CAIR Standard Disclosure Policy

Per California Immunization Registry law (Health and Safety Code, Section 120440), all patients/parents must receive proper disclosure before patient information can be entered into and shared through CAIR. Entry into and sharing of patient information through CAIR is understood to include any and all vaccine doses or Tb test results received by the patient, regardless of when those doses or Tb tests occurred relative to the date of disclosure. Patient/parents also have the right to decline to have their information in CAIR shared with other participating Organizations. Below is the CAIR Standard Disclosure Policy for Organizations using CAIR.

1. Organizations must use the CAIR Immunization Registry Notice to Patients and Parents (PDF) (‘CAIR Notice’, English) (or equivalent language subject to CAIR approval) for disclosure. Translations of the ‘CAIR Notice’ into other languages are available on the CAIR Forms page.
2. Organizations must give a paper or laminated copy of the CAIR Notice to each patient/parent whose information will be entered into CAIR to read (patients/parents only need to be disclosed once).
3. A CAIR Notice in the patient’s/parent’s preferred language should be provided. The CAIR Notice is available in multiple languages on the CAIR Forms page.
4. If the patient is under the age of 18, the CAIR Notice must be given to the parent or guardian of that child.
5. A paper copy of the CAIR Notice must be give to the patient/parent to keep if requested.
6. Disclose to patients or their parents/guardians that state law requires patient immunization information and TB test results to be shared with CAIR and that patients have the option to share their immunization records/TB test results with all CAIR providers or only providers that require vaccination history to provide care. Written disclosure is highly recommended.​
7. As an alternative to giving each patient/parent a copy of the CAIR Notice to read, the Organization may post CAIR Notice posters in their office waiting rooms, visible to all patients whose information may be entered into CAIR. Both English and Spanish versions of the poster must be posted. The posters should also be posted in other areas (e.g., exam rooms) to maximize the opportunity for patients/parents to read the information. The Organization must also give a paper copy of the CAIR Notice to patients/parents to keep if requested. CAIR Notice posters are available from your Local CAIR Representative. Visit our Local CAIR Representative page to find your representative.
8. The Organization should ensure that the patient/parent understands the information contained in the CAIR Notice and has the opportunity to ask questions if he/she is unclear about it.
9. Once disclosure has been performed, this must be documented in CAIR by selecting “Yes” to the question: “Has patient been disclosed (IZ/TB)?”  on the CAIR Add New Patient when creating the record in CAIR screen in the patient record in CAIR. This will also default the “Has patient agreed to share?” field to “Yes.” See the Sharing Policy below for further information. Organizations providing patient immunization data to CAIR through electronic data exchange should review the CAIR HL7 Data Exchange Specifications documents on the 4 Steps to Data Exchange page for instructions on incorporating disclosure and sharing information into immunization messages.
10. CAIR also receives public birth certificate records. Both the Disclosure and Share fields are automatically set to “No” in CAIR. These records cannot be opened until disclosure has been performed with the parent. Follow the on-screen instructions in CAIR for conducting disclosure and setting the Share filed for these records.
11. CA law allows a patient/parent to decline to have their/their child’s information in CAIR shared with other Organizations that use CAIR (‘opt out’). In this case, their information may still be entered into CAIR but it must be ‘locked’ by the Organization. See the Sharing Policy below for further information.

CAIR Mail-based Disclosure Policy

Per California Health and Safety Code, Section 120440, mail-based disclosure is a legal means for conducting Immunization Registry disclosure to patients/parents. Mail-based disclosure is primarily used by an Organization to load its initial patient records into CAIR when it first starts using CAIR. The Regular (in-person) disclosure process must then be used on an ongoing basis. Below is the CAIR Mail-based Disclosure Policy for Organizations using CAIR.

1. A mailing must be sent to each patient/parent whose immunization information you would like to enter into CAIR.
   
2. The mailing must include the CAIR Immunization Registry Notice to Patients and Parents (PDF) (‘CAIR Notice’, English) in a minimum of English and Spanish (and preferably in the patient’s preferred language if it is known) and a cover letter from the Organization. The CAIR Notice is available in multiple languages on the CAIR Forms page. Here is a samp​le cover letter (PDF). The final letter must be approved by CAIR staff.
3. If the patient is under the age of 18, the Registry Notice must be addressed and mailed to the parent or guardian of that child.
4. A minimum of 30 days from the date of the mailing must be given before patients’ records can be entered into CAIR to allow for undeliverable mail to be returned and for patients/parents to ask questions or to decline sharing of their records through CAIR.
5. A reasonable mechanism must be established for patients/parents to ask questions and/or decline sharing. Patients/parents should be referred to the CAIR Help Desk (phone: 800-578-7889, email: CAIRHelpDesk@cdph.ca.gov) if they have questions or concerns.
6. After the 30-day mailing period, patients/parents can be considered disclosed if the mail has not been returned as undeliverable. Disclosure must then be documented in CAIR by selecting “Yes” to the question: “Has patient been disclosed (IZ/TB)” on the Add New Patient screen when creating the record in CAIR. This will also default the ‘Has patient agreed to share?’ field to “Yes.”​​​ See the CAIR Patient/Parent Sharing Policy below for further information. Organizations providing patient immunization records to CAIR through electronic data Exchange should review the CAIR HL7 Data Exchange Specifications documents on the 4 Steps to Data Exchange page for instructions on incorporating disclosure and sharing status information into immunization messages.
7. Records for patient’s whose mail has been returned as undeliverable cannot be entered into CAIR.
8. CA law allows a patient/parent to decline to have their/their child’s information in CAIR shared with other Organizations that use CAIR (‘opt out’). In this case, their information may still be entered into CAIR but it must be ‘locked’ by the Organization. See the CAIR Patient/Parent Sharing Policy below for further information.

To ensure that the above criteria are met as well as to determine if the funding, staff resources and tracking mechanisms are in place to support a mail-based disclosure process for the Organization, a Mail-based Disclosure Checklist​ (PDF) is available to help guide this process.