Long: CDPHE recognized by governor’s award for statewide ‘phishing scam’
Author: Pam Long - January 31, 2017 - Updated: January 28, 2017
‘The public should be appalled at this award’
On January 24, 2017, Gov. John Hickenlooper recognized the Colorado Department of Public Health and Environment with a Governor’s Elevation Award for enhancing a database that tracks the public’s private medical information without their knowledge with a long list of undisclosed entities. Specifically, CDPHE was honored for enhancing data sharing of immunization records within a state registry known as the Colorado Immunizations Information Systems (CIIS). Here are seven reasons the public should be appalled at this award.
1. Doctors and nurses are not required to tell parents that their child’s immunization records are added to the state immunization registry, CIIS. People and their records are added to the registry at creation of the birth certificate, when vaccines are given, and at schools and daycares when records are collected. It is an opt-out system, meaning a parent has to know that the registry exists and opt-out, instead of opting-in under transparency. Parents are not required by law to share their children’s private medical information with the state, so an opt-out system circumvents consent.
2. The CIIS system has a primary function as an inventory and product re-ordering system for vaccine providers. This million-dollar annual expense to taxpayers supports a highly profitable vaccine industry. No other for-profit industry has a state funded record keeping software.
3. A 2015 Economic Review of IIS (Patel et al) found no actual benefit to public health measured by reduced morbidity and mortality, at the cost of $2.4 million to $7 million dollars over five years to the state.  A 2015 Systematic Review of IIS (Groom et al) found that IIS had no performance measures or deliverables for public health, and practices using IIS did not have significantly higher vaccination rates than those practices not using an IIS.
4. The CIIS system uses the data to activate a reminder-recall-home visit program to increase vaccine uptake.  If a parent opts a child out of a vaccine, such as the controversial HPV vaccine for a sexually transmitted disease, the parent could be harassed by the state for their choice for their child. The database is loaded with Personally Identifying Information (PII) to include addresses.
5. CIIS creates a targeted population registry at the state level that interfaces with the CDC’s Vaccine and Tracking System at the federal level.  According to the IIS Strategic Plan Executive Summary from the CDC, the end goal is “Real time, consolidated immunization data and services for all ages are available for authorized clinical, administrative, and public health users, and consumers, anytime and anywhere.” There are no protections in Colorado law for citizens, both adults and children, from CDPHE utilizing CIIS data to restrict attendance at school or work, or travel for people who opt out of some vaccines or boosters every 10 years.
6. Schools are required to protect the privacy of vaccine records as part of all student records under the federal law of FERPA, so an automated system to collect immunization records from the schools is in a posture to violate federal law and phishing for private medical information. FERPA requires that schools and daycares can only release student records if parents have given prior written consent for the specific record and to the specific agency.
7. In 2016, CDPHE implemented a new online vaccine exemption form for schools that feeds PII directly into CIIS. However, Colorado statute only requires a parent to submit a “statement of exemption” to the school for any of the 70 doses on the current U.S. vaccine schedule. Statute does not require that a parent submit a form to the state for inclusion in a registry. CDPHE does not have authority in legislation, nor did it follow the public rule making process to implement this form. The new exemption form is currently pending judicial review in Douglas County for legality.
Our state lawmakers are currently desperately looking for money to improve roads and schools. The people of Colorado would like to give a “High Impact Performance Award” for the lawmaker who can lead the legislative effort to defund CIIS in the state budget, and direct those millions of dollars to something that actually works for the public, and not against the public.