MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or...

31
i Revised 3-27-14 MCIR Region 1 Policy & Procedure Manual TABLE OF CONTENTS CHAPTER: PAGE: 1 USER/PROVIDER ADMINISTRATION 01-01 MDCH/MCIR Confidentiality Guidelines 1 01-02 MCIR *User/Usage Agreement Processing 7 01-03 Cancellation of MCIR Site/User ID and/or Password Information 10 01-04 Provider Reporting Compliance 11 01-05 R1 LHD Private Provider MCIR ID Usage 13 01-06 MCIR Record Requests and Releases 14 2 SYSTEM ADMINISTRATION 02-01 Merge File 16 02-02 MCIR Record Correction Process 17 3 DATA ENTRY, PROCESSING, QUALITY ASSURANCE & PROTECTION 03-01 Data Entry Standards 19 03-02 Processing of Opt-Out Forms 20 03-03 Regional Legacy Support 21 4 DATA ACCESS & REPORTING 04-01 Site Registration and Data Access 22 04-02 Use of AFIX Reports 23 5 HELP DESK OPERATIONS

Transcript of MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or...

Page 1: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

i – Revised 3-27-14

MMCCIIRR RReeggiioonn 11 PPoolliiccyy && PPrroocceedduurree MMaannuuaall

TTAABBLLEE OOFF CCOONNTTEENNTTSS

CCHHAAPPTTEERR:: PPAAGGEE::

1

USER/PROVIDER ADMINISTRATION

01-01 MDCH/MCIR Confidentiality Guidelines 1

01-02 MCIR *User/Usage Agreement Processing 7

01-03 Cancellation of MCIR Site/User ID and/or Password Information 10

01-04 Provider Reporting Compliance 11

01-05 R1 LHD Private Provider MCIR ID Usage 13

01-06 MCIR Record Requests and Releases 14

2

SYSTEM ADMINISTRATION

02-01 Merge File 16

02-02 MCIR Record Correction Process 17

3

DATA ENTRY, PROCESSING,

QUALITY ASSURANCE & PROTECTION

03-01 Data Entry Standards 19

03-02 Processing of Opt-Out Forms 20

03-03 Regional Legacy Support 21

4

DATA ACCESS & REPORTING

04-01 Site Registration and Data Access 22

04-02 Use of AFIX Reports 23

5

HELP DESK OPERATIONS

Page 2: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

ii – Revised 3-27-14

05-01 Help Desk Operations 24

6

MATERIALS DISTRIBUTION

7

MARKETING AND OUTREACH

8

TRAINING

9

GOVERNANCE

Page 3: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

3

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 01-01 v.1 Subject: MDCH/MCIR Confidentiality Guidelines

Effective Date: 06-15-07 Authority: MDCH, Regional Staff

Date Approved: 06-15-07 Page: 3 of 6

Policy Statement: Each Regional Office of the Michigan Care Improvement Registry (MCIR) will be

responsible for the Confidentiality of information pertaining to the information gathered and held within.

Using these guidelines, Regional staff will ensure that confidentiality, accuracy, timeliness, and

accountability will be of the highest standards.

Purpose of Policy: To ensure that there is a standard procedure in place for maintaining confidentiality

throughout all Regional activities.

Responsibility: It is the responsibility of all Regional Staff to safeguard the confidentiality of the

information flowing in and out of the registry.

Procedure: The following guidelines, compiled by the Michigan Department of Community Health,

outline the procedures for maintaining confidentiality and addressing security issues should they arise.

Confidentiality Guidelines for

The Michigan Care Improvement Registry (MCIR)

Notice: These guidelines, any part or its entirety, are subject to revisions by the Michigan

Department of Community Health (MDCH) at any time without advanced notice provided to all

interested agencies and/or providers.

I. Introduction

In 1996, the 88th

Legislature of the state of Michigan passed Public Act 540 (PA 540) Section

9207 of the act sanctioned the Michigan Department of Community Health the right to establish

an immunization registry, to be known as the Michigan childhood immunization registry, to

record information regarding immunizations performed by immunization providers. Subsection

(2) of Section 9207 states The information contained in the childhood immunization registry is

subject to the confidentiality and disclosure requirements of this section and sections 2637 and

2888 and to the rules promulgated under section 9227 (see those sections for additional

information). Thus PA 540 requires that information contained in the MCIR be kept

confidential. In 2006, the legislature of the State of Michigan adopted section 333.9207

Childhood immunization registry; Michigan care improvement registry; establishment; purpose;

confidentiality and disclosure requirements Sec. 9207:

(1) The department shall establish a registry, to be known as the "childhood immunization

registry", to record information regarding immunizations performed under this part. Beginning

after the effective date of the amendatory act that added section 9227(2), the "childhood

Page 4: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

4

immunization registry" shall be known as the "Michigan Care Improvement Registry". The

department shall enter information received under sections 2821 and 9206 in the registry.

(2) The information contained in the registry is subject to the confidentiality and disclosure

requirements of sections 2637 and 2888 and to the rules promulgated under section 9227. The

department may access the information contained in the registry when necessary to fulfill its

duties under this code.

(3) Upon receipt of a written request from an individual who is 20 years of age or older, the

department shall make any immunization information in the registry pertaining to that individual

inaccessible. The written request shall be in a form prescribed or otherwise authorized by the

department. The administrative rules for section 333.9227:

(1) The department shall promulgate rules to implement this part, including, but not

limited to, rules governing all of the following:

(a) Age periods for immunizations.

(b) The minimum ages at which immunization may be commenced.

(c) The minimum number of doses required during a specified time period.

(d) Minimum levels of immunization for children in school.

(e) Reporting under section 9206(3).

(f) The acquisition, maintenance, and dissemination of information contained in

the registry established under section 9207.

(2) The department shall promulgate rules to implement the expansion of the registry to include

the reporting and recording of additional information such as lead screening performed on

children.

The confidentiality policy is intended to delineate and ensure this firm level of confidentiality.

This document addresses the following information:

Section Description

Section II Describes the levels of access granted to various immunization providers,

states the MCIR usage agreement policy, and outlines the penalties in place

for violating the confidential policy.

Section III

Indicates how parents and individuals are notified of the registry

Section IV

Provides information on how parents and individuals may choose to not

participate in the MCIR.

Section V Describes the purposes of collecting the immunization information, and how

the information will be used.

Section VI

Provides information on the varying degrees of access to the registry by

different providers is delineated in section.

Section

VII

Outlines the penalties for inappropriate use or disclosure of immunization

information.

Page 5: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

5

II. Agreements to Protect Confidentiality

Access to the MCIR is permitted for the sole purpose of providing information and

documentation needed for immunization purposes. This access is permitted under the provisions

of MCL 540.9201, 9206, and 9227. Access to MCIR data is under the terms and conditions

prescribed the MDCH, and stipulated below.

