CAIR Disclosure/Sharing Policy

CAIR Standard Disclosure Policy

Per California Immunization Registry law (Health and Safety Code, Section 120440), all patients/parents must receive proper disclosure before patient information can be entered into and shared through CAIR.  Entry into and sharing of patient information through CAIR is understood to include any and all vaccine doses or Tb test results received by the patient, regardless of when those doses or Tb tests occurred relative to the date of disclosure. Patient/parents also have the right to decline to have their information in CAIR shared with other participating Organizations. Below is the CAIR Standard Disclosure Policy for Organizations using CAIR.

  1. Organizations must use the CAIR Immunization Registry Notice to Patients and Parents ('CAIR Notice', English) (or equivalent language subject to CAIR approval) for disclosure.  Translations of the 'CAIR Notice' into other languages are available on the CAIR Forms page. 
  2. Organizations must give a paper or laminated copy of the CAIR Notice to each patient/parent whose information will be entered into CAIR to read (patients/parents only need to be disclosed once).
  3. A CAIR Notice in the patient’s/parent’s preferred language should be provided. The CAIR Notice is available in multiple languages on the CAIR Forms page at: http;//cairweb.org/forms/
  4. If the patient is under the age of 18, the CAIR Notice must be given to the parent or guardian of that child.
  5. A paper copy of the CAIR Notice must be give to the patient/parent to keep if requested.
  6. Disclosure must take place prior to creating the patient’s record in CAIR.
  7. As an alternative to giving each patient/parent a copy of the CAIR Notice to read, the Organization may post CAIR Notice posters in their office waiting rooms, visible to all patients whose information may be entered into CAIR.  Both English and Spanish versions of the poster must be posted. The posters should also be posted in other areas (e.g., exam rooms) to maximize the opportunity for patients/parents to read the information.  The Organization must also give a paper copy of the CAIR Notice to patients/parents to keep if requested. CAIR Notice posters are available from your Local CAIR Representative.
  8. The Organization should ensure that the patient/parent understands the information contained in the CAIR Notice and has the opportunity to ask questions if he/she is unclear about it.
  9. Once disclosure has been performed, this must be documented in CAIR by selecting "Yes" to the question: "Has patient been disclosed (IZ/TB)?"  on the CAIR Add New Patient when creating the record in CAIRscreen in the patient record in CAIR.  This will also default the "Has patient agreed to share?" field to "Yes".  See the Sharing Policy below for further information. Organizations providing patient immunization data to CAIR through electronic data exchange should review the CAIR HL7 Data Exchange Specifications documents on the 5 Steps to Data Exchange page for instructions on incorporating disclosure and sharing information into immunization messages.
  10. CAIR also receives public birth certificate records. Both the Disclosure and Share fields are automatically set to "No" in CAIR. These records cannot be opened until disclosure has been performed with the parent. Follow the on-screen instructions in CAIR for conducting disclosure and setting the Share filed for these records.
  11. CA law allows a patient/parent to decline to have their/their child’s information in CAIR shared with other Organizations that use CAIR ('opt out'). In this case, their information may still be entered into CAIR but it must be 'locked' by the Organization.  See the Sharing Policy below for further information.

 

CAIR Mail-based Disclosure Policy

Per California Health and Safety Code, Section 120440, mail-based disclosure is a legal means for conducting Immunization Registry disclosure to patients/parents.  Mail-based disclosure is primarily used by an Organization to load its initial patient records into CAIR when it first starts using CAIR.  The Regular (in-person) disclosure process must then be used on an ongoing basis. Below is the CAIR Mail-based Disclosure Policy for Organizations using CAIR.

