Immunization Registry: requesting your vaccine record and fixing an error

It is the Health Department database collecting demographic information and the history of all vaccines administered to children, adolescents and adults in Puerto Rico. The law places it in the Department’s Immunization Division and orders it maintained. Two connections define how it works: the Registry **must be linked to Puerto Rico’s Demographic Registry such that registering a birth creates an immunization file**, and it must be able to interact and exchange information with the Puerto Rico Medicaid Management and Information System (PRMMIS), meeting the Center for Medicare and Medicaid Services (CMS) requirements.

Any person, as to their own information. The law extends the right to the information **of their minor children and of persons under their guardianship**. There is no age, health plan or place-of-vaccination requirement: the Registry collects vaccines administered to children, adolescents and adults in Puerto Rico.

• Requesting your own information, or that of a minor child or a person under your guardianship. The law recognizes the right to inspect and to request a copy in those three cases.Verified against the official source
• To correct an error, identify the health provider who administered the vaccine: the law directs the rectification request to that provider.Verified against the official source

• The vaccination certificate or P-VAC-3, which the law defines as the form provided by the Health Department, signed by the physician, the authorized certified pharmacist or the health professional who administers the vaccine, certifying that a person has been vaccinated against a given disease. The law says it may be on paper or electronic, through the Health Department and Immunization Registry portal.

1. 1

   Step 1: Your right to see and to copy

   Article 6 says it in one sentence: **any person may inspect and request a copy of their own information in the Registry and that of their minor children and of persons under their guardianship**. Two distinct verbs — inspect and request a copy — and three holders: yourself, minor children and persons under guardianship. The same sentence adds the correction route, which we treat separately. The article closes saying **the Secretary shall establish by regulation everything concerning security measures and access levels to the Registry’s information**; that regulation is not in the law and we do not publish it, so we publish no form, portal, copy cost or turnaround.

2. 2

   Step 2: If there is an error, you ask the provider

   This is the practical detail that saves trips. The law does not say you ask the Health Department for the correction: it says that, **if they believe there is an error, they may ask the health provider who administered the vaccine to rectify the Registry’s information**. The law defines "provider" as a health professional, pharmacy or pharmacist, or health care facility duly authorized and licensed to provide health care services in Puerto Rico. That is: the clinic, pharmacy or pediatrician who gave the shot is who to go to. And there is a system reason behind it: Article 5 says the primary duty to report belongs to the provider, and that the provider must ensure the information is reported and that the reported information is correct.

3. 3

   Step 3: The Registry counts as proof

   Article 6 says the Registry shall disclose a person’s immunization information **to health providers and to the schools or day-care centers where the person is enrolled**. And it adds the consequence: **the information in the Immunization Registry shall be conclusive proof of the vaccines administered to a person**, and therefore any health provider or educational institution **may rely on the information in the Registry to determine whether the person meets the immunization requirements of any law or regulation**. That is what solves the lost-paper case: the data is in the Registry and the school may rely on it.

4. 4

   Step 4: A file that is born with the birth

   Article 3 orders the Department to maintain its Immunization Registry, called the Puerto Rico Immunization Registry, attached to the Immunization Division, to collect demographic information and the history of all vaccines administered to children, adolescents and adults in Puerto Rico. And it sets two architectural requirements: **the Registry must be linked to Puerto Rico’s Demographic Registry such that when a birth is registered an immunization file is created in the Immunization Registry**; and it must be able to interact and exchange information with PRMMIS, meeting any requirement the CMS sets.

