Chapter 115. Virginia Immunization Information System
12VAC5-115-10. Definitions.
The following words and terms when used in this chapter shall have the following meanings unless the context clearly indicates otherwise:
"Commissioner" means the State Health Commissioner or the State Health Commissioner's designee.
"Data exchange" means electronically sending immunization information from an existing information system to VIIS and being able to retrieve information from VIIS.
"De-duplication" means the process in information systems that matches incoming data with existing client records and merges those identified as the same client.
"Health care entity" means the same as that term is defined in § 32.1-127.1:03 of the Code of Virginia.
"Health care provider" means the same as that term is defined in § 32.1-127.1:03 of the Code of Virginia.
"Health plan" means the same as that term is defined in § 32.1-127.1:03 of the Code of Virginia.
"Participant" means a person or organization with a VIIS account.
"Patient" means the client who is receiving health services.
"Public health emergency" means any (i) public health event caused by an act of bio-terrorism or vaccine-preventable disease outbreak or (ii) other public health event resulting from natural or human cause.
"Security role" means the level of security assigned to a participant that determines what information the individual may access in the application and what system functions may be performed.
"VDH" or "Department of Health" means the Virginia Department of Health.
"Virginia Immunization Information System" or "VIIS" means the statewide immunization registry.
"VITA" means the Virginia Information Technologies Agency.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-20. Authorized participants.
A. A health care provider in the Commonwealth who administers immunizations shall report to VIIS pursuant to § 32.1-46.01 of the Code of Virginia and this chapter. No health care provider required to report patient immunization information to VIIS pursuant to § 32.1-46.01 of the Code of Virginia shall be required to pay a fee to VDH to participate in VIIS.
B. A health care entity is authorized to participate in VIIS so long as the health care entity is licensed or certified in Virginia to deliver or support health care services or public health and requires immunization data to support a purpose listed in § 32.1-46.01 A of the Code of Virginia.
C. Other state or regional immunization registries may share data and have access to data from VIIS by contacting the VIIS program manager and complying with the registration procedure in 12VAC5-115-30.
D. VDH shall give access to VIIS under the condition that having access to immunization information is required to perform the job function of the participant. The VIIS program manager or designee shall assign the security role of the participant based on needs and job responsibilities of the VIIS program manager or designee.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-30. Registration procedures.
A. To gain access to VIIS, an authorized participant shall complete the VIIS electronic registration process. The participant shall complete the electronic registration process every year as directed by VDH. Registration shall require the participant to ensure compliance with necessary confidentiality and security access provisions that specify security procedures to ensure that VIIS data are protected from unauthorized view and access.
B. VDH must approve the registration before granting the participant access to the system.
C. VDH shall confirm the participant completed VDH-specified training and then activate the participant in the VIIS system.
D. A qualifying participant organization shall designate an administrator for the participant's organization. The administrator may then allow VIIS access by an employee in the administrator's organization and, in doing so, shall assume responsibility for registering that person, ensuring the employee is trained and has reviewed the VDH security requirements for VIIS, assigning the security role of the participant, accepting legal responsibility for the participant's proper use of VIIS, and terminating access to VIIS if the participant is noncompliant with VIIS requirements or no longer requires access.
E. If a participant’s access is terminated, the data entered by the participant shall remain in the system.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 38, Issue 8, eff. January 7, 2022; Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-40. Patient confidentiality.
A. A participant may only access individual immunization information within VIIS that is required to perform the participant's job function.
B. No participant may conduct any activity that jeopardizes the proper function or security of VIIS, including sharing of sign-on information, allowing unauthorized view of VIIS screens, or failing to log off VIIS when leaving a workstation. A participant may only use VIIS patient-level data for a purpose listed in § 32.1-46.01 A of the Code of Virginia and must immediately notify the patient and VDH of any breach of personal privacy or confidentiality.
C. No employer may access an employee's patient-level data in VIIS for the purpose of determining if the employee is in compliance with the employer's immunization policies.
D. A patient may opt out of VIIS by completing the electronic VDH Opt-Out Form specifying the patient's opt-out preferences.
E. Patient immunization records may not be copied except for authorized use. The copies may not be left where they are visible by unauthorized personnel and shall be shredded, pulped, or incinerated before disposal.
F. VIIS records shall be treated with the same confidentiality and privacy as any other health record. VDH shall immediately suspend a participant's system access privileges for inappropriate use of VIIS records and shall conduct an investigation. VDH may take additional actions pursuant to § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges.
