Q: Our health care facility has just started mandating vaccines and we are finding that a number of our employees have misplaced their vaccine cards. Our facility is an authorized user of IRIS (Immunization Registry Information System) can we use it to check if the employee has been vaccinated?

A: Yes, but you need a consent form from the employee. 

IRIS is not intended to be used by employers to double-check employee health records, although it may be used as part of an employee health program. 

As an authorized site user, your organization would have signed an authorized site agreement which requires that you comply with all IRIS requirements including their privacy and security policies. The site agreement itself indicates that the facility will “only access immunization and other health screening information in IRIS for individuals to whom the organization provides services or is necessary to perform a legally authorized function of the organization.” IDPH has stated that this may include checking employee vaccines broadly to help employees complete all vaccines and identify vaccine gaps. 

Also note the security and confidentiality policies of IRIS state, “Information in IRIS is confidential under Iowa law. Enrolled users shall not release immunization or health screening data obtained from the registry except to the person immunized or screened, the parent or legal guardian of the person immunized or screened, admitting officials of licensed child-care centers and schools, medical or health care providers providing continuity of care, and other enrolled users of the registry.” However, based on these statements, if an employee could not produce a vaccine registry card and requested access to IRIS data, a consent form from the employee could be obtained which would be kept in the employee health file and would allow the facility to access the IRIS system based on that request.

The consent forms found online are primarily requests made to the state for access, any consent obtained from an employee should specifically consent to access the database and vaccine registry.