Users, defined as anyone with access to the MCIR, must register and sign a formal user/usage

agreement Users are categorized into one of the following user types:

1 Public Provider

2 Private Provider

o Family Practice

o Pediatrician

o Internist

o OBGYN

o Site Administrator

o Pharmacies

o Long Term Care

3 School/Daycare/Camp Site Administrators

4 Health Care Organizations

5 WIC

6 Health Department Administrative Staff

7 MDCH Authorized Agent

8 MCIR Regional Administrators

Providers, defined as those who can authorize the administration of any immunizing agent (as

defined by Public Health Code MCL 333 9204), can be registered individually, or by

organization. In the latter case, the organization assumes full responsibility and liability for the

individual's usage of the MCIR, including any penalties associated with improper usage of the

MCIR and/or any immunization data associated with the MCIR.

Any physicians who practice outside of the state of Michigan but regularly treat residents of

Michigan (i.e., areas bordering Michigan) may be registered as MCIR users. Such providers

need to enter demographic and immunization encounter data for their patients who are Michigan

residents. The MCIR will not contain restrictions on entering data for children with out-of-state

addresses.

Page 6: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

6

Different user types will have varying degrees of access to MCIR data (see below). Anyone

wishing to use the MCIR must first register with the MCIR as a user by reading and signing a

user/usage agreement. All registered sites in MCIR have a Site Administrator responsible for adding or removing

additional users for each site. This individual is responsible for adding new users as well as

invalidating users to their site in the MCIR.

The first step to receive access to the Michigan Care Improvement Registry:

1. A site must designate a Site Administrator and complete a Provider Usage Agreement.

This agreement is then sent to the MCIR Regional Office for processing. The MCIR staff

registers the site in MCIR, and then trains the site administrator on the user registration

process.

2. Once the Site Administrator completes the registration process, they have the ability to

add other MCIR users to their site.

3. When a site administrator enrolls a user to the system the user receives a pin number

through an email from [email protected]

4. The user logins to the Single Sign Portal and creates a user id that includes The User ID

will be the user’s last name & first initial plus the 4-digit number that they enter.

5. Single Sign On system requires users to answer and confirm a set of Challenge/Response

Questions

6. The user will then subscribe to MCIR with the PIN number through the SSO application.

7. Users are required to change their password and answer the challenge/response questions

8. Registered users are required to change your password every 90 days.

9. Every year a register user is required to accept the MCIR User/Usage Confidentiality

Agreement online.

In addition, regional coordinators and/or staff are responsible for re-verifying or re-certifying

provider licenses or organizations every three years. The following process outlines an

acceptable method for re-verification or re-certification of provider licenses or organizational

status to ensure that users of the MCIR are appropriately licensed providers or organizations in

Michigan.

Every three years the provider licenses will be re-verified and every three years an

organization or individual within the organization will be re-certified.

Page 7: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

7

Provider licenses are re-verified as follows:

A. Primary verification method is to use the Michigan Department of

Licensing and Regulatory Affairs

B. If a provider license cannot be verified, the provider will be personally

notified within one business day. The provider's User ID/password will

then be immediately inactivated within one business day.

C. If a provider license cannot be re-verified, the provider will be personally

notified, within one business day. The provider's User ID/password will

then be inactivated within one business day.

D. It will be the provider's responsibility to investigate the issues related to

the non-verification.

Organizational status will be re-certified as follows:

A. Primary re-certification method is to use the licensing agency, the parents

organization (e.g., school district office for a school).

B. To re-certify an individual in a school district, such as the principal of a

school who signed the MCIR School User/Usage Agreement, the school

district office can be contacted.

C. If an organization or an individual within the organization cannot be re-

certified for any reason, the organization and/or individual will be notified

personally within one business day. The organization or individual

Password and User ID will then in inactivated within one business day.

D. It will be the responsibility of the organization or individual to investigate

the issues related to non-verification.

As a registered user of the MCIR, users agree to the following stipulations:

Users will handle information or documents obtained through the MCIR in a confidential

manner.

Users will restrict their use of the MCIR to accessing information and generating

documentation only as necessary to properly conduct the administration and management

of their duties as they relate to immunizations.

Users understand that transactions on the MCIR are logged and are subject for review for

overall usage.

Users will not furnish information of documentation obtained through the MCIR to

individuals for personal use nor to any individuals not directly involved with the conduct

of the duties of the user as they related to the administration, recording, and reviewing

Page 8: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

8

immunizations.

Users will not falsify any document or data obtained through the MCIR.

Users will not attempt to or copy all or any part of the database or the software used to

access the MCIR database for any unapproved purpose, nor attempt to falsify or

otherwise alter data in the MCIR database, or otherwise violate all or any portion of the

Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law

(MCL 333.2894) summarized on the back of the user/usage agreement.

Users will carefully and deliberately safeguard their access privileges and password for

the MCIR and will not permit the user of such access privileges by any other person,

unless expressively authorized by MDCH to possess such use.

Users agree to reports any threat to or violations of (whether real or perceived) to the

appropriate MCIR security personnel.

Any improper use of the MCIR that violates the preceding stipulations will result in revocation

of the user's access privileges and may include official penalties and/or sanctions as specified in

Public Act 540 of the Public Acts of 1996 (see attachment A), the Vital Records Law (MCL

333.2898), or the Michigan Computer Crime Law (Sec 752.797).

III. Notification

Pursuant to Section 2828 (3) of Public Act 540, upon receipt of a vital record consisting of a

birth registration transmitted by a local registrar pursuant to section 2815(2), the state registrar

shall transmit the information contained in the birth registration to the childhood immunization

registry created in section 9207. Thus, state laws do not require that parents receive any verbal

and/or written notification that their child's immunization records will be loaded into and become

part of the MCIR database. All Vaccine Information Statements (VIS) provided by the MDCH

contain a paragraph informing parents that all immunizations administered to their children will

be entered into the MCIR unless the parent signs an opt-out form. All parents of children born in

a Michigan hospital should receive a Child Passport. Included in this package will be

information about the MCIR

IV. Participation

The MCIR was authorized by the legislature to permit parents to opt-out if they so choose.

Parents/individuals who do not want immunization information about themselves or their

children in the MCIR are required to sign an opt-out form, which may be obtained from the local

health department, immunization provider or the Regional Immunization Coordinator.

Immunization and demographic information on any person who has chosen to opt-out is then no

longer accessible by users and no reminder or recalls are generated. However, a persons basic

demographic information - date of birth, gender and name remain within the MCIR for purposes

of accurately determining the population for the sole purpose of calculating community and state

immunization rates.

Page 9: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

9

Parents/individuals may choose not to receive Reminder/Recall notices. If a parents/individuals

chooses not to receive these notices they may notify their immunization provider to document

this in MCIR.