G. Nothing in this chapter alters the provision in 45 CFR Part 164 that permits covered health care entities to disclose protected health information to a public health authority without individual authorization.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-50. Security.
A. The VIIS system shall automatically inactivate a user session after a predetermined period of inactivity as determined by VITA security policy.
B. The VIIS system shall inactivate a participant’s account, denying access to the system when the participant has not logged into the system after a predetermined period of time, as determined by VITA security policy. If the participant requests reactivation of the account, VDH shall review the request and may reactivate the account, granting continued access to VIIS.
C. There shall be a secure encrypted connection, as determined by VITA or VDH, between VIIS and the participating organization sending or receiving data if data exchange is performed.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-60. Population of VIIS.
A. The VDH Division of Immunization and Office of Vital Records shall have an agreement to populate demographic information in VIIS with birth certificate data. Death certificate data shall be used to make the VIIS record no longer viewable. The data shall be transmitted via electronic data exchange.
B. A participant shall make every effort to ensure the accuracy of all immunization and demographic information and shall include enough identifying information to allow for de-duplication of patients.
C. Data shall be reported in VIIS either by online data entry or by data exchange of files from other information systems. Reporting shall occur within three days of vaccine administration.
D. Both demographic and immunization data shall be reported for each immunization administered.
1. Patient demographic information shall include the patient's name and date of birth in order to be accepted by VIIS. The following information is required, if available: gender, telephone number, email, home address, race, ethnicity, birth place, and mother's maiden name.
2. Patient immunization information shall include the type of immunization administered using industry standards, such as vaccine groups, Health Level 7 codes, or Current Procedural Terminology codes; date the immunization was administered; identity of the health care provider who administered the vaccine; manufacturer; trade name; lot number; and, if present, any contraindications or religious or medical exemptions.
E. Participants in data exchange shall provide an acceptable level of data quality, such as correct data fields, data accuracy, and enough information to correctly merge with existing patients. Upon initial data delivery, and periodically thereafter, VDH shall review data to determine data quality and shall notify a participant if the data quality is not acceptable, including notice of any rejected records. The participant shall resolve a rejected record in a timely manner, not to exceed 30 days after notice from VDH. VDH may suspend system privileges and take additional action in accordance with § 32.1-27 of the Code of Virginia for a participant who knowingly submits inaccurate data or repeatedly provides an unacceptable level of data quality.
F. If insufficient information is reported to allow de-duplication of patients, VDH shall place incoming data in a pending file and merge the data manually, if appropriate. All participants shall identify a contact to work with VDH on pending files.
G. VDH shall incorporate immunization data pursuant to § 32.1-46 E of the Code of Virginia into VIIS by data exchange from other immunization systems, patient care management billing systems, or information systems to the extent possible.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-70. Release of VIIS data.
A. Individual patient data may not be disclosed except to the extent required or permitted by state and federal law or regulations.
B. Patient data shall be erased when no longer needed, when IT equipment is being terminated, or in accordance with a data sharing agreement or a participant registration agreement with VDH.
C. Aggregate data from which personal identifying data has been removed or redacted may be released for the purposes of statistical analysis, research, or reporting only after approval by VDH.
D. VDH shall immediately suspend a participant's system access privileges for inappropriate use of VIIS data and shall conduct an investigation. VDH may take additional actions in accordance with § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges upon satisfactory completion of required remedial actions and guarantee of proper use of VIIS in the future.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.
12VAC5-115-80. Data access in public health emergency.
A. The commissioner may access and release VIIS data in accordance with §§ 32.1-40 and 32.1-41 of the Code of Virginia.
B. The commissioner may designate additional persons to view VIIS information during a public health emergency. VDH shall contact designated authorized users, provide instruction for those who are not current participants, and activate an account.
C. The commissioner may include public health emergency announcements and notices or guidelines on the main screen that may be viewed immediately by the VIIS participants.
Statutory Authority
§ 32.1-46.01 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015.
Forms (12VAC5-115)
Administrator Information, VIISADM (eff. 10/2012)
Electronic Data Exchange with VIIS (eff. 10/2012)
Information Systems Security Access Agreement (eff. 10/2012)
Organization Information, VIISORG (eff. 10/2012)
Virginia Immunization Information System (VIIS) Opt-In of VIIS (reviewed 6/2015)
Virginia Immunization Information System (VIIS) Opt-Out of VIIS (reviewed 6/2015)
VIIS Security Policy and User Confidentiality Agreement (rev. 5/2019)