OAR 333-049-0070: Limitations on Access to Information in the Immunization Information System and Tracking and Recall System

(1) An authorized user may only access information in the IIS or Tracking and Recall System as follows: (a) An authorized user may access information on a client who is presently under that authorized user’s care, or enrolled in the authorized user’s children's facility, school, post-secondary educational institution, program or health plan, except as otherwise provided by law. (b) An authorized user that is a state or local public health authority may, in addition to accessing information described in subsection (1)(a) of this rule, access information on an individual within a public health entity’s jurisdiction for: (A) Assessment, evaluation, surveillance and outreach related to immunization promotion and vaccine-preventable disease prevention; and (B) The Pregnancy Risk Assessment Monitoring System (PRAMS). (2) The program may monitor and audit all access to a client's record contained in the IIS. (3) The program may require any person who has accessed a client's record to provide evidence that such client was under the care of the person or enrolled in the person's post-secondary educational institution, school, children's facility, program or health plan at the time the client's record was accessed. (4) Requests for client-specific data from entities other than authorized users, or requests from authorized users for data beyond that listed in subsection (1)(a) or (1)(b) of this rule, will be considered on a case by case basis in the interests of public health practice. (5) If a request for client-specific data is denied, aggregate/de-identified data may be provided at the discretion of the IIS manager. (6) The Public Health Division may report violations of these rules by any authorized user who has accessed a client's record to the appropriate licensing or regulatory authority.