Section 689.10  Definitions

 

"Act" means the Immunization Data Registry Act.

 

"Authorized user" means an individual who has signed an Individual User Agreement and Confidentiality Statement, and to whom the Department has provided credentials authorizing that person access to the Registry.

 

"Consent" means permission and authorization to access, disclose, or allow individual personal information or personal identifiers to be used for vaccine verification purposes.

 

"Department" means the Illinois Department of Public Health or its designated agent.

 

"Designee" means individuals, acting under the authority of a health care provider or another category of authorized user, who have been specifically delegated responsibility to access the Registry and perform functions permitted by the user.

 

"Director" means the Director of the Department or his or her designee.

 

"Health care provider" or "Provider" means any person licensed and authorized to administer or order the administration of any immunization in Illinois.  Health care provider includes the clinics, facilities, hospitals and pharmacies where the licensed health care provider works, as well as Illinois licensed long term care facilities.

 

"Historical record" means a record recorded by a clinic or source other than the provider or an immunization not given from the provider's inventory.

 

"Hospital" means a facility that is licensed under the Hospital Licensing Act.

 

"Immunization" means treatment of an individual with any vaccine or immunologic drug licensed, approved or authorized for use by the United State Food and Drug Administration (FDA), including emergency use authorization (EUA) agents, or meeting World Health Organization (WHO) requirements, designed for the purpose of producing or enhancing an immune response in prevention against a vaccine-preventable disease.

 

"Individual User Agreement" means a signed agreement stating that the Registry user agrees that information that identifies a patient will not be released to any other person without the written consent of the patient. (Section 20(d) of the Act)

 

"Licensed child care center" means a center, private home, or drop-in facility open on a regular basis where children are enrolled for care or education that is licensed by the Illinois Department of Children and Family Services.

 

"Licensed child-placing agency" means a child welfare agency licensed in Illinois by the Department of Children and Family Services and operating in Illinois as an adoption agency or placing agency.

 

"Local health authority" means a local health department that is certified by the Department under the Certified Local Health Department Code, having jurisdiction over a particular area, including city, village, township and county boards of health and health departments and the responsible executive officers of those boards, or any person legally authorized to act for the certified local health department. In areas without a certified local health department, the local health authority shall be the Department.

 

"Locked" means that the individual patient record information is not available to view other than to the original provider or the Department.

 

"Long term care facility" means a location that is licensed under the Nursing Home Care Act, the ID/DD Community Care Act, the Assisted Living and Shared Housing Act, the Community Living Facilities Act, the Specialized Mental Health Rehabilitation Act of 2013, or the MC/DD Act.

 

"Opt out" means that an individual may request the Registry to lock the record so that it is not retrievable by anyone other than the provider site that marked the record as protected.

 

"Opt-Out Form" means the form that the Department provides, which is accessible from the Registry, to health care providers who are authorized to administer immunizations and to individuals who request the form. (Section 15(b) of the Act)

 

"Patient" means an individual for whom an authorized immunization provider submits immunization data to the Registry.

 

"Provider site" means a health care provider, certified local health department, elementary or secondary school, licensed child care center, licensed child-placing agency, college or university to which the Department may release information from the Registry.

 

"Provider site enrollment" means the agreement that is signed by the provider or designee, who assumes responsibility for the proper use and protection of Registry data at the site.

 

"Registry" means the electronic web-based immunization data registry operated by the Department as authorized by the Act.

 

"School" means a State, county, city or special district system under the jurisdiction of the Illinois State Board of Education.

 

"Site manager" means the person at the provider site who assumes responsibility for the proper use and protection of the Registry at the site.

 

"User" means an individual, with approved access to the Registry, who has signed an Individual User Agreement.

 

"Web portal" means a secure website to access Department programs and documentation, in addition to registering for user accounts to access the available program information.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.20  Incorporated and Referenced Materials

 

a)         The following federal statute is referenced in this Part:

 

Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. 1320d-2)

 

b)         The following Illinois statutes are referenced in this Part:

 

1)         Hospital Licensing Act [210 ILCS 85]

 

2)         Immunization Data Registry Act [410 ILCS 527]

 

3)         Nursing Home Care Act [210 ILCS 45]

 

4)         ID/DD Community Care Act [210 ILCS 47]

 

5)         Illinois Health Statistics Act [410 ILCS 520]

 

6)         Medical Studies Act [735 ILCS 5/8-2100]

 

7)         Assisted Living and Shared Housing Act [210 ILCS 9]

