As defined by the Centers for Disease Control and Prevention (CDC), immunization information systems (IISs) are "confidential, population-based, computerized databases that record all immunization doses administered by participating providers to persons residing within a given geopolitical area."¹ These systems—based at the state, local, and territorial level—have long recorded information on routine vaccinations, and are now being used for information on Coronavirus Disease 2019 (COVID-19) vaccinations. This CRS report provides background on IISs, an overview of the role of IISs during the COVID-19 pandemic, an overview of data and technology challenges faced by IISs, a summary of legislative developments, and a discussion of further selected policy considerations.

Background: Immunization Information Systems

IISs, commonly referred to as immunization registries, are primarily governed by and operated under laws and policies at the state, local, territorial, and tribal (SLTT) level. IISs are typically housed in SLTT public health departments. There are currently 63 IISs in the United States, including in all 50 states, the District of Columbia (DC), four localities, five territories, and three freely associated states.² The federal government, primarily though the CDC, which is based in the Department of Health and Human Services (HHS), supports these systems through grant funding, developing and promoting common IIS standards, and other activities.

Although they can serve many public health and policy purposes, IISs share several purposes:

Enabling consolidated immunization history records. People can get recommended vaccines in several locations—at a hospital, pediatrician's office, school, pharmacy, or a public health department. An IIS consolidates their immunization history in one place. Such immunization history records, which contain identifiable patient information, are generally accessible only to individuals with authorized access under the respective jurisdiction's laws and policies, such as the patient (or patient's parents or legal guardian) or a participating health care provider.³ The majority of jurisdictions allow certain other institutions, such as schools, to access IIS records to determine whether an individual has met that jurisdiction's immunization requirements.⁴

Enabling public health agencies to monitor and study immunizations at a population-level. Public health agencies can use aggregate IIS data to study immunization rates across the population, by demographic groups (e.g., age, sex/gender, or race/ethnicity groups), geographic location, or other variables. These aggregate data can allow public health agencies to target vaccination efforts, such as by targeting education and awareness efforts or by implementing community-based vaccination sites. IISs share de-identified (i.e., data with all identifiers, such as names and addresses, removed) data with CDC for national trend monitoring and studies of immunization rates.⁵

Enabling public health programs. Public health agencies can use IIS data in many ways. For example, during an outbreak of a vaccine-preventable disease, such as measles, an IIS can aid response by helping determine the immunization status of those exposed to the disease (identified through disease investigation and contact tracing) or by identifying geographic areas with low vaccination rates.⁶ IIS data can also support immunization program activities, such as reminder/recall programs, whereby public health agencies or health care providers use the IIS to remind individuals (by phone, text message, or mail) of an upcoming or overdue recommended vaccine dose.⁷

IISs can serve a number of additional purposes, such as supporting clinical decisionmaking and managing vaccine supplies.⁸ IISs can also aid with vaccine safety monitoring.⁹ The authorized uses of a given IIS are generally governed by law, regulations, and policy in the respective jurisdiction.

The use of IISs to improve immunization rates is considered a best practice in public health. For example, the Community Preventive Services Task Force—an independent, nonfederal panel of public health and prevention experts that makes evidence-based recommendations for public health programs—has recommended the use of IISs as a tool to increase vaccination rates, based on a review of over 200 studies.¹⁰

Brief History

A U.S. measles epidemic from 1989 to 1991, where half of all cases occurred among unvaccinated preschool children, prompted concerns about whether U.S. immunization policies and programs effectively ensured that children received recommended immunizations on time.¹¹ Many public and private organizations subsequently started programs to improve childhood immunization coverage. Starting in 1991, the Robert Wood Johnson Foundation (RWJF) launched the All Kids Count program, which funded a selected group of state and local jurisdictions to plan and implement population-based immunization registries. This effort initiated a movement to establish population-based IISs in all states—driven initially by philanthropic organizations. These population-based registries, which involved all participating providers in specific geographic areas, contrasted with the more prevalent member-based immunization registries operated by Healthcare Maintenance Organizations (HMO) prior to the All Kids Count effort, which included records on individuals enrolled in the HMO.¹²

