Requests for a vaccination master list

Overview

In a request for a list of Dengvaxia recipients, the NPC distinguished access to a represented child’s information from wholesale disclosure of a sensitive registry. An agency’s public mandate did not, by itself, give blanket access to another agency’s identifiable health data; aggregate information could answer public inquiries.

Practice implications

Parao Law practice guidance

For physicians

Keep identifiable vaccination lists behind a controlled release process. Verify parental or representative authority for an individual record, and use aggregate figures when responding to general public or media questions.

For lawyers

Separate a client-specific request from a request for an entire register. Establish statutory authority or valid authorization, limit the data shared, and document the purpose and safeguards. This is a fact-specific 2018 opinion.