 

8)         Community Living Facilities Act [210 ILCS 35]

 

9)         Specialized Mental Health Rehabilitation Act of 2013 [210 ILCS 49]

 

10)        MC/DD Act [210 ILCS 46]

 

c)         The following Illinois administrative rule is referenced in this Part:

 

Certified Local Health Department Code (77 Ill. Adm. Code 600)

 

d)         The following federal regulations are incorporated by reference in this Part:

 

Privacy Rule (Standards for Privacy of Individually Identifiable Health Information) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 CFR 164.512(a) and (k)(6) (October 1, 2007), 45 CFR 164.506 (October 15, 2002) and 45 CFR 164.501 (October 15, 2002)).

 

e)         All incorporations by reference of federal regulations refer to the regulations on the date specified and do not include any later amendments or editions.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.30  Registry Development and Purposes

 

a)         The Department may develop and maintain an immunization data registry to collect, store, analyze, release, and report immunization data.  (Section 10(a) of the Act)

 

b)         The Registry is accessible only to users who have completed a user agreement and are approved by the Department for access.  Enrolled health providers can submit and obtain immunization information for patients, including tracking and recall.  Patient information is confidential and available only to authorized users.

 

c)         Data in the Registry may be used only for the following purposes:

 

1)         To ensure that necessary immunizations are provided and over‑immunization is avoided;

 

2)         To assess immunization coverage rates;

 

3)         To determine areas of under-immunization and other epidemiological research for disease control purposes;

 

4)         To document that required immunizations have been provided as required for school or child care admission;

 

5)         To determine coverage levels for various subpopulations (geographic, racial and ethnic, and age groups) in this State;

 

6)         To accomplish other public health purposes as determined by the Department, including, but not limited to, use of the Registry as a vaccine management system, vaccine tracking system or a vaccine verification system, and the provision of immunization-related announcements, notices and guidelines to Registry users and participants. (Section 10(b) of the Act)

 

d)         The Registry may not be used to obtain information necessary to apply for a birth certificate, locate a child, the solicitation of products or services, or enroll persons in lawsuits.  Authorized users who engage in any prohibited use of the Registry may be denied further access to the Registry, in addition to any other penalties provided by law.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.40  Immunization Data Provided to the Registry

 

a)         Both demographic and immunization data shall be reported by providers participating in the Registry. Providers shall report all data elements for all immunizations administered.  The following are the minimum data elements that shall be reported to the Registry:

 

1)         Patient demographic information shall include, but is not limited to:

 

A)        First and last names, and, if applicable, middle name;

 

B)        Gender;

 

C)        Date of birth;

 

D)        Home mailing address;

 

E)        Telephone number, if available;

 

F)         Race;

 

G)        Ethnicity; and

 

H)        Any additional information as may be determined by the Department. 

 

2)         Patient immunization information shall include, but is not limited to:

 

A)        Name of immunization;

 

B)        Manufacturer of immunization;

 

C)        Lot/serial number of immunization;

 

D)        Type of immunization administered using industry standards such as vaccine groups, Health Level 7 codes, or current procedural terminology codes;

 

E)        Date of administration of immunization;

 

F)         Identity of provider site administering immunization;

 

G)        If applicable, any contraindications or religious or medical exemptions; and

 

H)        Any additional information as may be required by the Department.

 

b)         The current and historical immunization records of all children and adults in Illinois may be included in the Registry without consent.  An individual, parent or legal guardian or custodian may have a record locked from other providers at any time by completing the Opt-Out Form, which shall be maintained at the provider site (see Section 689.80). 

 

c)         All active providers who receive publicly funded vaccine shall use the Registry for submission of their immunization records to the Department.  Failure of providers who receive publicly funded vaccine to use the Registry may result in suspension from participation in the publicly funded vaccine program.  Participation in the Registry by all other authorized immunization providers is voluntary. 

 

d)         Providers shall report all COVID-19 immunizations administered in Illinois to the Registry.  Reporting of all other immunizations by providers is voluntary, except as provided in 689.40(c) for publicly funded vaccine providers.

 

e)         Data shall be provided electronically through the Department's web-based Registry system or through a secure electronic system integrated with the Registry via Health Level 7 (HL7) 2.3.1 format or higher.

 

f)         Users shall provide an acceptable level of data quality, such as correct data fields, data accuracy, and enough information to correctly merge with existing clients.  Data shall be reviewed to determine data quality.  Any rejected records shall be resolved by the user in a timely way.  The Department will suspend system privileges and take any action, as appropriate, including termination for any user that submits inaccurate data.