Increased federal support for IISs began in 1992-1993, when CDC began awarding planning grants to develop immunization registries in every state.¹³ In April 1993, President Bill Clinton submitted the Comprehensive Childhood Immunization Initiative Act, a legislative proposal that would have, among other things, authorized a new state grant program to support immunization registries that fed into a national system.¹⁴ Though some provisions of the original bill were enacted in the Omnibus Budget Reconciliation Act of 1993 (P.L. 103-66), the immunization registry-related provisions were not.¹⁵ Still, with increases in CDC's general immunization cooperative agreement funding, many of the 64 jurisdictional grantees (see the text box below) began to use the federal immunization grant funding in the 1990s to support their IISs.¹⁶ CDC reported total allocations of $181.3 million for the development and implementation of a nationwide network of community- and state-based immunization registries from 1993 to 2001.¹⁷ By 2005, almost all states (except New Hampshire) and the District of Columbia had an operational population-based IIS.¹⁸ CDC immunization grant funding to support IIS programs has continued through the George W. Bush, Obama, and Trump Administrations and to this day.¹⁹

Jurisdictions have developed their IIS programs separately from one another. This approach has allowed IIS programs to experiment with different strategies and identify best practices. As a result, IISs have operated under a patchwork of different laws, regulations, and policies at the SLTT level, and have had different functionalities and data practices. In addition, IISs have operated on different technology platforms that are, in some cases, outdated or not fully interoperable with other IISs or the health care system.²⁰ In the late 1990s, CDC, along with relevant stakeholders such as RWJF, began developing recommended common functional standards for IISs. These standards have been updated over the years and have evolved following major health information technology (HIT) reform pursuant to the Health Information Technology for Economic and Clinical Health Act (HITECH) enacted in 2009.²¹ Standards development efforts have generally focused on issues such as data quality and sharing, privacy and confidentiality, clinical decision support, and immunization program operations.²² In addition, the federal government has over the years undertaken a number of strategies, policies, and programs related to IISs—such as efforts aimed at improving data quality or informing programmatic uses.²³

Current Status of IISs

IISs were originally developed for childhood immunizations; however, in many jurisdictions IIS programs have expanded to include adolescent and adult immunizations. IISs are also being used to record COVID-19 vaccination data (see the "IISs in the COVID-19 Vaccination Program" section of this report). According to a CDC survey of IISs, the percentage of the population represented in IISs at the national level (excluding territories) in 2020 by age group were²⁴

• 94% of children under the age of six with two or more immunizations recorded;
• 84% of adolescents aged 11-17 with two or more adolescent immunizations recorded; and
• 68% of adults aged 18 or older with one or more adult immunization recorded.

Many IISs currently link automatically to jurisdictions' birth records to establish and create a consolidated immunization history record in the IIS for individuals born in that jurisdiction.'²⁵

Current Federal Roles

In the years preceding the COVID-19 pandemic, the federal government supported IISs in the following key ways:

Funding. Jurisdictions receive federal funds, such as through CDC's Immunization Cooperative Agreement (see the text box above) and other grants, to support the development and operation of their IISs.²⁶ According to the most recent CDC five-year cooperative agreement guidance starting in 2019, all jurisdictions have received an annual base award to support general immunization activities. Jurisdictions are directed to use these funds to implement CDC IIS Functional Standards (see below) and evaluate IIS performance, among other activities. Some jurisdictions have received additional funding under the cooperative agreement to support specific IIS projects.²⁷ Less than 50% of jurisdictions use local or state funding for IIS maintenance, operations, and enhancements, according to the American Immunization Registry Association (AIRA).²⁸

Standards development and promotion. CDC has played a key role in developing operational and technical standards for IISs (see the "Brief History" section of this report). The Immunization Information System (IIS) Functional Standards (version 4.1, 2019), identify key IIS functions, operations, and practices to ensure consistency and quality across jurisdictions.²⁹ The CDC immunization cooperative agreement guidance directs grantees to conduct activities that meet the functional standards, but it does not require them to meet all the standards as a condition of funding.³⁰ In addition, CDC helps develop and disseminate best practices for specific IIS operations and functions.³¹

