Use of Wisconsin Immunization Registry (WIR) Organization Security and Confidentiality Agreements During the COVID-19 Pandemic

When school districts enter into a Wisconsin Immunization Registry (WIR) Organization Security and Confidentiality Agreement (Confidentiality Agreement) with the Department of Health Services (DHS), authorized users are afforded certain rights and responsibilities.  This article focuses on the rights of school districts in accessing and using student COVID-19 vaccination data located on the WIR.  In addition, the article discusses why school districts should verify that they are operating under the current version of the Confidentiality Agreement.

DHS created the WIR to facilitate its goal to reduce or eliminate preventable diseases by collecting immunization data on Wisconsin residents via Wisconsin immunization providers.  The WIR also helps to improve school district access to immunization records by reducing the need for parent-provided immunization records.  With the information from the WIR, school nurses can assess whether students have received Wisconsin’s mandated vaccines set forth by the Wisconsin Student Immunization Law.  Equipped with such information, school nurses can support parents/guardians to learn about any required vaccinations their children have yet to receive and identify where their children can obtain those vaccinations.

The Wisconsin Student Immunization Law (Immunization Law) requires that children in all Wisconsin schools meet certain minimum immunization requirements.  School districts are required under the Immunization Law to assess all immunization records of their students to determine compliance with the Immunization Law.  If students do not produce the appropriate documentation by the end of the 30th school day, provided that they have received the required minimum immunizations, they may be excluded from school beginning on the 31st day. 

At this point, neither the Immunization Law, nor any other law, mandates COVID-19 vaccines for students.  Nonetheless, the WIR still tracks COVID-19 vaccination records, including the records of children ages five (5) and up.  As a result, school districts with access to the WIR pursuant to a signed Confidentiality Agreement are able to review the COVID-19 vaccination status of a student if the immunization provider reported the information to the WIR and the student’s parent/guardian did not opt out of reporting the COVID-19 vaccination status or otherwise take action to restrict school district access to the record.

Given the potential availability of students’ COVID-19 vaccination records through the WIR, school districts might be questioning whether the information in the WIR may be used to assess the need to employ certain preventative measures, such as masking, quarantining, and virtual schooling.  The language of the Confidentiality Agreement and guidance provided by DHS help in answering that question.

The Confidentiality Agreement outlines several authorized uses of the WIR data pursuant to the Agreement, including: (1) to “[p]ermit schools to determine the individual immunization status of their students,” and (2) for “DHS approved utilization of data for public health purposes.”  Thus, if the individual immunization status of a student helps to address a DHS-approved public health purpose, the school district may employ the data for that purpose.  In a letter sent to school districts, DHS explained that “authorized users such as… schools may use the COVID vaccine information [from the WIR] for purposes such as setting policy about masks, cohorting in schools, and other public health purposes.”

Although DHS’s guidance suggests that school districts may use the WIR data for such purposes, school districts may still want to proceed with caution for two reasons.  First, such data could be incomplete if the student received COVID-19 vaccinations out of state or if the parent/guardian elected to limit the availability of their child’s COVID-19 vaccination status on the WIR.  Second, even if complete, school districts may encounter negative public attention for using such information without the express consent of the parent/guardian, particularly in communities that have expressed parental choice concerns related to COVID-19.

As a result, school districts might want to notify parents/guardians, in writing, that all children will be considered unvaccinated, unless the district receives proof of a student’s COVID-19 vaccination status in one of two ways: (1) the parents/guardians provide written proof of the student’s vaccination status directly to the district, or (2) the parents/guardians provide the district with written authorization to obtain proof of a student’s COVID-19 vaccination status from the WIR.  The written notification would put parents/guardians on notice that, in the event the district establishes quarantine or other requirements based upon students’ vaccination status, any student for whom the district has not received proof of a student’s COVID-19 vaccination(s) would be subject to the established quarantine periods or other requirements. 

If a school district chooses to use the WIR data without explicit parental consent, the district may want to limit the types of policy decisions it bases on the data.  For instance, the school district might choose to avoid accessing a student’s vaccination status in determining whether that student must quarantine.  On the other hand, the school district might choose to access the vaccination status of all its students in order to determine if a district-wide masking policy is necessary based upon the vaccination rate of its student body.  In addition to these considerations, school districts that have a Confidentiality Agreement on file should verify that they are operating under the most recent version of the Confidentiality Agreement.  Although operating under an older version will not impact the current rights and responsibilities school districts have under such agreements related to accessing vaccination records, the language of the older versions could be confusing or misleading regarding those rights and responsibilities.  In order to determine whether the Confidentiality Agreement on file is up-to-date, a school district should compare the form provided in the link above with its own Confidentiality Agreement.  As depicted in the linked form, the district’s Confidentiality Agreement should have the form number (i.e., F-42008) followed by the version date (i.e., 02/2018) in the top left corner.  If a school district is operating under a Confidentiality Agreement with a different version date, it would be advisable to complete the form provided in the link and submit it to DHS without delay.