V. Use of Immunization Registry Data

MCIR benefits health care organizations, schools, licensed childcare programs, and Michigan's

citizens by consolidating immunization information from multiple providers. This reduces

vaccine-preventable diseases, over-vaccination, and allows providers to see up-to-date patient

immunization history. MCIR is governed by P.A.368 333.9207

and the associated rules R 325.162. MCIR assists providers in keeping a persons immunization

status up-to-date, decreases the number of duplicate vaccines administered, and gives the

provider an efficient means by which to track a persons immunization history. More succinctly,

the MCIR:

o Maintains immunization histories through the lifespan for individuals.

o Gives providers and other interested parties the ability to quickly and efficiently

look up a person’s immunization status.

o Provides a report of immunizations that are due.

o Evaluates immunization status and recommends future dose dates.

o Gives interested parties the ability to enter immunization information into the

MCIR via the web-based user interface or through electronic messaging.

o Provides immunization assessments.

o Can assess immunization coverage of a population.

o Assists in streamlining vaccination reports.

o Provides different levels of data access (see below), and safeguards

confidentiality.

o Allows a provider to manage their vaccine inventory.

VI. Access to and disclosure of Information

Page 10: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

Access to the MCIR is restricted to Immunization Providers and others, such as schools and day

care centers who have a need for such access, as well as technical and program staff at local and

state health departments and the MCIR Regional Administrator. The following table outlines the

different types of access to MCIR data that are allowed for each user group (type). Note that

“Add Person” means that the provider has the ability to add a person demographic record into the

MCIR database. “Update Person Info” means the provider has the authority to alter

demographic information already appearing as part of a specific record; “Add Immunization

Encounter” grants the provider access to add immunization information to a persons record;

“Modify Immunization Encounter” means that the provider can change immunization data they

entered into the MCIR; “View Immunization Status” allows providers to assess the if a person is

up-to-date, not up-to-date, or overdue with respect to their immunization status; and “View

Immunization History” gives providers permission to examine the entire immunization history

(immunization record) of a person in MCIR.

User Type

Add

Person

Update

Person

Add

Immuniz

ation

Encount

er

Modify

Immunizati

on

Encounter

View

Immunizati

on Status

View

Immunizati

on History

Providers (public

and private)

* * * * * *

Health care

organizations

* *

Schools/day

cares/camps

* * * * * *

Health

Department

Administrator

* *

MDCH

authorized agents

* * * * * *

MCIR Regional

Administrator

* * * * * *

WIC * *

* = Has authorization.

Users are classified and provided a discrete level of access based on the information they need to

obtain in order to carry out specific functions. That is, access is granted to users only on a need-

to-know basis. Providers have a limited browse (10 records) from the MCIR database, and must

enter unique identifying demographic information into the MCIR to locate a persons record. In

addition, providers can only enter additional information into the MCIR, and can only alter

information they specifically entered. If a provider finds that information entered by another

agency or provider is incorrect, the provider who finds the error must complete a petition for

Page 11: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

modification form that indicates what error(s) was made, requesting that it be corrected by their

regional coordinator.

All authorized users must sign a User Agreement before they are provided with a unique

username and password from the State of Michigan’s Single Sign On Application to access the

MCIR.

All requests for research use of the data should be directed to the Immunization Division and the

Internal Review Board at the Michigan Department of Community Health. The request will be

reviewed by the State Internal Review Board and approved, refused or returned for additional

information.

Disclosure of MCIR data on individuals by users to others, including law enforcement is

specifically prohibited. All sub-pœnas and other legal demands for MCIR data received by any

authorized user of the MCIR should be referred to the Division of Immunization, Michigan

Department of Community Health. Responses to these matters will be in accordance with

MDCH policy on sub-pœnas, court orders and other legal documents by the Office of Legal

Affairs.

VII. Penalties for Unauthorized Disclosures

The Division of Immunizations has controls in place that when a person reports a misuse of

MCIR data the MCIR technical staff may review the audit logs to research a breach of

confidentiality. The user name, time stamp and access to records are recorded in the audit file.

All users are required to follow HIPAA guidelines with printed and electronic information in

their medical offices. Schools are required to follow Family Education Rights and Privacy Act

(FERPA) guidelines for protect student information.

As previously indicated in Section II of this policy, any breach or violation of any portion of the

stipulations delineated in the User/Usage Agreement that the user signs will result in revocation

of the user's access privileges and may include official penalties and/or sanctions as specified in

Public Act 540 of the Public Acts of 1996 (see attachment A), the Vital Records Law (MCL

333.2898), or the Michigan Computer Crime Law (Sec. 752.797). Please see the appropriate

statute for the specific penalties associated with violation of a particular mandate. For example,

a person who is found to be in violation of the Vital Records Law is guilty of a misdemeanor

punishable by imprisonment for not more than 1 year, or a fine of not more than $1,000.00, or

both. A departmental employee who violates this regulation shall be subject to immediate

dismissal.

Amendment: November 2013

Page 12: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

12

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 01-02 v.3 Subject: MCIR User/Usage Agreement Processing

Effective Date: 06-15-07 Authority: MDCH, Regional Staff

Date Approved: 06-15-07 Page: 1 of 2

Policy Statement: Regional MCIR offices are responsible for verification and processing of

provider user/usage agreements. All activities associated with processing of these agreements

shall be conducted in a timely, efficient, effective and professional manner. Confidentiality,

accuracy and accountability will be maintained at all times.

Purpose of Policy:

This policy shall establish uniform standardized procedures to ensure that:

- User/usage agreements are processed in a uniform and timely manner;

- Requests to access the MCIR are timely verified, processed and approved;

- The licensure status of Michigan health care providers is accurately assessed; and

- Proper credentialing of other organizations is conducted.

Responsibility:

The MCIR Regional coordinator and assigned staff shall ensure that:

- User/usage agreements are processed in a timely manner.

- All information pertaining to a user/usage agreement is maintained in manner ensuring

the confidentiality and integrity of provided documentation.

Procedure: The procedure set forth below establishes standards for the distribution, receipt,

processing, and approval/denial of MCIR user/ usage agreements. This includes verification and

validation of the requesting organization and/or the health care provider. Regional MCIR

Administrator rights will be issued by the Michigan Department of Community Health (MDCH).