Health IT and electronic health record (EHR)-related efforts. Following enactment of the HITECH Act, several Centers for Medicare & Medicaid Services (CMS) programs have incentivized health care providers and states to adopt EHR systems and IISs that enable interoperability (i.e., automated and secure electronic data sharing) between IISs and health care providers.³² In addition, CDC, with the Office of the National Coordinator for Health Information Technology (ONC) and other HHS operating divisions, has sought, through various efforts, to improve interoperability between IISs in different jurisdictions and with health care providers. IIS program participation is voluntary.³³

CDC can receive de-identified, aggregate data from IISs and use that information to analyze and study national immunization trends. CDC also regularly surveys and evaluates the IISs.³⁴ In addition, various CDC and National Vaccine Program Office efforts have set overall strategies and goals related to IISs.³⁵

Selected IIS Laws, Regulations, and Policies

This section provides an overview of selected characteristics of SLTT IIS laws, regulations, and policies, as well as certain federal laws, regulations, and policies that affect IISs. Laws and policies regarding IISs vary widely across jurisdictions and change over time. Moreover, jurisdictions can change IIS data reporting and sharing requirements under emergency authorities and declarations.³⁶

Reporting

All jurisdictions that operate IISs have laws, regulations, and policies regarding which immunizations must be reported by providers to the respective IIS and what data are to be reported for each of these immunizations. Jurisdiction-level reporting requirements differ in many ways, including³⁷

• whether reporting is mandatory or encouraged;
• which types of providers must report;
• whether vaccinations administered to only certain age groups (e.g., children, adults) must be reported; and
• whether all or only certain types of vaccines (e.g., publicly funded vaccines) must be reported.

Furthermore, jurisdictions have different enforcement authorities and approaches for failures to report.

Privacy, Confidentiality, and Security

A complex regime of laws, regulations, and policies at the federal, state, and local levels governs the privacy and confidentiality of data in IISs. These privacy and confidentiality protections can vary by IIS program and jurisdiction. Most states have health privacy laws and IIS-specific laws. These laws generally inform which information may be collected by a given IIS program, how the information must be stored, who may access the information, authorized uses of the information, and how the information can be disclosed. The privacy and confidentiality frameworks for IISs generally reflect a balance between protecting the privacy of patients' personal health information and allowing IISs to function in ways that improve immunization coverage.³⁸

The primary federal regulation that governs the privacy of protected health information (PHI)—the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule³⁹—describes the circumstances under which HIPAA-covered entities, such as health care facilities, are permitted to use or disclose PHI. The Privacy Rule permits covered entities to disclose, without individual authorization, PHI to a public health authority (such as a state health department) authorized by law to collect or receive such information for the purpose of preventing or controlling disease.⁴⁰ In addition, covered entities are permitted to disclose PHI without individual authorization pursuant to a requirement in law.⁴¹ In some cases, the interactions of privacy laws at different levels of government and their application to different entities can create confusion and affect IIS activities. For example, in some instances, misinterpretations of the Privacy Rule have the effect of limiting the data that providers are willing to share with IISs.⁴²

CDC's current functional standards direct IIS programs to "implement written and approved confidentiality policies that protect the privacy of individuals whose data are contained in the system," and ensure that the IIS is "physically and digitally secured in accordance with industry standards for protected health information, security, encryption, uptime, and disaster recovery."⁴³ Nonfederal organizations, such as the American Immunization Registry Association (AIRA), publish more detailed guidance on recommended practices for ensuring IIS privacy, confidentiality, and security.⁴⁴ Currently, adherence to such standards and guidance is up to each IIS program, though adherence is encouraged by CDC immunization cooperative agreements.

Data Sharing and Consent

Laws, regulations, and policies at the jurisdictional level inform both how data are shared to IISs and under what permissions, and how IISs can share data with other systems.

Consent to Share Immunization Information

Patient consent models for sharing information vary by jurisdiction. In many jurisdictions, immunization data are shared to an IIS on the basis of implied patient consent, often with a right to opt-out (i.e., to exclude or remove immunization information from the IIS). Some jurisdictions do not allow for or restrict a patient's option to opt-out. A few jurisdictions require explicit patient consent ("opt in") to share data.⁴⁵

Data Sharing Between IISs in Different Jurisdictions

As of 2012, a portion of jurisdictions (36 of 52)⁴⁶ had authority to transmit or allow access to IIS data across state borders. For some jurisdictions (15), this authority derived from data-sharing agreements only (rather than from statute or regulation). Of the programs surveyed at that time, 24 did not share data across state borders.

