HB 772

relating to the immunization data included in and excluded from the
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1.  Section 161.007, Health and Safety Code, is
amended by amending Subsections (a), (a-2), (b), (b-1), (c), (d),
and (e) and adding Subsections (e-1), (l), and (m) to read as
(a)  The department, for the primary purpose of establishing
and maintaining a single repository of accurate, complete, and
current immunization records to be used in aiding, coordinating,
and promoting efficient and cost-effective communicable disease
prevention and control efforts, shall establish and maintain an
immunization registry.  The executive commissioner by rule shall
(1)  protect the confidentiality of patients in
accordance with Section 159.002, Occupations Code;
(2)  inform the individual or the individual's legally
authorized representative about the registry and that registry
information may be released under Section 161.00735;
(3)  [require the written or electronic consent of the
individual or the individual's legally authorized representative
before any information relating to the individual is included in
[(4)]  permit the individual or the individual's
legally authorized representative to request exclusion of the
individual's information from [withdraw consent for the individual
to be included in] the registry;
(4)  provide opportunities for the individual or the
individual's legally authorized representative to request
exclusion from the registry at any time, including:
(A)  at the time of the individual's birth if
attended by a health care provider who administers immunizations;
(B)  each time a health care provider in this
state administers any immunization to the individual;
(C)  through electronic submission of a request
for exclusion using a procedure available on the department's
(D)  through submission to the department of a
written request for exclusion; and
(E)  following a natural or man-made disaster;
(5)  ensure the individual or the individual's legally
authorized representative is not required to request exclusion from
the registry more than one time and, following the department's
receipt of the request for exclusion, the individual's immunization
information is not included in the registry unless the individual
or the individual's legally authorized representative subsequently
submits to the department a written request for inclusion in the
(6)  include on each immunization record the registry
generates the procedure for requesting exclusion from the registry
[determine the process by which consent is verified, including
affirmation by a health care provider, birth registrar, regional
health information exchange, or local immunization registry that
(a-2)  [The written or electronic consent required by
Subsection (a)(3) for an individual who is 18 years of age or older
is required to be obtained only one time and must be received from
the individual before the information may be released.]  An
individual's legally authorized representative or the individual,
after the individual has attained 18 years of age, may submit a
request [consent] in writing or electronically for exclusion of the
individual's information from [to remain in] the registry.  [The
consent of the representative or individual is valid until the
individual or the individual's legally authorized representative
withdraws consent in writing or electronically.  The department may
not include in the registry the immunization information of an
individual who is 26 years of age or older until written or
electronic consent has been obtained as provided by this
subsection.]  The department shall coordinate with the Texas
Education Agency to distribute materials described in Section
161.0095(a)(2) to students and parents through local school
(b)  Except as provided by Section 161.0071, the
immunization registry must contain information on the immunization
history that is obtained by the department under:
(1)  this section of each individual for whom
immunization information [consent] has been obtained, unless the
individual or the individual's legally authorized representative
requested exclusion of the individual's information from the
registry in accordance with guidelines adopted under Subsection
(2)  Section 161.00705 of individuals [persons]
immunized to prepare for or in response to a declared disaster,
public health emergency, terrorist attack, hostile military or
paramilitary action, or extraordinary law enforcement emergency;
(3)  Section 161.00706 of first responders or their
(4)  Section 161.00735 of individuals [persons]
evacuated or relocated to this state because of a disaster.
(b-1)  The department shall exclude [remove] from the
registry information for any individual for whom [consent has been
withdrawn.  The department may not retain individually identifiable
information about any individual:
[(1)  for whom consent has been withdrawn;
[(2)  for whom a consent for continued inclusion in the
registry following the end of the declared disaster, public health
emergency, terrorist attack, hostile military or paramilitary
action, or extraordinary law enforcement emergency has not been
received under Section 161.00705(f);
[(3)  for whom a request to be removed from the registry
has been received under Section 161.00706(e);
[(4)  for whom consent for continued inclusion in the
registry following the end of a disaster has not been received under
[(5)  for whom] a request to exclude [remove]
information from the registry has been received under this
subchapter [Section 161.00735(g)].
(c)  A payor that receives data elements from a health care
provider who administers an immunization to an individual younger
than 18 years of age shall provide the data elements to the
department.  A payor is required to provide the department with only
the data elements the payor receives from a health care provider.  A
payor that receives data elements from a health care provider who
administers an immunization to an individual 18 years of age or
older may provide the data elements to the department.  The data
elements shall be submitted in a format prescribed by the
department.  [The department shall verify consent before including
the reported information in the immunization registry.  The
department may not retain individually identifiable information
about an individual for whom consent cannot be verified.]