A. Distribution of User/Usage Agreements may occur with or without a MCIR

information/training packet. If an information training packet is provided, it is

recommended that the following be included:

1. Instructions for completing a MCIR user/usage agreement;

2. MCIR Reporting (Opt Out) form;

3. Petition for Modification to MCIR Information form including instructions;

4. Registry information pamphlet;

5. Name and phone number of the Regional MCIR Coordinator; and

6. Any other relevant materials.

B. MCIR user/usage agreements may be distributed in the following manner:

1. Through regional MCIR outreach efforts including presentations;

2. Through local health departments and their IAP Coordinator

3. Through MDCH Regional Field Representatives;

4. MDCH, Division of Immunization;

5. Downloaded from the Resource Library at www.mcir.org; and

6. Directly from the Regional MCIR office upon request.

C. Processing of MCIR user/usage agreements:

1. Thoroughly completed agreements will be submitted to the Regional MCIR

office;

2. Upon receipt, agreements will be timely reviewed and processed;

Page 13: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

13

3. New sites will be timely added to the MCIR and issued a site ID;

4. Identified designated users will be attached to the MCIR Site ID and provided

with instructions for MCIR User Registration;

5. New users will be counseled regarding sharing of MCIR login information

constitutes a breach of HIPAA standards as well as the MCIR User/Usage

Agreement;

6. If a provider site fails to timely submit a completed MCIR User Agreement

(renewal) the Regional MCIR office may at its discretion terminate MCIR access

rights to the provider until such time as signed updated agreement is received. A

determination to discontinue access rights to the MCIR shall be made on a case

by case basis following a thorough review of all pertinent information.

D. Verification of Provider/Organization License:

1. Health care Provider licensure is verified:

a. Online through MDCH: http://www.dleg.state.mi.us/free/default.asp;

and

b. Through proof of current licensure status submitted by the provider;

Verification of other non-provider organizations may be conducted by contacting the

organization’s CEO, director, president or administrator. Under certain circumstances a

certifying or licensing agency may be available.

E. Non-Verification of Provider/Organization:

1. If a health care provider or organization cannot be verified, the

provider/organization shall be notified in a timely manner:

2. The health care provider or organization is then responsible for further

investigation and resolution of the underlying circumstances resulting in non-

verification; and

3. It is the responsibility of the health care provider or organization to contact the

Regional MCIR Office to provide additional information allowing for resolution

of the non-verification.

F. Retention and filing of User/Usage Agreements

1. Completed, verified and processed user/usage agreements will be retained on file

at the Regional MCIR Office; and

2. User/Usage Agreements will be appropriately stored and maintained to maintain

confidentiality and document integrity.

G. Requests for User IDs and Passwords:

When the Regional MCIR office is contacted regarding forgotten User IDs or passwords. The

password will not be reset until the Regional office validates that the provided information

(user, site) is appropriate to the request.

H. Revocation of Password and I.D. numbers:

1. The revocation of a MCIR Site ID or of a user’s login and password may be

necessary under circumstances in which the confidentiality of an ID has been

compromised or when the provider who signed the user/usage agreement departs

from employment with the organization;

2. 2. It is the responsibility of the Regional MCIR office to proceed with the

revocation process or in the alternative with processing of a new MCIR

user/usage agreement as appropriate;

3. Organizations and users active in the MCIR will be notified of the termination of

their rights and rationale(s) surrounding the termination; and

Page 14: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

14

4. The organization will be notified by the Regional MCIR office of the need to

prepare and submit a new MCIR user/usage agreement if appropriate.

I. MCIR Registration Renewal

MCIR User/Usage Agreements are valid for a period of three (3) years from the date of

signature. A new form shall be prepared, signed and submitted by the provider/organization

to ensure continued, uninterrupted MCIR access. It should be noted that processing of MCIR

User/Usage Agreement renewals are subject to the licensure verification process.

Related Policies and Procedures: None

Note: Comparable to MDCH Policy 01-01 v.2

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-2011

Adopted: 6-16-2005

Page 15: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

15

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 01-03 v.2 Subject: Cancellation of MCIR Site, User ID

and/or Password Information

Effective Date: 06-15-07 Authority: MDCH, Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: The process described below will be followed for the cancellation or

modification of any regional MCIR user information. ‘Site’ and’ individual’ MCIR IDs and/or

passwords are both included in this policy.

Purpose of Policy: To provide a standardized process for the cancellation or modification of any

regional MCIR user information.

Responsibility: It is the responsibility of the Regional Coordinator and other regional staff

members to cancel or modify a MCIR ID/password as determined to be necessary.

Procedure: A regional MCIR ‘Site’ or ‘individual’ user ID and/or passwords may be modified or

cancelled at any time, for one or more of the following reasons:

1. Routine cancellation and reassignment of an ID and/or password by the Regional Office.

2. The individual who signed the user agreement for the organization in no longer with the

practice/organization.

3. There is reason to believe that there has been a breach in security and/or confidentiality.

4. The provider assigned the ‘Site’ ID and password is deceased.

5. The user assigned the ‘individual’ user ID and password is no longer with the practice.

6. The provider office or specific physician attached to the ‘Site’ ID and password has either

moved outside the regional MCIR project jurisdiction, has collaborated with another medical

facility, or is no longer practicing medicine.

7. At regional discretion

A letter will be sent to the provider, or in the event of a death, to the provider’s organization

informing them of any change or cancellation made to the MCIR ID and password information.

A record of all changes and cancellations will be maintained at the Regional Office indefinitely.

Related Policies and Procedures: #01-01 MDCH/MCIR Confidentiality Guidelines; #01-02

MCIR *User/Usage Agreement Processing

Notes: None

Revision and Review History: Reviewed 6-15-07, 10-14-11, 10-23-13

Adopted: 06-16-2005

Page 16: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

16

MICHIGAN CARE IMPROVEMENT REGISTRY

REGION 1 POLICIES AND PROCEDURES

Number: 01-04 v.2 Subject: Provider Reporting Compliance

Effective Date: 06-15-07 Authority: Region 1 MCIR, all R1 LHDs

Date Approved: 06-15-07 Page: 1of 2

Policy Statement: The Michigan Department of Community Health (MDCH) requires

development and implementation of a policy to ensure compliance with requirements addressing

provider reporting of immunization data into the MCIR. Providers identified as failing to report

required data shall have a “MCIR Reporting Outreach Plan” developed and implemented to assist

in compliance with MCIR reporting requirements. A Region 1 MCIR Manager shall submit the

name and address of providers who fail to comply with applicable Outreach Plans, including

support documentation, to the MDCH State MCIR Coordinator for review and further action.

Policy Statement: The Michigan Department of Community Health (MDCH) requires

development and implementation of a policy to ensure compliance with requirements addressing

provider reporting of immunization data into the MCIR. Providers identified as failing to report

required data shall have a “MCIR Reporting Outreach Plan” developed and implemented to assist

in compliance with MCIR reporting requirements. A Region 1 MCIR Manager shall submit the

name and address of providers who fail to comply with applicable Outreach Plans, including

support documentation, to the MDCH State MCIR Coordinator for review and further action.

Purpose of Policy: 1. To ensure accordance with Michigan Public Health Code sections including 333.9206 &

333.9207, Administrative Rule 325.163(1) and any applicable VFC requirements;

2. To encourage immunizing providers to utilize the MCIR as an immunization reference and

assessment tool; and

3. To ensure compliance with MCIR data entry time frames including Administrative Rule

325.163(6) requiring immunization data reporting to the MCIR within 72 hours (3 calendar

days) of vaccine administration, utilizing the benchmark provided in the Michigan Local

Public Health Accreditation Program Minimum Program Requirement Indicator Guide

(Section V: Immunization, Indicator 4.3) for all providers.