IISs in the COVID-19 Vaccination Program

The COVID-19 vaccination program is an unprecedented effort to rapidly vaccinate a large number of eligible people across the country. As such, the program required planning by public health agencies at different levels of government well before vaccines were authorized for use. IISs are being leveraged to consolidate multidose COVID-19 vaccination records for specific individuals (available only to authorized users), to remind individuals of follow-up doses, and to monitor vaccination rates across the population using aggregate data.⁴⁷ IISs played similar roles during the 2009 H1N1 influenza pandemic.⁴⁸

Starting as early as fall 2020, CDC began working with jurisdictions to prepare and improve their IIS programs for COVID-19-related data collection, funded by COVID-19 supplemental funding awards. COVID-19 vaccine providers are generally required to report specified data to their respective jurisdictional IIS (see the text box below). One priority for this vaccination campaign has been to ensure that providers that had not typically administered vaccines or reported to IISs prior to the pandemic—such as pharmacies, long-term care facilities, and mass vaccination sites—were trained and capable of doing so.⁴⁹ Also, as part of the Trump Administration's Operation Warp Speed, several federal efforts through CDC and the Department of Defense created new data platforms and sharing systems to (1) enable new providers and mass vaccination sites to report vaccination data; (2) facilitate data sharing between federal health care programs (e.g., the Veterans Health Administration), providers, and IISs in different jurisdictions; and (3) create new data analytic functionalities and tools that could aid in monitoring and analyzing vaccination coverage.⁵⁰

Some of these efforts generated controversy. In late 2020, CDC requested that jurisdictions submit certain personally identifiable information (PII) on vaccine recipients to CDC's data clearinghouse (DCH; see the text box below). The PII was to be automatically secured and encrypted. According to CDC, the identifiable data submission would allow the agency "to assess and verify second-dose vaccination, to assess vaccine safety, and to allow for critical vaccine effectiveness monitoring."⁵¹ CDC and HHS generally would not have access to the PII in the system, but they would have access to de-identified aggregate vaccination data generated from the system.⁵² Several state officials questioned or criticized this data request.⁵³ State associations, such as National Governors Association and the Association of State and Territorial Health Officials, questioned why the federal government needed PII.⁵⁴ In addition, some states asserted that their laws did not allow them to share PII from IISs with the federal government.⁵⁵ Accordingly, CDC signed data-sharing agreements specific to each jurisdiction, many of which have limited the PII that jurisdictions share with CDC's DCH.⁵⁶

Despite efforts to prepare, improve, and invest in IISs for the COVID-19 response, the large volume of data collected during the pandemic has reportedly overwhelmed the capabilities of some IISs and exacerbated long-standing problems with their technology, staffing, and functioning, as explained in the next section.⁵⁷

IIS Data and Technology Challenges

Given that many IISs were established in the 1990s, some IISs still rely on legacy software and technology. In addition, because these systems are jurisdiction-based, their technology varies and they are not based on any one platform.⁵⁸ No policy is in place to require that IISs programs adhere to common technical or operational standards, though CDC encourages IIS programs to meet its functional standards. States and other jurisdictions have implemented different functional standards according to their priorities, and many IISs have not achieved all of CDC's functional standards.⁵⁹ This may have contributed to the following data and technology challenges, reportedly exacerbated during the COVID-19 pandemic:

Technology. Because IISs have been developed separately at the jurisdictional level, different systems rely on different technology and staffing, with different functionalities and scalability. Not all IISs use up-to-date IT standards to ensure secure and scalable data sharing and storage.⁶⁰ One 2019 analysis found that a quarter of all IISs were out-of-date and in need of major changes to meet current IT standards. The analysis also found that the other IISs would face increased costs in ensuing years associated with ongoing IT modernization. The analysis noted increasing costs associated with servers, technical support, user onboarding, quality control, and compensation for skilled software developers.⁶¹

