Idaho AG’s Office to GOP leaders: Yes, it is legal to keep adult vaccine records
Changing the law would have unforeseen consequences, says deputy AG
Republican leaders in the Idaho Legislature this year accused the state of unlawfully keeping vaccination records and said the records should be destroyed.
But a response from the Idaho Attorney General’s Office told them they were wrong.
House and Senate Republican leaders on April 9 sent a letter to Idaho Attorney General Lawrence Wasden that claimed the state’s Immunization Reminder Information System wasn’t allowed to keep records of vaccines received by adults. They said Idaho laws and regulations allowed IRIS only to keep records on childhood vaccines administered to children, and that the Idaho Department of Health and Welfare should destroy records of adult immunizations.
“As part of our due diligence, several members of the Legislature requested any of their own personal records that may have been reported to IRIS in an attempt to trace the reporting of the COVID-19 vaccines,” said the letter, signed by Senate President Pro Tempore Chuck Winder, House Speaker Scott Bedke and several other GOP legislative leaders. “These requests resulted in multiple reports listing adult vaccination records for multiple different vaccines over multiple years.”
The IRIS system is similar to those used by other states. It helps health care providers remind people when they, or their children, are due for vaccines. Child care providers can access it to verify a child’s vaccine status. It also maintains a record so that, for example, a patient with a short memory doesn’t get a tetanus booster shot every year.
The state also has used aggregate data from IRIS to track vaccine trends during the pandemic.
The records are stored securely and made accessible only to health care providers, child care providers and schools. Individual patients also can request their own records, or opt to have their records excluded from IRIS.
A letter April 29 from Chief Deputy Attorney General Brian Kane explained that while Idaho statute calls for a “voluntary immunization registry for children,” there is no prohibition against its use for adult vaccination records.
The question ultimately raised by your letter is therefore whether the department can only maintain a voluntary adult immunization registry if expressly authorized by the Idaho Legislature. The answer is that the department ... may exercise its executive and administrative discretion to maintain an adult registry for the following reasons: (1) The department, the director of the department, and the Board of Health and Welfare are granted the broad obligation and authority to protect the life, health, and mental health of the people of Idaho ... as well as the express authority to maintain a vaccine registry for children, (2) the maintenance of adult vaccination information in IRIS is reasonably necessary to carry out these statutory charges given the practical health and safety purpose of maintaining vaccination information, and (3) the maintenance of an adult registry is not expressly prohibited. – Brian Kane letter, April 29
The letter goes on to describe instances since 2013 that the Idaho Legislature has discussed or deliberated upon adult immunizations being included in IRIS, with one former legislator even asking how Idaho could compel pharmacies — which vaccinate mostly adults — to start adding vaccine records to IRIS.
When the House and Senate majority leaders sent their letter to the AG’s Office on April 9, they issued a news release April 9 that criticized the use of IRIS to store adults’ vaccination records.
Bedke said in the release that he believes the IRIS record-keeping “goes beyond simple regulatory overreach. This has the potential to be an abuse of the people’s trust.”
Winder said in the release that IRIS “is intended to protect Idaho children and instead it’s being used to collect Idahoans’ health information without their knowledge.”
Kane’s letter explains why changing the law, to forbid IRIS from holding adult vaccination records, may be unwise.
“If there is a desire to specify that adult vaccination information shall not be included in IRIS, the Legislature has the authority to prohibit such activity,” he wrote. “But it is important to note that the registry, as discussed above, fulfills an important public health function by allowing for the sharing of information among medical providers for those who have opted in.”
Prohibiting that wouldn’t keep the records from being collected, he said.
“The CDC requires that providers who give COVID-19 vaccines be enrolled through a Vaccination Provider Agreement with the CDC. These agreements require providers to receive training on proper vaccine administration, management, and reporting of vaccine inventories, and to register vaccine administration in their state’s immunization registry.”
Without agreeing to that, health care providers won’t receive the vaccines to administer to Idahoans, he wrote.
If the Legislature were to prohibit the use of IRIS for adult vaccine records, Idaho may have to create a new registry, which could “possibly delay or discourage vaccinations against COVID-19,” he wrote. “Even more troubling is that such a registry would be governed and administered by the federal government without the information security protections … and opt-outs that Idaho has provided for.”
It’s also untrue that Idaho adults aren’t notified that their vaccine records are stored in IRIS.
The fact sheets for the Moderna, Pfizer and Johnson & Johnson COVID-19 vaccines, for example, notify patients that their vaccine record may be entered into an immunization information system. The Moderna and Pfizer fact sheets explain that the record helps to ensure they receive the same type of vaccine when they return for a second dose.
In addition, the Idaho Department of Health and Welfare and the CDC have for many years publicly reported Idaho’s vaccination rates for childhood and all-ages vaccines.