Colorado Department of Public Health and Environment

CIIS Header

 

Confidentiality/Security

Policy

The CIIS Confidentiality Policy applies to all individually identifiable information in all formats, including paper-based and electronic records. Information in CIIS can only be released to:

 

  • The individual or parent/guardian
  • The individual’s healthcare provider

confidential graphic

  • A school, childcare center or university where the individual is enrolled
  • A managed care organization or health insurer where the individual is enrolled
  • Hospitals
  • Persons or entities who have an agreement with the State of Colorado for immunizations
  • The Colorado Department of Health Care Policy and Financing for individuals enrolled in Medicaid

 

Authorized individuals can access immunization information in CIIS only for clinical (including data entry), quality assurance, public health or school entry law purposes. All individuals accessing CIIS are required to treat all information in CIIS as confidential. Any person who releases or makes confidential immunization records public in any unauthorized manner commits a class 1 misdemeanor and upon conviction thereof, shall be punished by 6-18 months in jail or a fine of $500 to $5000, or both. The unauthorized release of each record shall constitute a separate offense. Read the full CIIS Confidentiality Policy pdf logo

 

Great care and consideration are put into assuring the security of the Colorado Immunization Information System. The CIIS Security Policies and Procedures comply with the security standards defined by the following agencies: Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information, International Organization for Standardization, American National Standards Institute, National Institute of Standards and Technology, National Infrastructure Protection Center, and Crisis Emergency Response Team.

 

CIIS security measures include: user authentication, individual passwords changed every 90 days, and extensive audit trail records. CIIS revises its Security Policy and Procedures as the industry standards are updated. Read the CIIS Security Policy pdf logo