Connections with health care providers. As noted, many health departments worked to enroll new providers to report to their respective IIS as a part of the COVID-19 vaccination program. Prior to the pandemic, not all vaccine providers were connected to their respective IIS and reporting requirements were not consistently enforced.⁶² In some cases, providers relied on manual paper-based or online forms to report to their IIS—adding an administrative burden.⁶³ In recent years, with CMS programs that support health IT interoperability efforts and incentives, much of the IIS reporting has been automated through electronic health records (EHRs), though not all.⁶⁴ Connections between IISs and EHRs also have not been uniformly "bidirectional," meaning that health care providers cannot always readily access complete and accurate records for their patients in their EHR system.⁶⁵

Data sharing between jurisdictions and federal health care providers (e.g., Veterans Health Administration, VA). Because people may get vaccinated in more than one state, the IIS record on one person in any one state may be incomplete. The COVID-19 pandemic has highlighted this issue, as it has proven difficult in some instances to consolidate and reconcile information on doses received in different jurisdictions. (This issue may have contributed to discrepancies in CDC national vaccine data reported in December 2021.⁶⁶) Challenges with sharing IIS data across state lines was an issue before the pandemic. For example, a 2015 measles outbreak in California, linked to exposures at Disneyland, involved over 100 cases in 14 different states, challenging health departments and health care providers in determining the immunization status of all potentially exposed and infected individuals. Following this incident, the National Vaccine Advisory Committee recommended that HHS address technical and legal barriers to interjurisdictional data exchange.⁶⁷

IIS data sharing with federal health care systems, such as with VA and Department of Defense (DOD) facilities, has also been an issue. Although HHS has sought to facilitate interjurisdictional data exchange in recent years, not all IIS programs have participated in these efforts, especially prior to the pandemic.⁶⁸ (These efforts have focused on facilitating data exchange between different jurisdictions, and between jurisdictions and federal or multistate health care providers, but not with CDC or HHS. For example, the cross-jurisdictional data-sharing system, the IZ Gateway, is housed on a nonfederal platform.⁶⁹)

Data quality and completeness. Even when IISs collect data, the immunization history and other information collected for an individual may not be complete or may contain errors that affect data quality.⁷⁰ In addition, not all IIS programs collect or report the same data elements. For example, during the COVID-19 pandemic, not all states have collected data about the race/ethnicity of vaccine recipients or shared such data with CDC. Some stakeholders have argued that this data limitation has affected the ability to understand disparities and equity in vaccination at a national level.⁷¹

Legislative Developments

Although several enacted laws have mentioned IISs, no enacted federal legislation has focused specifically on IISs.⁷² CDC and other HHS operating divisions have conducted activities related to IISs under general public health authorities, primarily in the Public Health Service Act (PHSA)—the compilation of statutes that authorize many of the activities of the U.S. Public Health Service Agencies in HHS (of which CDC is a component).⁷³

There have been several legislative developments related to IISs in recent years. Several appropriations in the COVID-19 relief laws can support IIS activities of CDC and SLTT agencies, as summarized below.

In the 117^th Congress, there are many bills related to IISs and vaccination data more generally.⁷⁴ Some bills seek to improve data collection and sharing or otherwise strengthen IISs, such as the COVID-19 Delivery Act (H.R. 330/H.R. 936), Section 104 of the Cures 2.0 Act (H.R. 6000), and the Health STATISTICS Act of 2021 (H.R. 831). Other proposals seek to limit the collection and use of identifiable vaccination data and strengthen related federal privacy protections, such as H.R. 449 and the No Vaccine Passports for Americans Act (H.R. 3868 and S. 1932, similar to H.R. 2384). The section below provides more information on the Immunization Infrastructure Modernization Act of 2021 (H.R. 550)—an IIS-related bill that passed the House on November 30, 2021.

COVID-19 Relief Funding

Several COVID-19 appropriations can support COVID-19 vaccination program efforts, including IIS-related activities. Earlier in the pandemic, before vaccines were available, CDC had received broad supplemental appropriations for its pandemic-related activities in March 2020 and used some of this funding for vaccination program grants and planning. Since then, CDC has received several appropriations specifically for vaccine-related activities.⁷⁵

For efforts to "plan, promote, distribute, administer, monitor, and track COVID-19 vaccines," CDC received a total of $16.25 billion in FY2021, including $8.75 billion in the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSA), enacted in December, 2020 (P.L. 116-260, Division M), available until September 30, 2024, and $7.5 billion in the American Rescue Plan Act (ARPA; P.L. 117-2), Section 2301, enacted in March 2021, available until expended. ARPA Section 2301 specifies that CDC must use funds to support SLTT agencies, including for "information technology, standards-based data, and reporting enhancements, including improvements necessary to support standards-based sharing of data related to vaccine distribution and vaccinations and systems that enhance vaccine safety, effectiveness, and uptake, particularly among underserved populations," among other things.