Responsibility: It is the responsibility of Region 1 MCIR and/or their designee(s) to ensure that

all immunizing Region One providers use the MCIR in accordance with the Purpose of Policy set

forth above.

Procedure for Regional LHD non-compliance: 1. MCIR staff shall monitor data submissions made by regional LHDs on a monthly basis.

Monitoring shall include review of the interval at which data transfers are conducted;

2. Region 1 MCIR shall contact a LHD upon identification of area(s) of non-compliance. A

regional LHD shall follow up on provided information in a timely manner with issuance

of a Corrective Action Plan as applicable;

3. Identified areas of non-compliance which continue for a period of three (3) months or

more, will result in contact by the State MCIR Coordinator. The State MCIR Coordinator

will review the issues and determine if additional corrective measures are necessary to

address the identified areas of non-compliance; and

4. The State MCIR Coordinator shall, in consultation with the Assessment & Vaccine

Management Section Manager, determine the need for referral of non-compliant LHDs to

the MDCH, Bureau of Health Professions.

Page 17: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

17

Procedure for Regional private provider non-compliance:

1. MCIR staff shall monitor data submissions made by regional immunization providers on

a monthly basis to identify areas of non-compliance, making contact with those providers

on a case-by-case basis as warranted;

2. Region 1 MCIR staff shall notify a provider of the specific area(s) of non-compliance

utilizing the Step 1 compliance letter template. This notification shall include reference to

reporting requirements of the Public Health Code, Administrative Rules and VFC

Program as applicable, allowing the provider 30 days to comply;

3. If a provider fails to resolve the non-compliance within the 30 days allowed, Regional

MCIR staff shall notify the LHD in the jurisdiction the provider site resides, asking the

Medical Director or Health Officer of the LHD (or designee) to contact the provider

within seven (7) working days of the region’s referral, utilizing the Step 2 LHD

compliance letter template (providing the region with a copy);

4. A provider shall be given 30 days subsequent to LHD contact to demonstrate timely and

accurate submission of immunization data into the MCIR;

5. If a provider fails, within the 30-day period set forth in subpart 4, to demonstrate the

ability to timely and accurately submit immunization data into the MCIR, the matter will

be referred to the State MCIR Coordinator for review and consultation with the

Assessment & Vaccine Management Section Manager. It should be noted that this review

may result in referral to the MDCH Immunization Division Director or designee, and/or

the Bureau of Health Professions Licensing and Regulatory Affairs (LARA).

Related Policies and Procedures: #03-01 Data Entry Standards

Notes: The regional MCIR office may maintain direct contact with a non-compliant provider

during any point of the above procedures, if warranted. Providers who have gone through the

process once and are being contacted for the second time (within one year from the original date

of follow-up), will be contacted by the Region. If the provider fails to comply within 30 days, the

Region will make a direct referral of the provider to MDCH for further follow-up.

Revision and Review History: Reviewed 2-26-1998, 9-22-06, 6-15-07 & 10-8-2010, 10-23-13;

Revised 9-22-06, 10-14-2011, 4-10-2012

Adopted: 3-15-05

Page 18: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

18

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 01-05 v.1 Subject: R1 LHD Private Provider MCIR ID Usage

Effective Date: 06-15-07 Authority: Region 1 MCIR, authorized R1 LHDs

Date Approved: 06-15-07 Page: 1 of 2

Policy Statement: Region One LHDs should have access to provider sites to monitor

jurisdictional immunization rates. Participating VFC provider site information shall be shared as a

result of language in the VFC contract, however, private (non-VFC) sites must allow LHDs

permission/access before sharing. Regional staff will encourage private providers to allow local

health department access to their site information as needed.

Purpose of Policy: 1. To allow LHDs to have access to individual MCIR Site IDs and data for monitoring

jurisdictional immunization rates.

2. To ensure private providers have given their permission to allow LHDs access to their MCIR

Site/information, by acquiring signed documentation designating so.

Responsibility:

1. Region 1 staff will encourage private providers to work with LHDs by allowing the LHDs

access to their MCIR site/information. If LHD access is approved by the site, Region 1 MCIR

staff will obtain written consent from the provider(s), via the Provider MCIR ID Usage

Consent Form, to access individual provider’s MCIR sites.

2. Region 1 MCIR shall maintain the signed MCIR ID Consent Form, while providing a copy to

the provider and LHD.

3. The regional MCIR office shall grant and/or invalidate all regional LHD private provider

access rights, based on the consent and/or rescind of any regional provider.

4. The regional MCIR office will maintain the Provider MCIR ID Consent Form for an

indefinite period of time. This form will verify the particular private provider Site IDs that

were released to each LHD, specifying the release/rescind dates.

Procedure:

Region 1Steps for encouraging LHD private provider access rights:

1. Regional staff will maintain provider information, identifying VFC and private provider sites.

2. Region 1 MCIR will monitor active providers, identifying non-VFC private providers.

3. Regional staff will offer Provider MCIR ID Consent Forms to each private provider office in

their jurisdiction, encouraging them to allow LHD access rights to their MCIR site.

4. Region 1 MCIR must receive a complete, signed Provider MCIR ID Consent Form from the

private provider office before the LHD will be granted access rights.

5. At any point in time, a provider may rescind consent for the LHD to access the MCIR under

their Site ID. The region must receive the rescind request in writing, allowing 30 days for

processing and removal of LHD staff.

6. All information obtained by the LHD while under any private provider ID shall only be

shared and utilized to support the provider office under whose Site ID the data was obtained.

Related Policies and Procedures: #01-01 MDCH/MCIR Confidentiality Policy; # 01-03

Cancellation of MCIR Site, User ID and/or Password Information.

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 19: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

19

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 01-06 v.2 Subject: MCIR Record Requests and Releases

Effective Date: 06-15-07 Authority: MDCH, Regional MCIR Staff, all MCIR Users

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: Immunization information maintained in the MCIR constitutes the official

immunization record for the State of Michigan. Immunization data maintained in the MCIR is

proprietary to the State of Michigan. The Michigan Department of Community Health (MDCH)

retains responsibility for processing requests for release of MCIR information. However, MDCH

specifically authorizes Regional MCIR offices to release MCIR information under circumstances

in which there is no indication that the requested information will be utilized in a legal

proceeding. In complying with a parent or an individual’s request for MCIR data, Regional MCIR

offices shall utilize the form entitled Request for Official State of Michigan Immunization Record.

Purpose of Policy: To identify the procedure for releasing an Official State of Michigan

Immunization Record from MCIR to the individual(s) listed as Responsible Party in MCIR,

referring requests submitted to Region 1 MCIR via subpoena, freedom of information act (FOIA),

court order or other legal demand by attorneys, law firms, health care organizations, law

enforcement, etc. to MDCH for review and further processing as appropriate.

