CDC Updates COVID-19 Vaccination Program Provider Agreement to Address Use and Disclosure of Vaccination Data

On May 18, 2021, the Centers for Disease Control (CDC) posted an amendment to the Vaccination Program Provider Agreement to provide additional restrictions on what providers participating in the federal vaccination program can do with personal data gathered on vaccine recipients. The amendment, which is automatically imposed on all vaccine providers, is described by the CDC as restricting a provider’s ability to use vaccine recipient data for commercial marketing purposes. The restrictions, however, are broader than just marketing. The amendment provides:

“Notwithstanding uses or disclosures otherwise allowed by law, providers are prohibited from using or disclosing data collected from vaccine recipients for and through the CDC COVID-19 Vaccination Program for commercial marketing purposes or for any other purpose not allowed under this updated provision of the COVID-19 Vaccination Provider Agreement. Such data include COVID-19 vaccination registration information and vaccine administration data. These data are collected solely for the purposes of the CDC COVID-19 Vaccination Program and must be maintained in a manner that protects the integrity of the CDC COVID-19 Vaccination Program by only being used or disclosed for the purposes of the COVID-19 Vaccination Program and other limited purposes that promote public health, advance positive patient outcomes, and promote health equity.

This prohibition is not intended to limit communications by health care providers to vaccine recipients with whom the provider has an existing relationship prior to contact about COVID-19 vaccination.
The following are not included in the above prohibition:

• • • Communications regarding receipt of a second dose, or potential booster dose(s), of COVID-19 vaccine
    • Communications to vaccine recipient for public health purposes
    • Communications to vaccine recipients involving pharmacy or clinical services of the provider, personalized to the vaccine recipient’s medical needs, even if those services are not directly related to COVID-19 vaccination
    • Availability of other vaccines (e.g., shingles, pneumococcal conjugate, seasonal influenza, routine childhood vaccines)
    • Clinical emails
    • Disease screening services
    • Communications about the availability of programs to manage particular health conditions (e.g., asthma, diabetes, heart disease)”

We believe the amendment does not prohibit disclosures required by law, such as mandatory disclosures to a state registry, particularly where the state law is consistent with public health purposes supported by the CDC. It is important that providers verify that any request for disclosure of vaccine recipient data specifically conforms to the requirements of a particular state law. Other requests for use or disclosure of vaccine recipient data should be carefully scrutinized to confirm the authority and purpose for use or disclosure conforms to the requirements of the CDC.