Of the $8.75 billion in CRRSA, at least $4.5 billion is designated for SLTT grants (or cooperative agreements), of which $210 million must be transferred to the Indian Health Service, and a separate amount of not less than $300 million is designated for "high-risk and underserved populations, including racial and ethnic minority populations and rural communities." The ARPA provision directs CDC to award supplemental funding to eligible awardees that received grants under CRRSA based on a specified alternative formula.

Using these funds, CDC has awarded grants to jurisdictions that can be used to support IIS programs and operations.⁷⁶ For example, under the $3 billion CDC funding allocation in January 2021, funded by CRRSA (P.L. 116-260, Division M), activities to "use immunization information systems to support efficient COVID-19 vaccination" are included among required activities by the grant. Allowable IIS-related activities under the grant include to "develop and enhance health information infrastructure and IIS upgrades to improve data quality and ensure robust reporting at the jurisdiction and federal level," among others.⁷⁷ Additional related grants may be awarded to jurisdictions in the future with remaining unobligated funds.⁷⁸

Immunization Infrastructure Modernization Act of 2021 (H.R. 550)

The Immunization Infrastructure Modernization Act of 2021 (H.R. 550) was introduced in the House on January 28, 2021. The bill was subsequently discussed in a House Energy and Commerce Committee hearing on June 15, 2021; marked up and ordered to be reported during a committee meeting on July 21, 2021; and reported to and passed by the House on November 30, 2021.⁷⁹ The Senate has not considered a similar measure.

As passed by the House on November 30, 2021, H.R. 550 would amend PHSA Title XXVIII, National All-Hazards Preparedness for Public Health Emergencies,⁸⁰ to add a new Section 2824 to the end of Subtitle C entitled "Immunization Information System Data Modernization and Expansion." H.R. 550 defines an immunization information system as "a confidential, population-based, computerized database that records immunization doses administered by any health care provider to persons within the geographic area covered by that database."⁸¹

The language in H.R. 550 is similar to legislation enacted in December, 2020 (P.L. 116-260, Division BB, Title III, Section 314), that similarly authorizes an HHS grant program for public health data modernization as PHSA Section 2823.⁸² In contrast to the enacted PHSA Section 2823, which addresses public health data modernization broadly, H.R. 550 focuses specifically on modernization of IISs.

The proposed new PHSA Section 2824 would direct the HHS Secretary to⁸³

Expand, enhance, and improve IISs administered by health departments or other SLTT agencies and used by health care providers. Given that HHS agencies, such as CDC, already conduct activities related to IISs under general authorities, this authorization may serve to codify some existing activities.

Award grants or cooperative agreements to the health departments or other SLTT agencies that administer IISs, subject to the data and technology standards below. Among other things, the grants may be used to support IIS programs to (1) assess their technology and data infrastructure gaps; (2) enroll and train health care providers in an IIS; (3) improve secure data collection, exchange, maintenance, and analysis, including by improving data exchange across jurisdictions and simplifying reporting by health care providers; (4) ensure IISs are interoperable according to federal health IT standards; (5) support adoption of CDC functional standards and security standards; (6) procure updated software and technology; and (7) improve IIS functionalities such as outbreak response capabilities, clinical decision support, and vaccine supply management.

Designate data and technology standards that must be followed as a condition of receiving a funding award. The Secretary is required to prioritize standards that are developed by consensus-based organizations with input from the public and voluntary consensus-based standards bodies. The Secretary is also required to support a means of independent verification of the standards. In addition, the awardee must adhere to federal health IT standards reviewed and adopted under PHSA Section 3004 regarding standards for health information. This requirement to adhere to federal health IT standards may be waived if the Secretary determines that grant activities cannot otherwise be carried out within the applicable jurisdiction.

