# COMAR Title 10 — Maryland Department of Health

## Subtitle 06 — Diseases

### Chapter 03 — ImmuNet

**Authority:** Health-General Article, §18-109; Health Occupations Article, §12-508; Annotated Code of Maryland

**Administrative History:** Effective date: April 27, 2015 (42:8 Md. R. 607)

#### Regulation .01 Scope.

*COMAR 10.06.03.01*

This chapter governs ImmuNet, a computer-based registry of immunizations, as established in Health-General Article, §18-109, Annotated Code of Maryland.

#### Regulation .02 Definitions.

*COMAR 10.06.03.02*

A. In this chapter, the following terms have the meanings indicated.

B. Terms Defined.

  (1) “Authorized user” means:

    (a) A child care facility;

    (b) A health care provider;

    (c) A health insurer;

    (d) A health maintenance organization;

    (e) An institution of higher learning;

    (f) A local health department;

    (g) A long-term care facility;

    (h) A managed care organization;

    (i) A nonprofit health service plan;

    (j) A patient;

    (k) A pharmacist authorized to administer vaccinations in accordance with Health Occupations Article, §12-508, Annotated Code of Maryland;

    (l) A school;

    (m) A school-based health center;

    (n) In the case of a minor child, a parent or guardian; and

    (o) Any other authorized user designated by the Secretary.

  (2) “Department” means the Maryland Department of Health.

  (3) “ImmuNet” means a computerized information and reminder system to:

    (a) Improve the timely and appropriate delivery of immunizations;

    (b) Provide a coordinated network for reminder notices when immunizations are due;

    (c) Provide and collect information to be shared by authorized users; and

    (d) Provide a quality indicator for the insurers’ health care provider practices and public health purposes.

  (4) “Refusal to permit disclosure of information” means the right of an individual or the parent or guardian of a minor to prevent disclosure to authorized users of individual identifiable information that was reported to ImmuNet.

  (5) Regional Registry.

    (a) “Regional registry” means a database that contains immunization information for individuals residing in an area of Maryland.

    (b) “Regional registry” includes an immunization database or registry maintained and operated by a local health department.

  (6) “Secretary” means the Secretary of Health.

  (7) “Vaccine information statement (VIS)” means a document that:

    (a) Is created and updated by the U.S. Centers for Disease Control and Prevention; and

    (b) Relates:

      (i) The purpose of specific vaccines;

      (ii) Schedules of administration; and

      (iii) Possible adverse reactions to specific vaccines.

#### Regulation .03 Administration of ImmuNet.

*COMAR 10.06.03.03*

A. The Department shall support and administer ImmuNet.

B. The Department may enter or edit information contained in ImmuNet.

C. ImmuNet is subject to the security and reliability standards set forth in Regulation .09 of this chapter.

D. The Department shall make available to authorized users and to the general public all forms relevant to ImmuNet, such as the:

  (1) User agreement;

  (2) Refusal to Permit Disclosure of Information form; and

  (3) Statement of Reactivation of Participation in ImmuNet form.

#### Regulation .04 Information Reported to ImmuNet.

*COMAR 10.06.03.04*

A. The Department shall enter the following information from each birth certificate registered in Maryland:

  (1) Child’s:

    (a) First, middle, and last name;

    (b) Date of birth;

    (c) Sex; and

    (d) Current or last known address; and

  (2) Child’s mother’s:

    (a) First and middle names;

    (b) Maiden Name if applicable; and

    (c) Current last name.

B. Following the administration of a vaccine to an individual residing in Maryland, the health care provider who administered the vaccine may enter the following information to ImmuNet:

  (1) Patient’s:

    (a) First, middle, and last name;

    (b) Date of birth;

    (c) Sex;

    (d) Birth state and country;

    (e) Current or last known address;

    (f) If the patient is a minor, the name of the parent or guardian;

    (g) Last four digits of Social Security number, if available; and

    (h) Medicaid number, if available and applicable;

  (2) Patient’s mother’s:

    (a) First and middle names;

    (b) Maiden name, if applicable; and

    (c) Current last name;

  (3) For each vaccine administered:

    (a) Antigen type;

    (b) Manufacturer;

    (c) Expiration date;

    (d) Lot number;

    (e) Date VIS provided to patient;

    (f) VIS date; and

    (g) Date of administration;

  (4) Contraindication, adverse event, and exemption information for the patient, including:

    (a) A medical contraindication or adverse event to the administration of one or more vaccines;

    (b) Whether the contraindication is permanent or temporary and, if temporary, the date after which the contraindication will no longer exist or needs to be reassessed; and

    (c) An objection to immunization based on a bona fide religious belief and practice;

  (5) Other medical information pertaining to vaccine-preventable diseases, including serologic test results;

  (6) Other information designated by the U.S. Centers for Disease Control and Prevention as Immunization Information System Required Core Data Elements; and

  (7) Other information designated by the Secretary.