5. 5

   Step 5: What gets reported about you, and how soon

   Article 4 sets the duty in two layers. The first is the provider’s: **within a term of no more than fifteen (15) days, every health provider who administers vaccines must, on each occasion they administer one, report to the Registry**. The law lists what information, without limiting itself to it: given and family names, sex, phone and address of the vaccinated person; date and place of birth, including birth hospital if applicable; postal code and municipality of residence; social security number as universal number; date of vaccination; the specific type of vaccine administered on that date, **including manufacturer and lot number**; and the health service organization or insurer whose coverage is being used, if applicable. For persons under eighteen (18), the mother’s and father’s name with both surnames, address and phone, or those of the legal guardians, are also reported. The second layer is the payer’s: **quarterly, every health service organization or insurer, self-insured entity, third-party service administrator or health plan must share with the Registry each vaccine administered under coverage to one of its insureds during the past quarter, without being able to delegate this function or demand it for contracting purposes of the provider or administrator of the vaccine**. The Secretary sets by administrative order the calendar of those quarterly dates.

6. 6

   Step 6: When the data does not match

   Article 5 sets up a cross-check between the two sources. The Registry must be able to reconcile the information received from providers with that received from insurers, self-insured entities, third-party administrators or health plans, **so that discrepancies can be detected**. When one is detected, **the Department shall notify both parties of that discrepancy, giving them a term of ten (10) days to explain and cure the error or omission to the Secretary’s satisfaction**. If the provider does not cure or commits repeated faults, the Secretary may impose the corresponding sanctions, including administrative fines, per occurrence, set under the agency’s regulations. If the non-complying party is an insurer, self-insured entity, third-party administrator or health plan, the Secretary notifies them and gives ten (10) days to cure; once the term lapses, **the situation is referred to the Office of the Insurance Commissioner, which shall impose an administrative fine per incident** under its governing regulations. The law further clarifies that nothing prevents a provider from contracting or delegating data entry to another person, but **the primary duty to report belongs to the provider**. And it orders the Secretary to establish protocols to identify fraud, waste and abuse in vaccine administration, and to refer every case to state and federal law enforcement agencies, such as the Medicaid Fraud Control Unit, the Department of Justice and the federal Department of Health and Human Services Office of Inspector General. **We publish no fine amounts: the law leaves them to each agency’s regulations.**

7. 7

   Step 7: Privacy and statistics

   Article 6 opens by saying **all information in the Registry must be classified and handled as Protected Health Information (PHI) under HIPAA**, federal Public Law 104-191 of 1996. And it closes with a bounded statistical outlet: **the Secretary shall share with the Institute of Statistics all information collected in the registry whose disclosure is not prohibited or protected by federal and state laws and regulations**, for public dissemination, demographic analysis or any other scientific research. Both sentences must be read together: what is shared for statistics is what is neither prohibited nor protected.

To inspect or request a copy, before the Health Department, through its Immunization Division, where the law places the Registry. To correct an error, before the health provider who administered the vaccine: the law directs the rectification request there. The school or day-care center where the person is enrolled receives the information directly from the Registry and may rely on it as conclusive proof. What we do not publish: the form, the portal, the Immunization Division’s address or phone, the cost of a copy or how long it takes, because Act 169-2019 defers all of that to the regulations the Secretary was to issue within ninety (90) days of the law’s approval, and those regulations are not in the legal text; that is why cost and processing time stay unverified.

• Asking the Health Department to fix the error: the law directs the rectification request to the provider who administered the vaccine.
• Believing you may only see your own file: the right reaches your minor children’s and that of persons under your guardianship.
• Giving up on the record because the paper was lost: the Registry’s information is conclusive proof of the vaccines administered.
• Panicking because a recent vaccine does not appear: the provider has up to fifteen days to report it to the Registry.
• Accepting that the health plan pass its reporting duty to the provider: the law prohibits delegating it or demanding it by contract.
• Not following up on a discrepancy: the Department notifies both parties and gives them ten days to explain and cure.
• Assuming the school needs the signed paper: the Registry discloses the information to the schools and day-care centers where the person is enrolled.

These are the government pages this guide is based on.

• Departamento de Salud de Puerto Rico

  Salud

  bvirtualogp.pr.gov

• Puerto Rico Department of Health

  Salud

  www.salud.pr.gov

• Office of the Insurance Commissioner (OCS)

  OCS

  www.ocs.pr.gov