Provide technical assistance, as well as certification and training, related to IIS information exchange across jurisdictions and health care providers. The Secretary may use public-private partnerships for these efforts.

Report to Congress (1) a strategy and implementation plan within 90 days of enactment and (2) a follow-up report not later than a year after enactment. The strategy and implementation plan must identify the measures that the Secretary intends to take to update and improve IISs supported by CDC, and to carry out the activities supporting the expansion, enhancement, and improvement of SLTT IISs. In developing the plan, the Secretary is required to consult with stakeholders, such as health departments, professional medical and health associations, health information technology experts, other health care entities, and other public or private entities, as appropriate. For the follow-up report, the Secretary is required to describe any barriers to (1) reporting, interoperability, and information exchange, or (2) the effective establishment of a network to support immunization reporting and monitoring, and to make recommendations to address such barriers. The follow-up report must also include an assessment of immunization coverage and access to immunizations services, and any disparities and gaps in such coverage and access for medically underserved, rural, and frontier areas.

The section also authorizes a one-time, no-year appropriation of $400 million, to remain available until expended.

Selected Policy Considerations

In considering legislation related to IISs, Congress may consider the following policy considerations:

What is the long-term strategy for funding and financing IISs? As described above, CDC and other HHS operating divisions fund and support IISs in many ways, especially through annual Immunization Cooperative Agreement funding to 64 jurisdictions. Although jurisdictions can use these grants in part to support IIS-related activities, these flexible funds may be used for other competing priorities. One 2019 analysis found that IIS programs reported tighter federal and state budgets, which affected their ability to fund system upgrades and maintenance.⁸⁴

As noted, funded jurisdictions can use some CDC supplemental COVID-19 grants, in part, to support IIS modernization and improvements. According to AIRA, many jurisdictions are using COVID-19 relief funds primarily to meet immediate programmatic needs during the pandemic.⁸⁵ Different COVID-19 public health grants are available for different time periods; however, much of the relevant grant funding is available through 2024.⁸⁶ Comprehensive, publicly available information on how states and other jurisdictions are spending their CDC COVID-19 grants is unavailable at this time. According to AIRA, IIS programs may be reluctant to spend the temporary supplemental funding on long-term investments, such as major software and technology upgrades, without assurance that future funding can sustain such investments.⁸⁷

If the Immunization Infrastructure Modernization Act of 2021 (H.R. 550) is enacted and the authorized grant funding is later appropriated, jurisdictions may receive additional funding for IIS standardization and modernization under the one-time appropriation. Still, the long-term funding challenges may remain. One of CDC's recent IIS-related strategies is to "Sustain the IIS Community," which includes "diversifying mechanisms of financial support for IISs," and "identifying new ways to reduce costs and use existing resources effectively."⁸⁸ Congress might consider its role in IIS sustainability. Could Congress consider dedicated annual funding for IISs? Can Congress encourage or incentivize state or private funding for IISs?

To what degree should the federal government support SLTT IIS programs? As noted earlier, fewer than 50% of jurisdictions have local or state funding for their IIS programs, according to AIRA.⁸⁹ Given that IISs are primarily state- and local-based, to what extent should the federal government support these systems? Congress may consider whether grants under existing or new program authorizations should include a matching funds requirement in which jurisdictions invest in their own systems, and whether such a requirement could deter participation.

To what degree should the federal government standardize or inform SLTT IIS programs? Several legislative proposals, especially the Immunization Infrastructure Modernization Act of 2021 (H.R. 550), seek to standardize IIS programs to enable data quality and sharing. As currently written, H.R. 550 would give the HHS Secretary discretion to determine the required data and technology standards. If enacted, how does Congress provide oversight to ensure that the standards meet intended policy goals?

Separately from H.R. 550, what role should Congress play in informing the policies and activities of SLTT IIS programs? Some current legislative proposals seek to limit their ability to collect or use identifiable data (e.g., H.R. 3868 and S. 1932). Others seek to impose requirements on SLTT vaccination data collection and reporting (e.g., H.R. 330/H.R. 936 and S. 302). In considering any such proposal, Congress may weigh any benefits of national requirements and standards with any benefits of allowing SLTT governments autonomy over their own laws, policies and programs.