(a)

1. (1) A statewide immunization registry shall be established and include data as specified by the Department of Health.

2. (2)

   1. (A) All persons under twenty-two (22) years of age receiving immunizations shall be enrolled into the registry.
   2. (B) As of January 1993, all newborns to Arkansas residents have been automatically enrolled.
3. (3) Persons age twenty-two (22) years or older may be enrolled into the registry.

4. (4) The minimum data elements to be furnished by the provider in an immunization record in the immunization registry are:

   1. (A) Clinic name;
   2. (B) Clinic code;
   3. (C) Name;
   4. (D) Date of birth;
   5. (E) Address;
   6. (F) Mother’s name (maiden name preferred);
   7. (G) Gender and race;
   8. (H) Shot type;
   9. (I) Date immunization given;
   10. (J) Provider number;
   11. (K) Lot number;
   12. (L) Insurance status;
   13. (M) All previous immunizations if not given by the reporting provider; and
   14. (N) Vaccine manufacturer.

(b)

1. (1) All providers who provide immunizations to persons under twenty-two (22) years of age shall register with the department.
2. (2) Providers who provide immunizations to persons age twenty-two (22) years or older may register with the department.

3. (3) Enrollment.

   1. (A) The Immunization Branch shall maintain a current listing of providers.
   2. (B) The Immunization Branch shall respond to providers by:

(i) Assigning a clinic code; and

1. (ii) Supplying the provider agreement (see subdivision (b)(4) of this section) for signature by a physician or administrator.

   1. (C) The Immunization’s Branch response shall also include instructions for the provider to:

      1. (i) Submit reports of doses given; and
      2. (ii) Make requests for immunization records.

2. (4) Department/provider agreement.

   1. (A) A signed agreement shall be kept on file by the Immunization Branch and the provider.
   2. (B) It shall specify the purpose for the information and outline required security/confidentiality measures.
   3. (C) Statements on disclosure of information specifying what and how information is to be released shall be included.

   4. (D) Providers signing the agreement will specifically certify that information will be accessed only on persons for whom they have medical responsibility.

      1. (c)
3. (1) All providers shall report to the department the administration of any childhood immunization to any person under twenty-two (22) years of age.
4. (2) A department-approved format for the reporting of data shall be used by all providers to report immunizations given.
5. (3) Providers shall submit information on immunizations provided within two (2) weeks of administration.
6. (4) When reporting immunizations, previous unreported doses shall also be reported to provide a complete immunization history to the registry.

7. (5)

   1. (A) Failure to report shall result in the department contacting the provider to encourage compliance.

   2. (B) Continued noncompliance may result in sanctions not to exceed twenty-five dollars ($25.00) and/or removal from the Vaccines For Children (VFC) program.

      1. (d)
8. (1) Providers may report immunizations given to individuals age twenty-two (22) years or older to the registry.
9. (2) A department-approved format for the reporting of data shall be used by all providers to report immunizations given.
10. (3) Providers should submit information on immunizations provided within two (2) weeks of administration.
11. (4) When reporting immunizations, previous unreported doses, if available, should also be reported to provide a complete immunization history to the registry.

(e)

1. (1)

   1. (A) The department shall upon request make information regarding the immunization status of individuals in the registry available to:

      1. (i) An individual requesting a copy of his or her immunization record;
      2. (ii) The parents or legal guardians of the child;
      3. (iii) Providers who report on the immunization status of individuals in their care; and
      4. (iv) Such other persons or organizations authorized by the State Board of Health.
   2. (B) The Immunization Branch will evaluate the written documentation requesting access to information from the registry.
   3. (C) If the request is authorized within this part and criteria approved by the board, the Immunization Branch will grant access to the information.

2. (2) Providers.

   1. (A) When written requests are used, they shall be made on letterhead and include the:

      1. (i) Provider’s clinic code (if applicable);
      2. (ii) Patient name; and
      3. (iii) Date of birth.
   2. (B) Phone requests shall be accepted, but only if the clinic code (if applicable) is provided along with patient name and date of birth.

   3. (C)

      1. (i) Faxed requests shall be submitted on letterhead and include the:

(b) (b) Patient name; and

1. (c) (c) Date of birth.

   1. (ii) The information shall be faxed or phoned to the numbers on file only.

   2. (D) Electronic requests shall be accepted if they include the:

      1. (i) Provider’s clinic code (if applicable);
      2. (ii) Patient name; and
      3. (iii) Date of birth.

2. (3) Parents/legal guardians of children/self.

   1. (A) Parents/legal guardians of children/self shall receive immunization information from the registry without providing consent for the release of information.
   2. (B) Requests may be made in writing, in person, electronically, or by fax with requested qualifying the information.

3. (4) Other persons or organizations.

   1. (A)

      1. (i) If accompanied by a Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, compliant authorization to disclose on AS Form 4000 signed by a parent or guardian, written requests shall be granted.
      2. (ii) The request shall include the patient name and date of birth.
      3. (iii) Information shall include the requesting party’s:

(b) (b) Mailing address; and

1. (c) (c) Phone number.

   1. (B) Phone requests shall not be granted.

   2. (C)

      1. (i) Faxed and electronic requests shall:

(b) (b) Include the patient name and date of birth.

1. (ii) Information shall include the requesting party’s:

(b) (b) Email or mailing address;

1. (c) (c) Phone number; and

   1. (d) (d) Fax number.
   2. (D) Any licensed daycare facility responsible for ensuring compliance with immunization requirements may have read-only access after the submission of a signed user agreement.
2. (5) Granting access to the registry does not commit the department to any expense.

(f)

1. (1) Confidentiality of medical information shall be observed.
2. (2) The patient’s name, date of birth, and immunization information shall be the only information released from the registry.
3. (3) No further identifying or contact information shall be disclosed.