HB 2872

relating to the release or disclosure of vaccination or
immunization information; providing a civil penalty.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1.  Subchapter A, Chapter 161, Health and Safety
Code, is amended by adding Section 161.0093 to read as follows:
Sec. 161.0093.  PROHIBITED RELEASE OR DISCLOSURE OF
VACCINATION OR IMMUNIZATION INFORMATION; EXCEPTIONS; CIVIL
PENALTY.  (a)  In this section, "health authority" has the meaning
(b)  An employee or agent of the department or a health
authority may not release or otherwise disclose to any person an
individual's vaccination or immunization information the
department or health authority receives unless:
(1)  the department or health authority, as applicable,
obtains the written or electronic consent of the individual or the
individual's legally authorized representative;
(2)  the employee or agent releases or discloses the
information to a health care provider in accordance with applicable
state and federal laws relating to the privacy, protection,
confidentiality, and transmission of health information; or
(3)  the release or disclosure is otherwise authorized
(c)  A person who obtains an individual's vaccination or
immunization information under this subchapter may not release or
otherwise disclose the information to a third party, including
under a contract or subcontract, for the purpose of encouraging
individuals to obtain a vaccine or to provide educational materials
(d)  A person who releases or discloses vaccination or
immunization information in violation of Subsection (b) or (c) is
liable to this state for a civil penalty in an amount of not less
than $2,000 and not more than $50,000 for each violation.  The
attorney general may bring an action to collect the civil penalty
SECTION 2.  Sections 161.007(a) and (j), Health and Safety
Code, are amended to read as follows:
(a)  The department, for the primary purpose of establishing
and maintaining a single repository of accurate, complete, and
current immunization records to be used in aiding, coordinating,
and promoting efficient and cost-effective communicable disease
prevention and control efforts, shall establish and maintain an
immunization registry.  The executive commissioner by rule shall
(1)  protect the confidentiality of patients in
accordance with Section 159.002, Occupations Code;
(2)  inform the individual or the individual's legally
authorized representative about the registry [and that registry
information may be released under Section 161.00735];
(3)  require the written or electronic consent of the
individual or the individual's legally authorized representative
before any information relating to the individual is included in
(4)  permit the individual or the individual's legally
authorized representative to withdraw consent for the individual to
be included in the registry; and
(5)  determine the process by which consent is
verified, including affirmation by a health care provider, birth
registrar, regional health information exchange, or local
immunization registry that consent has been obtained.
(j)  Except as provided by Sections 161.00705, 161.00706,
[161.00735(b),] and 161.008, information obtained by the
department for the immunization registry is confidential and may be
disclosed only with the written or electronic consent of the
individual or the individual's legally authorized representative.
SECTION 3.  Section 161.00705(g), Health and Safety Code, is
(g)  The immunization information of a child or other
individual received by the department under this section, including
individually identifiable information, may be released only:
(1)  on consent of the individual or, if a child, the
child's parent, managing conservator, or guardian; or
(2)  to a [state agency or] health care provider
consistent with the purposes of this subchapter or the purposes of
aiding or coordinating communicable disease prevention and control
efforts during a declared disaster, public health emergency,
terrorist attack, hostile military or paramilitary action, or
extraordinary law enforcement emergency.
SECTION 4.  Sections 161.00706(c) and (d), Health and Safety
Code, are amended to read as follows:
(c)  The executive commissioner shall:
(1)  develop rules to ensure that immunization history
submitted under Subsection (a)(2) is medically verified
(2)  develop guidelines for use by the department in
informing first responders about the registry [and that registry
information may be released under Section 161.00735]; and
(3)  adopt rules necessary for the implementation of
(d)  A [Except as provided by Section 161.00735, a] person's
immunization history or data received by the department under this
section may be released only on consent of the person or to any
health care provider licensed or otherwise authorized to administer
SECTION 5.  Section 161.0071(a), Health and Safety Code, is
(a)  The first time the department receives registry data for
an individual for whom the department has received consent to be
included in the registry, the department shall send notice to the
individual or the individual's legally authorized representative
(1)  that providers and payors may be sending the
individual's immunization information to the department;
(2)  the information that is included in the registry;
(3)  the persons to whom the information may be
released under Section [Sections 161.00735(b) and] 161.008(d);
(4)  the purpose and use of the registry;
(5)  the procedure to exclude an individual from the
(6)  the procedure to report a violation if an
individual's information is included in the registry after
exclusion has been requested or consent has been withdrawn.
SECTION 6.  Section 161.0073(a), Health and Safety Code, is
(a)  Except as provided by Section [Sections] 161.00705 [and
161.00735], information that individually identifies an individual
that is received by the department for the immunization registry is
confidential and may be used by the department for registry
SECTION 7.  The heading to Section 161.00735, Health and
Safety Code, is amended to read as follows:
Sec. 161.00735.  [RELEASE AND] RECEIPT OF REGISTRY DATA IN
SECTION 8.  Section 161.00735(h), Health and Safety Code, is
(h)  The executive commissioner shall make every effort to
enter into a memorandum of agreement with each state from [to] which
residents of that [this] state are likely to evacuate to this state
[(1)  the release and use of registry information under
this section to the appropriate health authority or local health
authority of that state, including the length of time the
information may be retained by that state; and
[(2)]  the receipt and use of information submitted by
the health authority or local health authority of that state for
inclusion in the registry under this section.
SECTION 9.  Section 161.0075, Health and Safety Code, is
Sec. 161.0075.  IMMUNITY FROM LIABILITY.  Except as provided
by Sections [Section] 161.009 and 161.0093, the following persons
subject to this subchapter that act in compliance with Sections
161.007, 161.00705, 161.00706, 161.0071, 161.0073, 161.0074, and
161.008 are not civilly or criminally liable for furnishing the
information required under this subchapter:
(2)  a health care provider who administers
(3)  an employee of the department.
SECTION 10.  Section 161.008(d), Health and Safety Code, is
(d)  The department may release the data constituting an
immunization record for the individual to:
(1)  a health care provider treating the individual or
an organization of which the individual is a member [any entity that
is described by Subsection (c)]; or
(2)  [a school or child care facility in which the
[(3)  a state agency having legal custody of the
[(4)]  an employer of a first responder or a first
responder in accordance with Section 161.00708.
SECTION 11.  Section 161.00735(b), Health and Safety Code,
SECTION 12.  The changes in law made by this Act apply only
to the release or disclosure of information on or after the
effective date of this Act.  The release or disclosure of
information before the effective date of this Act is governed by the
law in effect when the release or disclosure was made, and the
former law is continued in effect for that purpose.
SECTION 13.  This Act takes effect September 1, 2025.