C. Correction of Inaccurate Information. A patient or a parent or a guardian of a minor patient whose immunization information is entered into ImmuNet may contact the Department to:

  (1) View the information; and

  (2) Provide information to correct any inaccuracies.

#### Regulation .05 User Agreement.

*COMAR 10.06.03.05*

A. An authorized user who wishes to obtain information from ImmuNet shall enter into a user agreement with the Department for the purpose of protecting the confidentiality and security of ImmuNet information.

B. The user agreement shall include but not be limited to the:

  (1) Functions that may be performed by an authorized user of ImmuNet;

  (2) Authorized uses of ImmuNet information as set forth in Health-General Article, §18-109(c), Annotated Code of Maryland;

  (3) Prohibitive uses of ImmuNet information as set forth in Health-General Article, §18-109(f), Annotated Code of Maryland; and

  (4) Basic practices for safeguarding confidential information.

C. Authorized users shall request the renewal of the user agreement on an annual basis.

D. Authorized User Functions.

  (1) An authorized user who has signed a user agreement may obtain the following information about an individual from ImmuNet:

    (a) First, middle, and last name;

    (b) Date of birth;

    (c) Address;

    (d) Telephone number;

    (e) In the case of a minor child, the name of the parent or guardian;

    (f) Immunizations given;

    (g) Immunization dates;

    (h) Contraindication, adverse event, and exemption information; and

    (i) Other medical information pertaining to vaccine-preventable diseases, including serologic test results.

  (2) An authorized user that is a health care provider, local health department, long-term care facility, or school-based health center that administers immunizations may:

    (a) Enter information into ImmuNet directly from medical records that are in the authorized user’s possession; and

    (b) Edit information the authorized user has entered into ImmuNet.

  (3) An authorized user who is a patient or a parent or guardian of a minor may view the patient’s or the minor patient’s ImmuNet information without signing a user agreement by requesting the information from the patient’s or minor’s immunization provider or the Department.

  (4) With approval from the Department, the following authorized users may enter information into ImmuNet:

    (a) A child care facility;

    (b) A health insurer;

    (c) A health maintenance organization;

    (d) An institution of higher learning;

    (e) A managed care organization;

    (f) A nonprofit health service plan; and

    (g) A school.

#### Regulation .06 Refusal and Reactivation.

*COMAR 10.06.03.06*

A. An individual or a parent or guardian of a minor child who has received an immunization may at any time prohibit information in ImmuNet from being disclosed to authorized users by providing to the Department a signed and dated Refusal to Permit Disclosure of Information form.

B. An individual or a parent or guardian of a minor who has submitted a Refusal to Permit Disclosure of Information form may allow information in ImmuNet to be disclosed by submitting to the Department a signed and dated written Statement of Reactivation of Participation in ImmuNet form.

#### Regulation .07 Permissible Use of ImmuNet Information.

*COMAR 10.06.03.07*

Information in ImmuNet may be used by authorized users for the following purposes:

A. To provide coordinated immunization services, including sending reminder notices to individuals who need immunizations;

B. To obtain an individual immunization history;

C. To identify geographic areas or population groups who are underimmunized;

D. To compile aggregate information and distribute statistical reports on the status of immunizations in geographic areas and population groups;

E. To assist in the management of State and local immunization programs;

F. To monitor the safety of vaccines;

G. To assess compliance with immunization requirements by monitoring admissions to:

  (1) Schools;

  (2) Institutions of higher learning; and

  (3) Child care facilities; and

H. For any other purpose that the Secretary deems necessary to prevent the spread of communicable diseases or assess the safety or effectiveness of vaccines in accordance with Health-General Article, §18-109(c), Annotated Code of Maryland.

#### Regulation .08 Regional and Other State Immunization Registries.

*COMAR 10.06.03.08*

A. A regional registry shall submit to ImmuNet all immunization information on Maryland residents within 14 calendar days of receipt of the information.

B. If the confidentiality of records of Maryland citizens is protected, the Department may enter into a collaborative agreement with other states for the purpose of sharing immunization information.

#### Regulation .09 Security and Reliability Standards.

*COMAR 10.06.03.09*

A. The Department shall maintain ImmuNet in accordance with system security requirements for federal information processing systems, including National Institute of Standards and Technology (NIST) 800-53 Special Publication, and prevailing agency information technology security policy standards and requirements.

B. ImmuNet Security.

  (1) The Department shall:

    (a) Maintain ImmuNet information on a server protected by a firewall; and

    (b) Encrypt information traveling to and from authorized users.

  (2) The Department shall maintain encryption keys in a secure location.