 

g)         The Department will distribute to health care providers, upon request, written information to be disseminated to patients that describes the Registry. The written information will include a description of the Registry and its purpose, as well as the information concerning the opt-out option (see Section 689.80). (Section 15(c) of the Act)

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.50  Enrollment of Provider Sites

 

a)         As a condition of enrollment in the Registry, the provider site shall enter into and agree to comply with a Provider Site Agreement with the Department and shall agree to:

 

1)         Use the Registry only for the immunization needs of patients, and assure that only the provider or his/her staff will have access to the Registry;

 

2)         Assure adequate immunization;

 

3)         Avoid unnecessary immunizations;

 

4)         Confirm compliance with mandatory immunization requirements;

 

5)         Conduct ongoing or special immunization coverage assessments; and

 

6)         Accomplish other public health purposes as determined by the Department.

 

b)         Each provider site staff member needing access to the Registry shall sign an Individual User Agreement and Confidentiality Statement that shall be kept in the employee's personnel file (see Section 689.60).

 

c)         The provider site shall promptly furnish demographic and immunization information to the Registry about patients receiving       immunizations, striving for submission within one week after immunization administration.

 

d)         In addition to the requirements of subsections (a) through (c), the Provider Site Agreement will include the following provisions:

 

1)         The provider site will abide by the requirements of the Confidentiality Statement (see Section 689.70) and is responsible for assuring that employees comply with confidentiality requirements.

 

2)         The provider site shall supply the name, address and type of health care provider; any additional sites under the same organization; the method of data submission; whether the site is a Vaccine for Children (VFC) provider; contact information; and the signature of the provider or authorized representative.

 

3)         If the Agreement is violated by unauthorized use of the Registry, the Department will terminate access to the Registry.

 

4)         Unauthorized disclosure of confidential information may result in criminal penalties.  A person who knowingly, intentionally, or recklessly discloses confidential information contained in the Registry in violation of the Act and this Part commits a Class A Misdemeanor. (Section 25 of the Act)

 

e)         The Provider Agreement shall be signed by a representative of the health care provider before any training on the use of the Registry and before gaining access to Registry data.

 

f)         Users shall be assigned defined roles:  Key Master, Add/Edit/Delete, Add/Edit, Reports Only, View Only and Offline/Historical.

 

1)         A Key Master can create employee profiles, new clinics, and perform all of the functions listed in this subsection (f).

 

2)         Add/Edit/Delete can add, edit and delete information in the Registry.

 

3)         Add/Edit can only add and edit, but not delete, information in the Registry.

 

4)         Reports Only can only run reports in the Registry.

 

5)         View Only can only view information in the Registry.

 

6)         Offline/Historical is not a Registry user.

 

Section 689.60  Individual User Agreement

 

a)         Each employee of a provider site who needs access to the Registry shall sign an Individual User Agreement, which also includes a confidentiality statement. Patient-specific or provider-specific information is available only to authorized users.

 

b)         Site Managers shall notify the Department within 48 hours after any change in status of any Registry users upon termination of employment or redefining of roles.

 

c)         The Department will revoke the Registry access of a user who misuses information contained in the Registry.

 

d)         Users are responsible for safeguarding their passwords and User IDs and for protecting the security of the computer when a Registry session is open.

 

e)         An authorized user who is a patient or a parent or legal guardian may view the patient’s immunization information without signing a user agreement by requesting the information from the patient’s immunization provider or the Department, or through any public portal or mobile application developed  by the Department.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.70  Confidentiality and Access of Information

 

a)         Records maintained as part of the Registry are confidential. (Section 20(a) of the Act) The Department will maintain the confidentiality of information within the Registry that would identify individual patients.

 

b)         The Department may release an individual's confidential information to the individual or the individual's parent or guardian if the individual is less than 18 years of age. (Section 20(b) of the Act)

 

c)         Subject to subsection (c), the Department may release information in the Registry concerning an individual to the following entities if the entity has a provider site or authorized user agreement with the Department:

 

1)         The immunization data registry of another state;

 

2)         A health care provider or a health care provider's designee;

 

3)         A certified local health department;

 

4)         An elementary or secondary school that is attended by the individual;

 

5)         A licensed child care center in which the individual is enrolled;

 

6)         A licensed child placing agency;

 

7)         A college or university that is attended by the individual;

 

8)         The Department of Healthcare and Family Services or a managed care entity contracted with the Department of Healthcare and Family Services to coordinate the provision of medical care to enrollees of the medical assistance program; (Section 20(c) of the Act);

 

9)         Health insurance plans not under contract with the Department of Healthcare and Family Services to coordinate the provision of medical care to enrollees of the health insurance plan; and

 

10)        Department employees and authorized agents or designees of the Department, including, but not limited to, Registry staff and Department vendors.