Responsibility: Region 1 MCIR staff and users are responsible for ensuring that MCIR records

are only released to the appropriate parties:

1. Any Responsible Party indicated in the MCIR

2. Other medical practices, schools or Health Care Organizations for immunization assessment

purposes only.

Pursuant to MDCH MCIR Confidentiality Guidelines – Disclosure of MCIR data on individuals

by users to others, including law enforcement is specifically prohibited. All subpoenas and other

legal demands for MCIR data received by any authorized user of the MCIR should be referred to

the Division of Immunization, Michigan Department of Community Health. Requests will be

responded to in accordance with MDCH policy on subpoenas, court orders and other legal

documents by the Office of Legal Affairs.

Procedure for all MCIR users:

1. All subpoenas, FOIA requests, court orders and any other legal demands for MCIR

information shall be timely forwarded to the Michigan Department of Community Health,

Division of Immunization, attention MCIR, PO Box 30195, Lansing, Michigan 48909.

2. Medical practices, schools, LHDs or other Health Care Organizations should follow their

internal policies for records releases.

3. Records released should be the 1-page Official State of Michigan immunization record

without address.

Procedure for Region 1 MCIR staff: 1. All individual requests for Official State of Michigan Immunization records should initially

be referred to the individual’s provider or local health department for release. Requests made

via subpoena, freedom of information act (FOIA), court order or other legal demand by

attorneys, law firms, health care organizations, law enforcement, etc. shall be referred to

MDCH for review and further processing as appropriate.

2. If the individual’s provider or LHD is unavailable or unable to process the request,

individuals should be provided with the Request for Official State of Michigan Immunization

Page 20: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

20

Record form to complete and send in along with a copy of the requestor’s state issued

identification card or driver’s license.

3. Once the completed Request for Official State of Michigan Immunization Record form is

received along with supporting documentation, Region 1 MCIR staff will process the request

within 14 business days.

Related Policies and Procedures: #01-01 MDCH/MCIR Confidentiality Guidelines; VFC & MI-

VFC Provider Resource Book (II-pgs. 6&7).

Notes: For the “Penalties for Unauthorized Disclosures,” see policy #01-01 MDCH/MCIR

Confidentiality Guidelines.

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 21: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

21

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 02-01 v.2 Subject: Merge File

Effective Date: 06-15-07 Authority: Region 1 MCIR Office

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: A standard procedure will be utilized to assess records in a Merge Queue.

Purpose of Policy: To establish and implement a consistent, accurate, and reproducible

methodology for evaluation of MCIR records flagged for merge.

Responsibility: The Michigan Department of Community Health (MDCH) and/or Region 1

MCIR staff shall maintain the merge file and all required documentation.

Procedure: 1. Review each record contained in the Merge File.

2. Verify that the records specified are for the same client. If indicators are insufficient to

allow for an accurate determination, contact the current provider for supporting

information. If the provider is unable to substantiate information for completion of the

merge, a responsible party may be contacted.

3. Address issues affecting the MCIR Vaccine Inventory Module.

4. Verify that all applicable MCIR fields are appropriately arranged allowing for successful

completion of the merge process. Include the incorporation of alias names as needed.

5. Determine whether records are appropriate for merge or whether they should be

designated as “Not Duplicates.”

6. Region 1 staff will retain a printed copy of the merge file for 30 days, while properly

discarding supporting documentation.

Related Policies and Procedures: #02-02 MCIR Record Correction Process

Notes:

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 22: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

22

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 02-02 v.2 Subject: MCIR Record Correction Process

Effective Date: 06-15-07 Authority: MDCH and Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: MCIR Administrative Access will be utilized by Region 1 staff for the

purpose of a modification to demographic information, or the deletion of an entire MCIR record.

Purpose of Policy: To define a consistent, accurate, and reproducible methodology for MCIR

record corrections.

Responsibility: The Michigan Department of Community Health (MDCH) and Region 1 MCIR

will modify demographic information and/or delete MCIR records if warranted. Region 1MCIR

staff will verify provider documentation and the associated MCIR records to establish the validity

of such requests.

Procedure:

1. If the MCIR user (with read and write access) identifies an error to a MCIR record, which was

entered by their office, the user may delete or modify the information. The change does not

require the submission of a Petition for Modification* to the Regional Office.

2. If the MCIR user identifies information that is not correct and is a view only user of the

MCIR, or the error is on data that was not entered by that site, a Petition for Modification

must be submitted to Regional staff in order for the corrections to be made. Appropriate

documentation may be required for requested modifications to a MCIR record. Sites

requesting a name change are NOT required to submit additional documentation (the office

staff should have verified the name with the responsible party in following their own internal

policies).

A. If the change is determined to be valid, the Petition for Modification will be processed

within 7 days of receipt of the change request and:

1.) Regional staff will determine the modification action:

a.) Modify and force record to merge (Vaccines For Children providers

may be asked to perform quality assurance on records that may affect

their inventory prior to a merge)

b.) Modify demographic information (the requesting provider may be

asked to update this information); or

c.) Delete the record

2.) All confidential documentation will be shredded once modifications are completed.

3.) All Petitions for Modification will be maintained for a minimum of 60 days from the

date of change.

B. If the change is determined to be inappropriate:

4.) The applicant will be contacted and informed of the denial and the reason(s) for the

denial. If the denial is due to insufficient documentation, submitters are encouraged

to resubmit the Petition for Modification with the proper documentation to the

Region 1 MCIR Office.

5.) A copy of the denied petitions (not related to insufficient documentation) will be

retained for 30 days.

Petitions for Modification will be denied if the requesting office is able to perform the

requested changes.

Page 23: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

23

3. If the request necessitates investigation by MDCH, the original Petition for Modification will

be forwarded to MDCH via U.S. mail and a copy of the original with any supporting

documentation will be kept on file at the Regional Office for a minimum of 1 year.

Notes: All official documents received will be shredded once modifications have occurred. The

regional MCIR office is prohibited from retaining this information. Requesting sites shall verify

information and supporting documentation following their internal office policies, and forward

only the Petition for Modification form to the Region.

*A Petition for Modification is any written or verbal request for changes to a MCIR record,

however, Region 1 MCIR does encourage the use of the Petition for Modification form.

Related Policies and Procedures: #02-01 Merge File

Revision and Review History: Reviewed and revised 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 24: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

24

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 03-01 v.1 Subject: Data Entry Standards

Effective Date: 06-15-07 Authority: All Michigan Immunizing Provider Offices

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: All immunization providers in the state of Michigan are required to report

immunizations to the Michigan Care Improvement Registry (MCIR) for any individuals under the

age of 20 years, and are strongly encouraged to input immunization data for adults as well. In

addition, all Michigan providers participating in the Vaccines for Children (VFC) program are

required to follow their MI-VFC agreement regarding MCIR data entry.

