIIS Organization Interested in Data Exchange (8/11).

Virginia Immunization Information System (VIIS Opt Out-In form).

VIIS User Acknowledgement Page.

VIIS User Signature Page.