 

d)         By July 1 of each year, the Department of Healthcare and Family Services shall provide to the Department a list of managed care entities under contract with the Department of Healthcare and Family Services to coordinate the provision of medical care to enrollees of the medical assistance program.  The Department of Healthcare and Family Services will provide updates regarding the list of managed care entities to the Department as needed throughout the year.

 

e)         Health care providers, schools, child care centers, colleges, universities, and health plans provided access to the Registry in subsection (c) will be granted access to information in the Registry for the purposes of verification of immunization status, the coordination of medical care or the provision of medical care to patients, residents, attendees, or enrollees of the institutions.  Access to the Registry will not be granted for the verification of immunization status of employees, contractors, or volunteers.

 

f)         Before immunization data may be released to an entity listed in subsection (c), the entity must enter into a Confidentiality Agreement with the Department that provides that information that identifies a patient will not be released to any other person without the written consent of the patient. (Section 20(d) of the Act) The Confidentiality Agreement provides that:

 

1)         Only personnel whose assigned duties include functions associated with the immunization of clients can be given access to Registry information. 

 

2)         Users who willfully misuse information contained in the Registry will have their access immediately restricted by the Department. 

 

3)         Any non-health use of Registry data is prohibited, and no user shall attempt to copy the database or software used to access the Registry without written consent from the Department.

 

4)         Site administrators may enroll users who have been trained in the use of the Registry at the appropriate access level and have signed the Individual User Agreement.

 

5)         Identifying information contained in the Registry will be accessible only to Department personnel, their authorized agents and authorized users. Requests for data for research purposes that go beyond the scope of the individual provider's patients or the certified local health department area of jurisdiction shall be forwarded to the Department.

 

6)         Registry data identifying clients will not be disclosed to unauthorized individuals, including law enforcement, without the approval of the Department.

 

g)         All enrolled sites shall maintain reasonable and appropriate administrative, technical and physical safeguards to ensure the integrity and confidentiality of the Registry information.  The Department will conduct periodic assessments on privacy and security policies.

 

h)         No person or automated system may access or attempt to access the Registry without approval from the Department.

 

i)          A person who knowingly, intentionally, or recklessly discloses confidential information contained in the Registry in violation of the Act and this Part commits a Class A Misdemeanor. (Section 25 of the Act)

 

j)          The Department may release summary statistics regarding information in the immunization data registry if the summary statistics do not reveal the identity of an individual. (Section 20(e) of the Act) Aggregate data from which personal identifying data has been removed may be released for the purposes of statistical analysis, research or reporting only after approval by the Department.  Release of data, including requests by medical or epidemiologic researchers,  will be done in accordance with the Illinois Health Statistics Act upon submission of a written request to the Department.

 

k)         Identifiable data may be released to the extent necessary for the treatment, control, investigation or prevention of diseases and conditions dangerous to the public health.  Identifiable data can be shared for conditions of public health significance, e.g., as permitted by HIPAA regulations, the Medical Studies Act, and the Health Statistics Act.  As described in the Health Statistics Act, a Department-approved Institutional Review Board, or its equivalent on the protection of human subjects in research, will review and approve requests from researchers for individually identifiable data. 

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.80  Opt-Out Option

 

a)         Before entering immunization data into the Registry, authorized immunization providers who provide immunization data into the Registry shall provide the patient or the patient's parent or guardian, if the patient is less than 18 years of age, with a printed Opt-Out Form at least once.  (Section 17 of the Act)

 

b)         Opt-out forms must include all of the following information:

 

1)         A description of the Registry and its purpose;

 

2)         That the health care provider may report immunization data to the Department to be entered into the Registry;

 

3)         That the patient or the patient's parent or guardian, if the patient is less than 18 years of age, has a right to exempt disclosure of immunization data to the Registry and may prevent disclosure by signing an immunization data exemption form;

 

4)         That the patient or the patient's parent or guardian, if the patient is less than 18 years of age, may have the individual's information removed from the Registry; and

 

5)         Instructions on how to have the information removed.  (Section 15(c) of the Act)

 

c)         Completed Opt-Out Forms shall be maintained at the provider site, and a copy shall be provided to the patient or the patient's parent or guardian.  If any provider subsequently tries to add the same client to the Registry, the provider will be warned that the client's record has been locked, and the provider will be unable to save the record. Only the Department and the provider site that originally submitted the patient record have the ability to view or unlock a locked record.