Purpose of Policy: 1. To ensure compliance with Michigan Public Health Code sections including but not limited

to 333.9206 and 333.9207, MCIR Administrative Rules, and any applicable VFC

requirements

2. To ensure compliance with MCIR data entry timeframes including Administrative Rule

325.163(6) requiring immunization reporting to the MCIR within 72 hours (3 calendar days)

of vaccine administration.

Responsibility: It is the responsibility of medical providers who vaccinate children in the state

of Michigan to follow the standards outlined in P.A. 540 regarding MCIR data entry. According

to Public Act 540 of 1996 and the Administrative Rules [R325.163], which govern the

immunizations given to children, any physician who administers immunizations to a child under

the age of 20 is required to report this information to the MCIR within 72 hours of administration.

Providers who administer immunizations will also report any immunization administered to a

child born after December 31, 1993, or any immunization administered to a child who was born

before January 1, 1994 if the child is less than 20 years of age. We are most interested in the

timely reporting of immunizations, and will work with providers not meeting these mandates to

resolve any issues. Exceptions by the Regional Office will be addressed on a case by case basis.

Those providers not in compliance will be addressed using the Provider Reporting Compliance

Policy.

Related Policies and Procedures: #01-04 Provider Reporting Compliance; VFC & MI-VFC

Provider Resource Book (pgs. I-4 &5, II-1&2, and II-6&7); Michigan Public Health Code,

Public Act 540 of 1996, Public Act 91 of 2006 and MCIR Administrative Rules

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 25: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

25

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 03-02 v. 3 Subject: Processing of “Opt-out” forms

Effective Date: 06-15-07 Authority: MDCH and Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: A standard procedure will be utilized when processing Participation in MCIR

Reporting (or Opt-Out) forms.

Purpose of Policy: In the event that an individual objects to their (or their child’s) immunization

information being reported to the MCIR or the individual would like to rescind a previous opt-

out, an Opt-Out form will be processed by the regional office in a standard and timely manner.

Responsibility: The Regional Coordinator and staff, as assigned, will process the Opt-out forms

that are submitted to the Region 1 MCIR.

Procedure:

Parental Objection Opt-Out / Rescind:

a. In the event that an individual or parent of a child objects having their immunization

information reported to the MCIR, the provider shall have the individual complete an

Opt-Out form.

b. It is suggested that the provider discuss with the individual their reasoning for requesting

the opt out prior to completion of an Opt-Out form. Providers should attempt to educate

the individual on the registry, and the importance of leaving the information in the MCIR.

c. If a completed opt-out form is received by a provider, a copy should be made for the

parent as well as for their records, and the original should be submitted to the regional

office (a copy may be faxed to expedite processing).

d. In the event that an individual wishes to rescind a previous objection, the Opt-Out copy

kept by the provider must be completed by the individual and submitted to the Regional

Office for processing (a copy may be faxed to expedite processing).

e. Upon receipt of the completed Opt-Out form, the Regional staff will either opt the

individual out of, or back in to the MCIR.

f. The MCIR regional staff will sign and date all processed Opt-Out forms, file the

documents and retain indefinitely.

Related Policies and Procedures: #02-02 Record Correction Processing

Revision and Review History: Reviewed 6-15-07,10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 26: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

26

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 03-03 v.2 Subject: Regional Legacy Support

Effective Date: 06-15-07 Authority: Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: The process described below will be followed by Region 1 MCIR when

receiving and processing legacy data from regional providers. Legacy data are all immunization

encounters administered prior to the last 6 months (200 days, per MDCH accreditation standards)

that have not been documented in the MCIR.

Purpose of Policy: To provide a standardized method by which the regional MCIR office will

receive and process legacy data from regional providers.

Responsibility:

1. It is the responsibility of the provider to ensure the timely documentation of administered

immunizations in the Michigan Care Improvement Registry.

2. Provider legacy data support will only be preformed at the discretion of the regional MCIR

office.

Procedure: Once the Region 1 MCIR has determined the necessity for providing legacy support

to a provider, the following process will be followed:

1. The provider must supply the regional MCIR office with copies of the childhood

immunization records for all children within the specified age range; under some

circumstances Regional Staff may be authorized to pull and copy charts.

2. Records will be processed by regional MCIR Staff and will be entered in to the MCIR within

a time frame acceptable to both MCIR staff and the private provider.

3. If an error is discovered in the request, or if the request is in any way unreadable or

questionable, the record will be returned to the private provider office for correction and

resubmission.

4. Processed records are shredded immediately following processing.

5. Regional staff will only implement one legacy load per site. Sites requesting a subsequent

legacy visit will be addressed on a case by case basis.

Related Policies and Procedures: # 01-01 MDCH/MCIR Confidentiality Guidelines; # 01-04

Provider Compliance Reporting; # 03-01 Data Entry Standards

Notes: Petitions for Modification are required for MCIR record modifications.

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 6-16-2005

Page 27: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

27

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 03-04 v1 Subject: Processing Adoption Changes

Effective Date: Authority: Regional Staff

Date Approved: Page: 1 of 1

Policy Statement: Regional MCIR offices are responsible for the processing of duplicate

records, petition for modification (P4M) forms and name change requests, many as a result of

adoption. All activities associated with the processing of adoptive records must be conducted in a

discreet, timely, efficient and professional manner. Confidentiality, privacy, accuracy and

accountability will be maintained at all times.

Purpose of Policy: To establish and implement a standardized method for the processing of

records involving changes due to adoption.

Responsibility:

1. It is the responsibility of the provider to submit a Petition for Modification form, identifying

they have reviewed the appropriate documentation to request record changes due to adoption.

2. Regional staff processing Name Change Request forms or merges due to adoption will ensure

the appropriate information is reviewed prior to processing changes.

Procedure:

1. Petition for Modification forms will be processed within a maximum of 3 business days of

receipt of the change request if the adoption information is indicated and completed in detail

and:

a. A new MCIR record will be created under the adoptive name.

b. Immunizations from the birth record will be entered as historical doses into the new

record, using the county LHD clinic site for data entry.

c. Alias names will be deleted, as well as other data that could create a tie between

records (at the discretion of regional staff).

d. The birth record will be opted out.

e. Documentation of the date and number of adoption birth record opt outs will be kept

indefinitely in the Opt Out file.

2. Request to Change Name forms sent directly to the regional office will be processed within 3

business days of receipt of the change request if the adoption information is indicated and

accompanied by the appropriate documentation, following the procedure outlined in 1a-1e as

stated above.