(d)  A health care provider who administers an immunization
to an individual younger than 18 years of age shall provide data
elements regarding an immunization to the department.  A health
care provider who administers an immunization to an individual 18
years of age or older may submit data elements regarding an
immunization to the department.  At the request and with the
authorization of the health care provider, the data elements may be
submitted through a health information exchange as defined by
Section 182.151.  The data elements shall be submitted in a format
prescribed by the department.  A health care provider who
administers an immunization to any individual and provides data
elements to the department shall notify the individual or the
individual's legally authorized representative of:
(1)  the inclusion in the registry of the individual's
immunization information unless exclusion from the registry is
requested in accordance with the guidelines adopted under
(2)  the procedure for requesting exclusion from the
registry  [The department shall verify consent before including the
information in the immunization registry.  The department may not
retain individually identifiable information about an individual
for whom consent cannot be verified].
(1)  post on the department's Internet website a
(A)  states an individual's immunization
information will be included in the registry unless exclusion from
(B)  details the procedure for submitting an
electronic or written request for exclusion from the registry
[provide notice to a health care provider that submits an
immunization history for an individual for whom consent cannot be
verified.  The notice shall contain instructions for obtaining
consent] in accordance with guidelines adopted under Subsection
(2)  make the form described by Subdivision (1)
available for distribution to health care providers [and
resubmitting the immunization history to the department].
(e-1)  A health care provider may use the printable form
described by Subsection (e) to provide the notification required
(l)  Registry information may not be used to exclude any
individual from the receipt of any service during a natural or
man-made disaster unless the service is withheld because of a
(m)  The department may not sell registry information to any
SECTION 2.  Section 161.00705(f), Health and Safety Code, is
(f)  Unless an individual or the individual's legally
authorized representative [consents] in writing or electronically
requests exclusion [to continued inclusion] of the individual's
information from [in] the registry, the department shall include
[remove] the immunization records collected under this section in
[from] the registry [on expiration of the period prescribed under
SECTION 3.  Sections 161.00706(e) and (f), Health and Safety
Code, are amended to read as follows:
(e)  A person whose immunization records are included in the
immunization registry as authorized by this section may request in
writing or electronically that the department exclude [remove] that
information from the registry.  Not later than the 10th day after
receiving a request under this subsection, the department shall
exclude [remove] the person's immunization records from the
(f)  The report required under Section 161.0074 must also
include the number of complaints received by the department related
to the department's failure to comply with requests for exclusion
[removal] of information from the registry under Subsection (e).
SECTION 4.  Sections 161.0071(a) and (b), Health and Safety
Code, are amended to read as follows:
(a)  The first time the department receives registry data for
an individual [for whom the department has received consent] to be
included in the registry, the department shall send notice to the
individual or the individual's legally authorized representative
(1)  that providers and payors may be sending the
individual's immunization information to the department;
(2)  the information that is included in the registry;
(3)  the persons to whom the information may be
released under Sections 161.00735(b) and 161.008(d);
(4)  the purpose and use of the registry;
(5)  the procedure to request exclusion of an
individual's information [exclude an individual] from the
(6)  the procedure to report a violation if an
individual's information is included in the registry after
exclusion has been requested [or consent has been withdrawn].
(b)  The [On discovering that consent to be included in the
registry has not been granted or has been withdrawn, the]
department shall exclude [the individual's immunization records]
from the registry and any other registry-related department record
that individually identifies the individual the immunization
record of any individual from whom the department receives a
SECTION 5.  Section 161.0073, Health and Safety Code, is
amended by amending Subsection (a) and adding Subsections (e), (f),
(g), and (h) to read as follows:
(a)  Except as provided by this section and Sections 161.007,
161.00705, 161.00706, [and] 161.00735, and 161.008, information
that individually identifies an individual that is received by the
department for the immunization registry is confidential and may be
used by the department for registry purposes only.
(e)  The department may use registry information for
internal public health research on approval of the department's
(f)  The department may release registry information for
external public health research if:
(1)  the individual or the individual's legally
authorized representative submits to the department a written
authorization for release of the individual's registry data;
(2)  the department does not disclose individually
(3)  subject to Subsection (g), the department's
institutional review board approves the release of individually
(g)  The department's institutional review board may not
approve the release of individually identifiable information for a
research proposal unless the proposal includes a provision
requiring the proposal's researchers to obtain informed consent
from each individual or the individual's legally authorized
representative before the department releases the individual's
registry data to the researchers.
(h)  The executive commissioner shall adopt rules to ensure
the use or release of registry information under this subchapter
complies with all state and federal laws relating to the privacy,
protection, confidentiality, and transmission of health
information, including the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) and rules adopted
SECTION 6.  Sections 161.00735(c), (g), and (h), Health and
Safety Code, are amended to read as follows:
(c)  The department may receive immunization information
from a health authority of another state or from a local health
authority in another state if the department determines that
residents of that state have evacuated or relocated to this state in
response to a disaster.  The department shall include information
received under this subsection in the registry.  [Notwithstanding
Section 161.007, the department is not required to obtain written
consent for the inclusion in the registry of information received
(g)  If an individual or, if a child, the child's parent,
managing conservator, or guardian requests in writing that the
individual's or child's information obtained under Subsection (c)
be excluded [removed] from the registry, the department shall
exclude [remove] that information from the registry.