 

d)         The Opt-Out Form shall also be used to opt the patient back into the Registry if the patient decides to do so. A patient may opt back in the Registry by the completion of an Opt-Out Form at any provider site participating in the Registry.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.90  Use of Registry for Public Health Emergency Purposes

 

a)         If an epidemic, or an outbreak of a vaccine-preventable disease or any disease of public health significance occurs, or a public health emergency as may be declared by the Department or the Governor, the Department may access and release data in the Registry without obtaining the prior consent of patients.

 

b)         The Department may designate additional persons to view Registry information during an epidemic, an outbreak of a vaccine-preventable disease or any disease of public health significance, or a public health emergency as may be declared by the Department or the Governor. 

 

c)         The Department may use the Registry as a vaccination management and tracking system in preparation for an epidemic, an outbreak of a vaccine-preventable disease or any disease of public health significance or a public health emergency and during an epidemic, an outbreak of a vaccine-preventable disease or any disease of public health significance, or a public health emergency and during a public health emergency as may be declared by the Department or the Governor.

 

d)         The Department may include public health emergency announcements and notices or guidelines on the main screen of the Registry for immediate viewing by the Registry users and participants.

 

(Source:  Amended at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.100  Registry Digital Platform

 

a)         The Department may develop a public portal, mobile application, or other digital platform for the purpose of allowing individuals, parents, and legal guardians to access, save, or print immunization records.

 

b)         All users of any public portal, mobile application or digital platform developed shall be 18 years of age or older and registered with the portal. Registration with the public portal will require the provision of demographic and current contact information. Registration will require the establishment of a password to access the public portal.  Additional information may also be requested from the individual as may be needed to match immunization records in the Registry.  The information provided at registration shall be an exact match in the Registry before any immunization information will be released through the public portal.

 

c)         If a record match is found in the Registry, the individual seeking access to the Registry information through the public portal, mobile application, or other digital platform will submit to a multi-factor verification process before any Registry information is shared by the Department, and agree to all terms and conditions associated with the portal, mobile application or digital platform.

 

d)         If the information provided at the time of registration with the public portal, mobile application, or digital platform is not an exact match with information contained in the Registry or the patient cannot be uniquely identified with a record in the Registry, portal, mobile application, or digital platform access will be declined.  If the public portal, mobile application, or other digital platform registration request is declined, the individual may access immunization records through their health care provider or by direct contact with the Department.

 

e)         The Department will share identifiable immunization data with vendors and software hosts as may be needed for the development, support and maintenance of any public portal, mobile application, or digital platform.  Only the minimum information necessary for the intended purpose will be disclosed. The Department will share the information in a manner that protects the confidentiality of the protected health information. A person or institution to whom information is furnished or to whom access to records has been given shall not divulge any part of the records so as to disclose the identity of the person to whom the information or record relates.

 

(Source:  Added at 46 Ill. Reg. 2680, effective January 28, 2022)

 

Section 689.APPENDIX A   Registry Access Allowed for Each User Group Type

 

User Type	View Immunizations	View Demographics	Add/Edit Information
Health Care Providers	Ÿ	Ÿ	Ÿ
Certified Local Health Department	Ÿ	Ÿ	Ÿ
Schools/Colleges/Universities	ss	ss
Child Care Centers	ss	ss
Child-placing Agency	ss	ss
IDPH/Agents	Ÿ	Ÿ	Ÿ

 

Ÿ    Has authorization to access all information

ss  Has authorization to access a subset of information, with contact information removed.

 

View Immunizations means that the user has permission to view the entire immunization history and status (i.e., whether the client is up to date with recommended immunizations).

 

View Demographics means that the user can view information about the client, including the client's name, date of birth, mother's maiden name, address and telephone number.

 

Add/Edit Information means that the user can add new immunizations to a client's record and edit immunizations already previously recorded in a client's record.  If an immunization was recorded as new, meaning that it was drawn from a provider's inventory, no other provider may edit the immunization.  Providers may edit historical immunizations not marked as given by a provider site.  Users may add a new client record into the Registry or alter the details on a client already contained in the Registry.