  1. A mailing must be sent to each patient/parent whose immunization information you would like to enter into CAIR.
  2. The mailing must include the CAIR Immunization Registry Notice to Patients and Parents (‘CAIR Notice’) in a minimum of English and Spanish (and preferably in the patient’s preferred language if it is known) and a cover letter from the Organization.  . The CAIR Notice is available in multiple languages on the CAIR Forms page. Here is a sample cover letter.  The final letter must be approved by CAIR staff.
  3. If the patient is under the age of 18, the Registry Notice must be addressed and mailed to the parent or guardian of that child.
  4. A minimum of 30 days from the date of the mailing must be given before patients’ records can be entered into CAIR to allow for undeliverable mail to be returned and for patients/parents to ask questions or to decline sharing of their records through CAIR.
  5. A reasonable mechanism must be established for patients/parents to ask questions and/or decline sharing.  Patients/parents should be referred to the CAIR Help Desk (phone: 800-578-7889, email: CAIRHelpDesk@cdph.ca.gov) if they have questions or concerns.
  6. After the 30-day mailing period, patients/parents can be considered disclosed if the mail has not been returned as undeliverable. Disclosure must then be documented in CAIR by selecting “Yes” to the question: “Has patient been disclosed (IZ/TB)” on the Add New Patient screen when creating the record in CAIR. This will also default the ‘Has patient agreed to share?’ field to “Yes”.  See the CAIR Patient/Parent Sharing Policy for further information. Organizations providing patient immunization records to CAIR through electronic data Exchange should review the CAIR HL7 Data Exchange Specifications documents on the 5 Steps to Data Exchange page for instructions on incorporating disclosure and sharing status information into immunization messages.  
  7. Records for patient’s whose mail has been returned as undeliverable cannot be entered into CAIR.
  8. CA law allows a patient/parent to decline to have their/their child’s information in CAIR shared with other Organizations that use CAIR (‘opt out’).  In this case, their information may still be entered into CAIR but it must be ‘locked’ by the Organization.  See the CAIR Patient/Parent Sharing Policy for further information.

To ensure that the above criteria are met as well as to determine if the funding, staff resources and tracking mechanisms are in place to support a mail-based disclosure process for the Organization, a Mail-based Disclosure Checklist is available to help guide this process.

 

CAIR Sharing Policy

Per California Immunization Registry law (Health and Safety Code, Section 120440), all patients/parents have the right to decline to have their information in CAIR shared with other participating Organizations. Below is the CAIR Sharing Policy for Organizations using CAIR.

  1. CAIR is an 'opt out' registry, meaning that patient information will be shared with other authorized CAIR users unless the patient/parent specifically requests that it not be shared. If a patient declines to share, the Organization is still authorized to input the patient information into CAIR but must ‘lock’ the record.  'Locking' a record allows the Organization that created (or 'owns') the record to access it, but prevents access by other Organizations.  To lock the record, select "No" to the question "Has patient agreed to share?" on the Add New Patient when creating the new record in CAIR.
  2. A patient/parent may request to change their sharing status at any time. To 'lock' (Sharing field set to "No") or 'unlock' (sharing field set to "Yes") an existing record in CAIR,  select "Yes" or "No" as appropriate to the question "Has the patient agreed to share information with other users?" on the Preferences screen in CAIR or follow the on-screen  instructions if prompted.   A patient/parent may also request change in sharing status by completing and faxing the CAIR 'Decline or Start Sharing ' form to the CAIR Help Desk at: 1-888-436-8320. Organizations may wish to document the patient/parent’s decision using the CAIR 'Decline or Start Sharing' form, which can be filed in the patient’s chart and a copy given to the patient/parent. Use of the CAIR 'Decline or Start Sharing' form is optional. Organizations should also be able to provide a blank copy or direct a patient/parent to the Decline or Start Sharing form if they request one. The Decline form is available in multiple languages on the CAIR Forms page.
  3. Organizations providing patient immunization records to CAIR through electronic data exchange should refer to the CAIR HL7 Data Exchange Specifications documents on the 5 Steps to Data Exchange page for instructions on incorporating disclosure and sharing status information into immunization messages.  If this is not possible, direct patients/parents to complete and fax the CAIR 'Decline or Start Sharing' forms to the CAIR Help Desk at: 1-888-436-8320 if they wish to decline to share or modify their 'sharing' status (default is 'Yes').

For any questions regarding these Disclosure and Share Policies, contact the CAIR Help Desk (1-800-578-7889, CAIRHelpDesk@cdph.ca.gov) or your Local CAIR Representative.