Section 24M. The department shall establish, maintain and operate a computerized immunization registry. The immunization registry shall record immunizations and immunization history with identifying information and shall include appropriate controls to protect the security of the system and the privacy of the information.

The department shall promulgate rules and regulations to implement the immunization registry.

Licensed health care providers administering vaccinations shall discuss the reporting procedures of the immunization registry with the persons receiving the vaccinations and their parents or guardians, when appropriate, and advise them of their right to object to the disclosure of such information as set forth in this section.

Notwithstanding any restrictions set forth in section 24B and chapter 46, upon receipt of an initial birth record for a newborn, the state registrar of vital statistics shall transmit to the immunization registry the information regarding immunizations administered to a newborn and such other information transmitted with the birth record that the department determines to be the minimum necessary for the effective operation of the registry.

All licensed health care providers practicing who administer immunizations shall report to the immunization registry such data related to immunizations as the department determines is necessary for disease prevention and control.

Immunization information shall only be released from the immunization registry to the following individuals and agencies without further express consent of the individual or the individual's parent or guardian if the individual is a minor, unless the individual or the parent or guardian objects to such disclosure: (1) licensed health care providers providing direct care to the individual patient; (2) elementary and secondary school nurses and registration officials who require proof of immunization for school enrollment and disease control; (3) local boards of health for disease prevention and control; (4) Women Infants and Children, or WIC, nutrition program staff who administer WIC benefits to eligible infants and children; and (5) staff of state agencies or state programs whose duties include education and outreach related to the improvement of immunization coverage rates among their clients.

The department may designate appropriate users who shall have access only to the individually identifiable information for which access is authorized. Authorized users, including employees of the department, who in good faith disclose or refuse to disclose information to the immunization registry, shall not be liable in any cause of action arising from the disclosure or nondisclosure of such information. The department may revoke access privileges for just cause.

Persons authorized by the commissioner may conduct research studies pursuant to section 24A; provided, however, that the researcher shall submit a written request for information and shall execute a research agreement that protects the confidentiality of the information provided.

The department may enter into collaborative agreements with registries of other states and exchange individual or group information provided that maximum protections are afforded the confidentiality of citizens of the commonwealth in accordance with state law.

Information contained in the immunization registry shall be confidential, shall not constitute a public record and shall not otherwise be disclosed except in accordance with this section. Such confidential information shall not be subject to subpoena or court order, and shall not be admissible as evidence in any action of any kind before a court, tribunal, agency, board or person.

The department shall establish procedures that allow for an individual or, if the individual is a minor, then the individual's parent or guardian to amend incorrect information in the immunization registry and shall provide, upon request, a record of all individuals and agencies that have accessed an individual's information.