(a) The department, for the primary purpose of establishing and maintaining a single repository of accurate, complete, and current immunization records to be used in aiding, coordinating, and promoting efficient and cost-effective communicable disease prevention and control efforts, shall establish and maintain an immunization registry. The executive commissioner by rule shall develop guidelines to:
(1) protect the confidentiality of patients in accordance with § 159.002, Occupations Code;
(2) inform the individual or the individual’s legally authorized representative about the registry and that registry information may be released under § 161.00735;
(3) require the written or electronic consent of the individual or the individual’s legally authorized representative before any information relating to the individual is included in the registry;
(4) permit the individual or the individual’s legally authorized representative to withdraw consent for the individual to be included in the registry; and
(5) determine the process by which consent is verified, including affirmation by a health care provider, birth registrar, regional health information exchange, or local immunization registry that consent has been obtained.
(a-1) The written or electronic consent required by Subsection (a)(3) for an individual younger than 18 years of age is required to be obtained only one time. The written or electronic consent of the individual’s parent, managing conservator, or guardian must be submitted to the department before the individual’s 18th birthday. After consent is submitted, the individual’s immunization information may be included in the registry until the individual becomes 26 years of age unless the consent is withdrawn in writing or electronically, or renewed after the individual’s 18th birthday as provided by Subsection (a-2). A parent, managing conservator, or guardian of a minor may provide the consent by using an electronic signature on the minor’s birth certificate.

(a-2) The written or electronic consent required by Subsection (a)(3) for an individual who is 18 years of age or older is required to be obtained only one time and must be received from the individual before the information may be released. An individual’s legally authorized representative or the individual, after the individual has attained 18 years of age, may consent in writing or electronically for the individual’s information to remain in the registry. The consent of the representative or individual is valid until the individual or the individual’s legally authorized representative withdraws consent in writing or electronically. The department may not include in the registry the immunization information of an individual who is 26 years of age or older until written or electronic consent has been obtained as provided by this subsection. The department shall coordinate with the Texas Education Agency to distribute materials described in § 161.0095(a)(2) to students and parents through local school districts.
(a-3) The executive commissioner by rule shall develop guidelines and procedures for obtaining consent from an individual after the individual’s 18th birthday, including procedures for retaining immunization information in a separate database that is inaccessible by any person other than the department during the eight-year period during which an individual who is 18 years of age or older may consent to inclusion in the registry under Subsection (a-2).
(a-4) After an individual’s 18th birthday, the department shall make a reasonable effort to provide notice to an individual whose immunization information is included in the registry with consent that was provided by a parent, managing conservator, or guardian under Subsection (a-1). The reasonable effort shall include at least two attempts by the department to provide the notice required by this subsection by telephone or e-mail, by regular mail to the individual’s last known address, or by general outreach efforts through the individual’s health care provider, school district, or institution of higher education. The notice must inform the individual that the individual’s immunization records will be included in the registry until the date of the individual’s 26th birthday unless the individual or the individual’s legally authorized representative:
(1) withdraws consent in writing or electronically before that date; or
(2) provides consent for the records to continue to be included in the registry as provided by Subsection (a-2).
(a-5) After an individual’s 25th birthday, the department shall make a reasonable effort to provide notice to an individual whose immunization information is included in the registry with consent that was provided under Subsection (a-1) and has not been renewed under Subsection (a-2). The reasonable effort shall include at least two attempts by the department to provide the notice required by this subsection by telephone or e-mail, by regular mail to the individual’s last known address, or by general outreach efforts through the individual’s health care provider or institution of higher education. The notice must inform the individual that the individual’s immunization records will be included in the immunization registry until the individual’s 26th birthday unless the individual or the individual’s legally authorized representative renews consent as provided by Subsection (a-2).
(a-6) The department shall make a reasonable effort to obtain current contact information for written or electronic notices sent by the department under Subsection (a-5) that are returned due to incorrect address information.
(b) Except as provided by § 161.0071, the immunization registry must contain information on the immunization history that is obtained by the department under:
(1) this section of each individual for whom consent has been obtained in accordance with guidelines adopted under Subsection (a);
(2) § 161.00705 of persons immunized to prepare for or in response to a declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency;
(3) § 161.00706 of first responders or their immediate family members; and
(4) § 161.00735 of persons evacuated or relocated to this state because of a disaster.
(b-1) The department shall remove from the registry information for any individual for whom consent has been withdrawn. The department may not retain individually identifiable information about any individual:
(1) for whom consent has been withdrawn;
(2) for whom a consent for continued inclusion in the registry following the end of the declared disaster, public health emergency, terrorist attack, hostile military or paramilitary action, or extraordinary law enforcement emergency has not been received under § 161.00705(f);
(3) for whom a request to be removed from the registry has been received under § 161.00706(e);
(4) for whom consent for continued inclusion in the registry following the end of a disaster has not been received under § 161.00735(f); or
(5) for whom a request to remove information from the registry has been received under § 161.00735(g).
(c) A payor that receives data elements from a health care provider who administers an immunization to an individual younger than 18 years of age shall provide the data elements to the department. A payor is required to provide the department with only the data elements the payor receives from a health care provider. A payor that receives data elements from a health care provider who administers an immunization to an individual 18 years of age or older may provide the data elements to the department. The data elements shall be submitted in a format prescribed by the department. The department shall verify consent before including the reported information in the immunization registry. The department may not retain individually identifiable information about an individual for whom consent cannot be verified.
(d) A health care provider who administers an immunization to an individual younger than 18 years of age shall provide data elements regarding an immunization to the department. A health care provider who administers an immunization to an individual 18 years of age or older may submit data elements regarding an immunization to the department. At the request and with the authorization of the health care provider, the data elements may be submitted through a health information exchange as defined by § 182.151. The data elements shall be submitted in a format prescribed by the department. The department shall verify consent before including the information in the immunization registry. The department may not retain individually identifiable information about an individual for whom consent cannot be verified.
(e) The department shall provide notice to a health care provider that submits an immunization history for an individual for whom consent cannot be verified. The notice shall contain instructions for obtaining consent in accordance with guidelines adopted under Subsection (a) and resubmitting the immunization history to the department.
(f) The department and health care providers may use the registry to provide notices by mail, telephone, personal contact, or other means to an individual or the individual’s legally authorized representative regarding an individual who is due or overdue for a particular type of immunization according to the department’s immunization schedule for children or another analogous schedule recognized by the department for individuals 18 years of age or older. The department shall consult with health care providers to determine the most efficient and cost-effective manner of using the registry to provide those notices.
(g) The department shall provide instruction and education to providers about the immunization registry provider application and enrollment process. The department shall:
(1) initially target providers in the geographic regions of the state with immunization rates below the state average for preschool children; and
(2) expedite the processing of provider applications.
(h) Nothing in this section diminishes a parent’s, managing conservator’s, or guardian’s responsibility for having a child immunized properly, subject to § 161.004(d).
(i) A person, including a health care provider, payor, or an employee of the department who submits or obtains in good faith immunization data elements to or from the department in compliance with the provisions of this section and any rules adopted under this section is not liable for any civil damages.
(j) Except as provided by Sections 161.00705, 161.00706, 161.00735(b), and 161.008, information obtained by the department for the immunization registry is confidential and may be disclosed only with the written or electronic consent of the individual or the individual’s legally authorized representative.
(k) The executive commissioner shall adopt rules to implement this section.