Health Law Quick Take: Immunization Registry Information System



Q: Our health care facility has just started mandating vaccines and we are finding that a number of our employees have misplaced their vaccine cards. Our facility is an authorized user of IRIS (Immunization Registry Information System) can we use it to check if the employee has been vaccinated?

A: Yes, but you need a consent form from the employee. 

IRIS is not intended to be used by employers to double-check employee health records, although it may be used as part of an employee health program. 

As an authorized site user, your organization would have signed an authorized site agreement which requires that you comply with all IRIS requirements including their privacy and security policies. The site agreement itself indicates that the facility will “only access immunization and other health screening information in IRIS for individuals to whom the organization provides services or is necessary to perform a legally authorized function of the organization.” IDPH has stated that this may include checking employee vaccines broadly to help employees complete all vaccines and identify vaccine gaps. 

Also note the security and confidentiality policies of IRIS state, “Information in IRIS is confidential under Iowa law. Enrolled users shall not release immunization or health screening data obtained from the registry except to the person immunized or screened, the parent or legal guardian of the person immunized or screened, admitting officials of licensed child-care centers and schools, medical or health care providers providing continuity of care, and other enrolled users of the registry.” However, based on these statements, if an employee could not produce a vaccine registry card and requested access to IRIS data, a consent form from the employee could be obtained which would be kept in the employee health file and would allow the facility to access the IRIS system based on that request.

The consent forms found online are primarily requests made to the state for access, any consent obtained from an employee should specifically consent to access the database and vaccine registry.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dentons | Attorney Advertising

Written by:


Dentons on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.