News and Events

California Assembly Bill 1797, “Immunization Registry”, is currently making its way through the California Legislature. At this writing, the bill:

• Changes provider participation in CAIR2 from voluntary to mandatory.
• Changes most demographic data elements, including race and ethnicity, from “required if available” (as determined by the HL7 implementation guide) to “required”.
• Contains the language: “In the case of schools, childcare facilities, family childcare homes, and county human services agencies, for the COVID-19 public health emergency, to perform immunization status assessments of pupils, adults, and clients to ensure health and safety.” The bill contains special language defining the COVID-19 emergency as lasting until 2026.

Software Partners’ position on AB 1797 and patient privacy:

1. Mandating provider participation in immunization registries is generally not effective.
There are a variety of reasons for this:

• Immunization registries, being regional, lose track of individuals who cross jurisdiction borders.
• Reporting immunizations to the government creates a disincentive for some populations to get vaccinated.
• It is difficult or impossible to enforce the mandate if providers who prefer to protect patient privacy fail to comply.
• Certain providers may also be disincentivized to give immunizations at all.
• Government control over the supply of vaccine, such as the COVID-19 emergency, or for “Vaccines For Children”, provides a much more effective mechanism to enforce reporting, making the mandate unnecessary. In December of 2020, the Los Angeles Times reported that “Doctors and clinics who want to provide the COVID-19 vaccine must sign a federal agreement requiring them to send each patient’s detailed personal information to the state’s vaccine registry within 24 hours.” 1 This requirement reflects in California public reporting of COVID-19 vaccination rates. Dr. Wilma Wooten stated in May that 94% of San Diegans have at least one COVID-19 vaccine. These numbers came from the San Diego immunization registry.

2. Making data elements mandatory instead of “required if available” is problematic.

If the data to be reported isn’t available, the reporting system has to be programmed to use a default, or the data entry user must take a guess. This causes bad data to be submitted to the immunization registry. Providers will also incur substantial costs not mentioned in the bill in order to modify their existing interfaces to populate fields previously left empty due to unavailability of data. Reimbursement for such costs is not included in the bill.

Instead, we suggest changes to California law to more rigorously implement the patient’s
option to “opt out” of CAIR2.

Presently, in California, “opt out” only means that the medical record of the person opting out is “locked” from sharing with other providers; the patient’s record still goes into CAIR2. The potential in CAIR2 for patient record errors noted elsewhere on this website creates further risk of inadvertent disclosure of records that are meant to be locked.

We feel that either an “opt in” policy, or the existing “opt out” policy, should be interpreted as excluding the record altogether. Software Partners’ IZD technology (link to IZD page) does provide a way to exclude “confidential” records arriving on HL7 interfaces from being stored within it, and from passing through to CAIR2 or any other immunization registry. At most, only records entered directly into CAIR2 using data entry screens by the providers who lack an EHR for patient care should be stored. Even then, such should be kept separate from records from those entered by other providers, as they are in the Matchmerge Immunization Registry (MIR) (link) software. We believe this double use of CAIR2 for patient care and public health explains why the law – written decades ago – is currently written as it is. Given the preponderance of HL7 interfaces today, the technology now exists to fully and correctly implement “opt out” or even “opt in”. Claiming that patients can “opt out” of CAIR2 without such implementation is misleading to the public.

Software Partners has submitted the letter below:

View Letter