3. Records identified in the de-duplication queue as potential adoptive records (that are not

accompanied by the appropriate documentation from the user that flagged such records) will

be processed as follows:

a. The user who flagged the record as duplicates will be contacted to submit a Petition

for Modification form that will be processed following the procedure outlined in 1a-

1e as stated above, after the pair is marked as Not Duplicates.

b. If the record was flagged by the system algorithm (dba scheduler) or by efforts

conducted by regional staff, the last known immunizing provider and/or medical

home will be contacted for additional information

i. If the child is determined to be active, a Petition for Modification form will

be requested and processed following the procedure outlined in 1a-1e as

stated above, after the pair has been marked as Not Duplicates.

ii. If the child is determined to be inactive, a P4M will be completed by regional

staff, documenting confirmation of information by providers (including the

Page 28: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

28

contact person), and processed following the procedure outlined in 1a-1e as

stated above, after the pair has been marked as Not Duplicates.

4. If an error is discovered in the request, or if the request is in any way unreadable or

questionable, the record will be returned to the private provider office for correction and

resubmission.

5. Processed records are shredded immediately after completion, noting the date and number of

birth record opt outs in the Opt Out file.

Related Policies and Procedures: # 01-01 MDCH/MCIR Confidentiality Guidelines; # 01-04

Provider Compliance Reporting; # 03-01 Data Entry Standards

Notes: Petitions for Modification are required for MCIR record modifications.

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 6-16-2005

Page 29: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

29

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 04-01 Subject: MCIR Data Access

Effective Date: 06-15-07 Authority: MDCH and Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: Region 1 MCIR will ensure that access to the registry and/or data will only be

given to approved/licensed sites/users that have completed the necessary User Agreements and

registration processes.

Purpose of Policy: To assure only approved users are given access to the registry to protect the confidentiality/use of

MCIR data.

Responsibility: All Regional MCIR Staff are responsible for safeguarding MCIR data, giving

MCIR access only to registered sites/users.

Procedure:

1. Prior to issuing Site/User Ids and passwords for MCIR access, the region will have all of

the appropriate signed documentation on file.

2. Individual site data will not be shared with other sites unless permission is granted from

the Provider/Site Administrator, using the Provider MCIR ID Usage Consent Form.

3. Local health departments will be allowed to see more detailed data from VFC sites, as

well as population coverage reports for all providers in their jurisdiction (per VFC

agreement and accreditation language).

4. Any misuse of the MCIR will result in immediate suspension of MCIR access, with

potential termination of access rights after further investigation.

Related Policies and Procedures: #01-01 MDCH/MCIR Confidentiality Policy; # 01-03

Cancellation of MCIR Site, User ID and/or Password Information.

Notes: None

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005

Page 30: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

30

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICIES AND PROCEDURES

Number: 04-02 Subject: Use of AFIX Reports

Effective Date: 3-17-11 Authority: Region 1 MCIR

Date Approved: 3-17-11 Page: 1 of 1

Policy Statement: The Assessment, Feedback, Incentive, and eXchange (AFIX) program is a

comprehensive quality improvement process implemented by the Michigan Department of

Community Health (MDCH) and local health departments (LHDs) statewide. Access to AFIX

reports by Regional MCIR staff is not for the implementation of the AFIX program and not to

conduct AFIX visits, but to assist with the data quality assurance and improvement of MCIR

processes within their jurisdiction(s).

Purpose of Policy: To identify the process for utilizing AFIX reports by Region 1 MCIR staff.

Responsibility:

3. MCIR staff will not conduct AFIX visits, but will utilize current approved (19-35 months age

range) AFIX reports to assist them with data quality assurance and the improvement of MCIR

processes within provider offices in their jurisdiction(s).

4. Region 1 MCIR staff will make appropriate referrals to the LHDs/MDCH for AFIX visits

and/or other support services as the need is identified.

5. Region 1 MCIR staff are not responsible for running and/or providing a site’s AFIX report(s)

for any partner organization (managed care or health care organization, local health

department, etc.), referring those requests to the MDCH AFIX Program Coordinator.

Procedure: Region 1 MCIR staff will adhere to the following steps in utilizing AFIX reports:

4. Prior to using AFIX reports, staff must be trained by the state AFIX Program Coordinator.

5. Staff may choose to run and review any of the following AFIX reports:

a. AFIX Basic Overview MCIR Report

b. AFIX Diagnostic MCIR Report

c. AFIX Missing Immunizations-Overdue MCIR Report

d. AFIX Summary MCIR Report

e. AFIX Summary-Last Visit >= 12 Month MCIR Report

f. AFIX Summary-Missed Opportunities MCIR Report

g. AFIX Summary-Need One Visit MCIR Report

h. AFIX Invalid Doses MCIR Report

i. AFIX Immunizations Coming Due MCIR Report

j. AFIX Single Antigen MCIR Report

6. MCIR staff will review completed reports looking for data quality and MCIR process issues

(i.e. low single antigen % that may be due to transfer coding issue, etc.).

7. MCIR staff may choose to share AFIX report information with a provider site for further

investigation and process improvement.

8. Non-VFC offices currently working with MCIR staff will be provided the LHD-Provider

User Usage Agreement form to allow data sharing with the LHD.

9. Additional support services and/or AFIX program implementation will be referred to the

LHD, MDCH Immunization Field Representative and/or state AFIX Coordinator.

Related Policies and Procedures:

Revision and Review History: Developed 3-17-11, Reviewed 10-23-13

Adopted: March 17, 2011

Page 31: MCII RR Reegioonn P11 cPoolliicyy M ... R1...Michigan Computer Crime Law (MCL 333.791-333.797) or the Vital Records Law (MCL 333.2894) summarized on the back of the user/usage agreement.

31

MICHIGAN CARE IMPROVEMENT REGISTRY

POLICY AND PROCEDURES

Number: 05-01 v.2 Subject: Help Desk Operations

Effective Date: 06-15-07 Authority: MDCH and Regional Staff

Date Approved: 06-15-07 Page: 1 of 1

Policy Statement: Region 1 MCIR will operate a Help Desk to resolve user questions and

problems in a professional and timely fashion.

Purpose of Policy: To ensure expedient resolution for MCIR inquiries, technical assistance and training needs.

Responsibility: All Regional MCIR Staff are responsible for Help Desk operations, specifically

the Region 1 MCIR Help Desk Specialist.

Procedure:

5. The regional help desk will operate between the hours of 8:00 a.m. and 4:30 p.m.

(Eastern Time), Monday through Friday, excluding designated holidays.

6. When un-staffed, the help desk will be covered by a voice mail system or by forwarding

calls to MPHI. Staff will remotely monitor help desk messages while away from the

office, responding to any message within 24 hours (1 full business day).

7. Standard call resolution time will be within 24 hours (1 full business day).

8. If resolution exceeds 1 full business day:

A. The caller will be notified.

B. Problems not resolved by the regional help desk staff will be referred to either the

individual caller’s internal MIS staff or the MDCH/MPHI Technical Support

staff, depending upon the nature of the issue.

9. All help desk contacts will be recorded and maintained in the Region 1 Provider Tracking

Database.

Related Policies and Procedures: None

Notes: None

Revision and Review History: Reviewed 6-15-07, 10-23-13; Revised 10-14-11

Adopted: 06-16-2005