1.1 	A bill for an act
1.2 	relating to health; clarifying access to immunization data; amending Minnesota 
1.3 	Statutes 2020, section 144.3351.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. Minnesota Statutes 2020, section 144.3351, is amended to read:
1.6 	144.3351 IMMUNIZATION DATA.
1.7 	(a) Providers as defined in section 144.291, subdivision 2, group purchasers as defined 
1.8 	in section 62J.03, subdivision 6, elementary or secondary schools or child care facilities as 
1.9 	defined in section 121A.15, subdivision 9, public or private postsecondary educational 
1.10 	institutions as defined in section 135A.14, subdivision 1, paragraph (b), a community health 
1.11 	board as defined in section 145A.02, subdivision 5, community action agencies as defined 
1.12 	in section 256E.31, subdivision 1, and the commissioner of health may exchange 
1.13 	immunization data with one another, without the patient's consent, if the person requesting 
1.14 	access provides services on behalf of the patient access a statewide immunization information 
1.15 	system to obtain immunization data of an individual, without the individual's consent, if 
1.16 	the person requesting the data has entered into an authorized user agreement with the 
1.17 	commissioner of health. The authorized user agreement must specify the privacy and security 
1.18 	terms for authorized users, including the loss of access if an authorized user violates the 
1.19 	terms of the agreement. An authorized user may only access the data for purposes related 
1.20 	to the health of the subject of the data.
1.21 	(b) Any provider administering a vaccine to a patient must inform the patient or the 
1.22 	patient's parent or legal guardian if the patient is a minor of the patient's participation in the 
1.23 	immunization system and of the patient's option to opt out of having the patient's 
2.1 	immunization data made available to authorized users through the immunization information 
2.2 	system. If a patient opts out, the patient's demographic record, including the patient's 
2.3 	immunization data, is not available and cannot be accessed by an authorized user. The 
2.4 	patient may elect to opt in at any time. The patient must not be penalized if the patient 
2.5 	chooses not to participate in the immunization system.
2.6 	(c) Data maintained in the statewide immunization system is private data on individuals, 
2.7 	as defined in section 13.02, subdivision 12. The commissioner must maintain a data audit 
2.8 	trail of all queries and responses and all actions in which data are entered, updated, accessed, 
2.9 	or disseminated. Data contained in the audit trail are public to the extent that the data are 
2.10 	not otherwise classified by law. Upon request, the commissioner must provide an individual 
2.11 	with information from the data audit trail related to the individual's immunization records.
2.12 	(d) The commissioner must immediately and permanently revoke the authorization of 
2.13 	any entity identified in paragraph (a), if any individual who is employed by or under contract 
2.14 	with the entity willfully enters, updates, accesses, shares, or disseminates data in violation 
2.15 	of state or federal law. If an individual willfully gains access to data without authorization 
2.16 	by law, the commissioner must forward the matter to the appropriate prosecuting authority 
2.17 	for prosecution.
2.18 	(e) By January 15 of each odd-numbered year, within existing appropriations, the 
2.19 	commissioner must provide a copy of the data audit trail required under this section to the 
2.20 	commissioner of administration, the chairs and ranking members of the legislative committees 
2.21 	and divisions with jurisdiction over health and human services and data practices, and the 
2.22 	Legislative Commission on Data Practices and Personal Data Privacy or its successor 
2.23 	commission.
2.24 	(f) For purposes of this section immunization data includes:
2.25 	(1) patient's name, address, date of birth, gender, parent or guardian's name; and
2.26 	(2) date vaccine was received, vaccine type, lot number, and manufacturer of all 
2.27 	immunizations received by the patient, and whether there is a contraindication or an adverse 
2.28 	reaction indication.
2.29 	(g) This section applies to all immunization data, regardless of when the immunization 
2.30 	occurred.