This chapter governs ImmuNet, a computer-based registry of immunizations, as established in Health-General Article, §18-109, Annotated Code of Maryland. In this chapter, the following terms have the meanings indicated. Terms Defined. “Authorized user” means: A child care facility; A health care provider; A health insurer; A health maintenance organization; An institution of higher learning; A local health department; A long-term care facility; A managed care organization; A nonprofit health service plan; A patient; A pharmacist authorized to administer vaccinations in accordance with Health Occupations Article, §12-508, Annotated Code of Maryland; A school; A school-based health center; In the case of a minor child, a parent or guardian; and Any other authorized user designated by the Secretary. “Department” means the Maryland Department of Health. “ImmuNet” means a computerized information and reminder system to: Improve the timely and appropriate delivery of immunizations; Provide a coordinated network for reminder notices when immunizations are due; Provide and collect information to be shared by authorized users; and Provide a quality indicator for the insurers’ health care provider practices and public health purposes. “Refusal to permit disclosure of information” means the right of an individual or the parent or guardian of a minor to prevent disclosure to authorized users of individual identifiable information that was reported to ImmuNet. Regional Registry. “Regional registry” means a database that contains immunization information for individuals residing in an area of Maryland. “Regional registry” includes an immunization database or registry maintained and operated by a local health department. “Secretary” means the Secretary of Health. “Vaccine information statement (VIS)” means a document that: Is created and updated by the U.S. Centers for Disease Control and Prevention; and Relates: The purpose of specific vaccines; Schedules of administration; and Possible adverse reactions to specific vaccines. The Department shall support and administer ImmuNet. The Department may enter or edit information contained in ImmuNet. ImmuNet is subject to the security and reliability standards set forth in Regulation .09 of this chapter. The Department shall make available to authorized users and to the general public all forms relevant to ImmuNet, such as the: User agreement; Refusal to Permit Disclosure of Information form; and Statement of Reactivation of Participation in ImmuNet form. The Department shall enter the following information from each birth certificate registered in Maryland: Child’s: First, middle, and last name; Date of birth; Sex; and Current or last known address; and Child’s mother’s: First and middle names; Maiden Name if applicable; and Current last name. Following the administration of a vaccine to an individual residing in Maryland, the health care provider who administered the vaccine may enter the following information to ImmuNet: Patient’s: First, middle, and last name; Date of birth; Sex; Birth state and country; Current or last known address; If the patient is a minor, the name of the parent or guardian; Last four digits of Social Security number, if available; and Medicaid number, if available and applicable; Patient’s mother’s: First and middle names; Maiden name, if applicable; and Current last name; For each vaccine administered: Antigen type; Manufacturer; Expiration date; Lot number; Date VIS provided to patient; VIS date; and Date of administration; Contraindication, adverse event, and exemption information for the patient, including: A medical contraindication or adverse event to the administration of one or more vaccines; Whether the contraindication is permanent or temporary and, if temporary, the date after which the contraindication will no longer exist or needs to be reassessed; and An objection to immunization based on a bona fide religious belief and practice; Other medical information pertaining to vaccine-preventable diseases, including serologic test results; Other information designated by the U.S. Centers for Disease Control and Prevention as Immunization Information System Required Core Data Elements; and Other information designated by the Secretary. Correction of Inaccurate Information. A patient or a parent or a guardian of a minor patient whose immunization information is entered into ImmuNet may contact the Department to: View the information; and Provide information to correct any inaccuracies. An authorized user who wishes to obtain information from ImmuNet shall enter into a user agreement with the Department for the purpose of protecting the confidentiality and security of ImmuNet information. The user agreement shall include but not be limited to the: Functions that may be performed by an authorized user of ImmuNet; Authorized uses of ImmuNet information as set forth in Health-General Article, §18-109(c), Annotated Code of Maryland; Prohibitive uses of ImmuNet information as set forth in Health-General Article, §18-109(f), Annotated Code of Maryland; and Basic practices for safeguarding confidential information. Authorized users shall request the renewal of the user agreement on an annual basis. Authorized User Functions. An authorized user who has signed a user agreement may obtain the following information about an individual from ImmuNet: First, middle, and last name; Date of birth; Address; Telephone number; In the case of a minor child, the name of the parent or guardian; Immunizations given; Immunization dates; Contraindication, adverse event, and exemption information; and Other medical information pertaining to vaccine-preventable diseases, including serologic test results. An authorized user that is a health care provider, local health department, long-term care facility, or school-based health center that administers immunizations may: Enter information into ImmuNet directly from medical records that are in the authorized user’s possession; and Edit information the authorized user has entered into ImmuNet. An authorized user who is a patient or a parent or guardian of a minor may view the patient’s or the minor patient’s ImmuNet information without signing a user agreement by requesting the information from the patient’s or minor’s immunization provider or the Department. With approval from the Department, the following authorized users may enter information into ImmuNet: A child care facility; A health insurer; A health maintenance organization; An institution of higher learning; A managed care organization; A nonprofit health service plan; and A school. An individual or a parent or guardian of a minor child who has received an immunization may at any time prohibit information in ImmuNet from being disclosed to authorized users by providing to the Department a signed and dated Refusal to Permit Disclosure of Information form. An individual or a parent or guardian of a minor who has submitted a Refusal to Permit Disclosure of Information form may allow information in ImmuNet to be disclosed by submitting to the Department a signed and dated written Statement of Reactivation of Participation in ImmuNet form. Information in ImmuNet may be used by authorized users for the following purposes: To provide coordinated immunization services, including sending reminder notices to individuals who need immunizations; To obtain an individual immunization history; To identify geographic areas or population groups who are underimmunized; To compile aggregate information and distribute statistical reports on the status of immunizations in geographic areas and population groups; To assist in the management of State and local immunization programs; To monitor the safety of vaccines; To assess compliance with immunization requirements by monitoring admissions to: Schools; Institutions of higher learning; and Child care facilities; and For any other purpose that the Secretary deems necessary to prevent the spread of communicable diseases or assess the safety or effectiveness of vaccines in accordance with Health-General Article, §18-109(c), Annotated Code of Maryland. A regional registry shall submit to ImmuNet all immunization information on Maryland residents within 14 calendar days of receipt of the information. If the confidentiality of records of Maryland citizens is protected, the Department may enter into a collaborative agreement with other states for the purpose of sharing immunization information. The Department shall maintain ImmuNet in accordance with system security requirements for federal information processing systems, including National Institute of Standards and Technology (NIST) 800-53 Special Publication, and prevailing agency information technology security policy standards and requirements. ImmuNet Security. The Department shall: Maintain ImmuNet information on a server protected by a firewall; and Encrypt information traveling to and from authorized users. The Department shall maintain encryption keys in a secure location. Health-General Article, §18-109; Health Occupations Article, §12-508; Annotated Code of Maryland Effective date: April 27, 2015 (42:8 Md. R. 607)