(h)  The executive commissioner shall make every effort to
enter into a memorandum of agreement with each state to which
residents of this state are likely to evacuate in a disaster on:
(1)  the release to and use by [of registry information
under this section to] the appropriate health authority or local
health authority of that state of registry information under this
section[, including the length of time the information may be
(2)  the receipt and use of information submitted by
the health authority or local health authority of that state for
inclusion in the registry under this section.
SECTION 7.  Sections 161.008(c) and (e), Health and Safety
Code, are amended to read as follows:
(c)  The department may obtain the data constituting an
immunization record for an individual from a public health
district, a local health department, the individual or the
individual's legally authorized representative, a physician to the
individual, a payor, or any health care provider licensed or
otherwise authorized to administer vaccines.  [The department shall
verify consent before including the reported information in the
immunization registry.  The department may not retain individually
identifiable information about an individual for whom consent
(e)  An individual or the individual's legally authorized
representative may obtain and on request to the department shall be
provided with all individually identifiable immunization registry
information concerning the individual and information on the
procedure for requesting exclusion from the registry.
SECTION 8.  Section 161.009(a), Health and Safety Code, is
(a)  A person commits an offense if the person:
(1)  negligently releases or discloses immunization
registry information in violation of Section 161.007, 161.0071,
(2)  fails to exclude an individual's immunization
information in violation of Section 161.0071;
(3)  fails to exclude an individual's [remove a
person's] immunization information in violation of Section
161.00705, 161.00706, or 161.00735; or
(4)  negligently uses information in the immunization
registry to solicit new patients or clients or for other purposes
that are not associated with immunization or quality-of-care
purposes, unless authorized under this section.
SECTION 9.  Section 161.0095(a), Health and Safety Code, is
(a)  The department shall develop:
(1)  continuing education programs for health care
providers relating to immunizations and the vaccines for children
program operated by the department under authority of 42 U.S.C.
(2)  educational information, for health care
providers, health care clinics, hospitals, and any other health
care facility that provides health care to children 14 to 18 years
of age, relating to the immunization registry and the option for an
individual or the individual's legally authorized representative
to request exclusion [who is 18 years of age or older to consent to
submission and retention] of the individual's information from [in]
SECTION 10.  Section 161.0107(c), Health and Safety Code, is
(c)  The executive commissioner by rule shall specify:
(1)  the fields necessary to populate the immunization
registry[, including a field that indicates the patient's consent
to be listed in the immunization registry has been obtained]; and
(2)  the data standards that must be used for
electronic submission of immunization information.
SECTION 11.  The following provisions of the Health and
(1)  Sections 161.007(a-1), (a-3), (a-4), (a-5), and
(2)  Sections 161.00705(e) and (h); and
(3)  Sections 161.00735(e) and (f).
SECTION 12.  (a)  The changes in law made by this Act to
Subchapter A, Chapter 161, Health and Safety Code, apply to
immunization information received by the Department of State Health
Services before, on, or after January 1, 2027.  An individual whose
immunization information was included immediately before January
1, 2027, in the immunization registry established under Subchapter
A, Chapter 161, Health and Safety Code, is subject to the changes in
law made by this Act to that subchapter, including the procedures
established by that subchapter as amended by this Act.
(b)  The changes in law made by this Act do not authorize the
Department of State Health Services to include in the immunization
registry established under Subchapter A, Chapter 161, Health and
Safety Code, immunization information of an individual who is 18
years of age or older and whose immunization information was not
included in the registry on or before January 1, 2027, unless the
department receives immunization data from a health care provider
(1)  administers an immunization to the individual
after that date and elects to provide the individual's immunization
information to the department; and
(2)  notifies the individual before submission of the
(A)  that the health care provider is providing
the information to the department for inclusion in the registry;
(B)  that the information will remain in the
registry until exclusion is requested by the individual or the
individual's legally authorized representative; and
(C)  of the procedures for requesting exclusion
from the registry under Subchapter A, Chapter 161, Health and
Safety Code, as amended by this Act.
(c)  The changes in law made by this Act apply only to an
offense committed on or after the effective date of this Act.  An
offense committed before the effective date of this Act is governed
by the law in effect on the date the offense was committed, and the
former law is continued in effect for that purpose.  For purposes of
this subsection, an offense was committed before the effective date
of this Act if any element of the offense occurred before that date.
SECTION 13.  (a)  As soon as practicable after the effective
date of this section, the Department of State Health Services shall
conduct a public awareness campaign to educate health care
providers, parents, payors, schools, and the public about the
changes in law made by this Act.
(b)  As soon as practicable after the effective date of this
section, the executive commissioner of the Health and Human
Services Commission shall adopt the rules required by Section
161.0073(h), Health and Safety Code, as added by this Act.
SECTION 14.  (a) Except as provided by Subsection (b) of this
section, this Act takes effect January 1, 2027.
(b)  Section 13 of this Act takes effect September 1, 2025.