A. The child immunization reporting system is established in the department to collect, store, analyze, release and report immunization data.

B. A health care professional who is licensed under title 32 to provide immunizations, except as provided in subsection I of this section, shall report the following information:

1. The health care professional’s name, business address and business telephone number.

2. The child’s name, address, social security number if known and not confidential, gender, date of birth and mother’s maiden name.

3. The type of vaccine administered and the date it is administered.

C. The health care professional may submit this information to the department on a weekly or monthly basis by telephone, fax, mail, computer or any other method prescribed by the department.

D. Except as provided in subsection I of this section, the department shall release identifying information only to the person, the person’s health care decision maker, parent or guardian, a health care provider, an entity regulated under title 20, the Arizona health care cost containment system and its contractors as defined in chapter 29 of this title, its external quality review organization or any other entity that has a business associate agreement with the Arizona health care cost containment system, a school official who is authorized by law to receive and record immunization records, a person or entity that provides services to a health care provider and with whom the health care provider has a business associate agreement that requires the person or entity to protect the confidentiality of the information, as required by the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 164, subpart E) or a nonprofit health information organization as defined in section 36-3801 that is designated by the department as this state’s official health information exchange organization. The department may also release identifying information to an entity designated by the person or the person’s health care decision maker, parent or guardian. The department, by rule, may release immunization information to persons for a specified purpose. The department may release nonidentifying summary statistics.

E. Identifying information in the system is confidential. A person who is authorized to receive confidential information under subsection D of this section or pursuant to rules adopted by the department shall disclose this information only as permitted by this section or rules adopted by the department.

F. A health care provider that provides information in good faith pursuant to this section is not subject to civil or criminal liability.

G. A health care provider that does not comply with the requirements of this section violates a law applicable to the practice of medicine and commits an act of unprofessional conduct or a violation of chapter 4 of this title.

H. Any agency or person receiving confidential information from the system who subsequently discloses that information to any other person other than as permitted by this section is guilty of a class 3 misdemeanor.

I. At the request of the person, or if the person is a child the child’s parent or guardian, the department of health services shall provide a form to be signed that allows confidential immunization information to be withheld from all persons including persons authorized to receive confidential information pursuant to subsection D of this section. If the request is delivered to the health care professional before the immunization, the health care professional shall not forward the information required under subsection B of this section to the department.

J. For the purposes of this section, "health care decision maker" and "health care provider" have the same meanings prescribed in section 12-2291.