ASTHO Legislative Prospectus | Previewing 2025 state legislative actions on data modernization and privacy.
States Reassessing Vaccine Policy and Public Health Powers Shalini Nair, Andy Baker-White Review of state policies to weaken vaccine requirements and reduce public health powers. Immunization is a key pillar of public health, crucial for protecting communities and preventing infectious diseases from spreading. State and territorial health officials and their departments play critical roles in setting and implementing immunization requirements, managing disease surveillance and outbreak response, and ensuring access to vaccines. In recent years, however, the immunization landscape has evolved as legislative changes alter public health authority and access to vaccines. As these challenges persist, public health officials must be informed and prepared to navigate the dynamic policy environment to ensure immunization programs’ continued effectiveness at protecting public health. The True Cost of Vaccine Skepticism and Misinformation In the years since the pandemic, rates of routine vaccinations among U.S. children have steadily declined; there has simultaneously been an increase in non-medical exemptions. While reasoning behind personal decisions about vaccination are not always clear, increasing prominence of vaccine-related myths is a significant contributor to this phenomenon. Perhaps the most glaring consequence of this decrease is best illustrated by the 2025 measles outbreak and the first measles-associated deaths in more than a decade. Previously considered to have been eliminated, measles is now under threat of resurgence as vaccine rates fall below the thresholds to uphold herd immunity. Health officials are also seeing declines in coverage for several other vaccine preventable diseases like pertussis, mumps, hepatitis, and even polio. Legislation Restricts Innovation and Sows Doubt About Vaccine Components The use of mRNA technology expanded in 2020 following its breakthrough success in COVID-19 vaccines. These mRNA vaccines prevented more than 120 million additional COVID-19 infections and 3.2 million additional deaths. Researchers are currently assessing mRNA technology to address pandemic influenza, HIV, Zika, and even cancer. During 2025 sessions, at least seven states introduced legislation to ban or limit using mRNA vaccines. Iowa’s SF 360 sought to prohibit any “gene-based vaccines” (i.e., those developed using mRNA or DNA technology); the bill was based on a widely debunked myth that mRNA vaccines can interact with and alter human DNA (they can’t). New York’s A 4798 would prevent administering COVID-19 mRNA vaccines until the department of health conducts a risk-benefit analysis. Several states have introduced legislation to prohibit selling — or require labeling foods that contain — vaccine or vaccine material. This bill is based on another common internet rumor that mRNA vaccines are being introduced into the food supply via livestock and produce (they aren’t). Nonetheless, Utah enacted a bill (HB 84) requiring that food intended for human consumption that contains a vaccine or vaccine material be designated as a drug. Similar bills were introduced in Florida (HB 525), Alabama (HB 316), and Tennessee (SB 616, HB 1100). Vaccine Authority’s Shifting Landscape While the federal government plays an important role in putting forth policy recommendations, the ultimate power to impose or revoke vaccine requirements and determine exemptions outside of health emergencies rests with states. In many jurisdictions, state health agency expertise determines the vaccines required for school enrollment. These decisions, while ultimately at the feet of state health officials, rely heavily on input from experienced, knowledgeable, and skilled agency staff. Recent legislative actions in several states seek to shift authority for determining school-based immunization requirements solely to the legislature. Idaho’s new law (H 290) removes the state board of health’s authority to determine which immunizations are required for daycare and school enrollment, as well as the manner and frequency of their administration. The bill also repeals a former law establishing the Idaho Childhood Immunization Policy Commission, created in 2010 to issue recommendations to the legislature and board of health. A similar effort in Maine (LD 727) would remove health department authority to determine school vaccine requirements as part of a larger repeal effort responding to the 2019 law disallowing vaccine exemptions based on religious or philosophical grounds. In New Hampshire, existing statutes define required immunizations for school attendance and allow the state health official to add to this list via the rulemaking process. Recently, lawmakers introduced a bill (HB 357) that would remove this add-on ability. If passed, existing commissioner-led requirements for vaccines such as varicella, hepatitis B, and Hib would expire in June 2026 and no future amendments could occur under this authority. Several other bills introduced in Texas (HB 468, HB 3304, SB 94, SB 117, HB 3852), West Virginia (SB 108, HB 2203), and North Carolina (HB 89) target shifting authority and/or modifying vaccine requirements for certain school types. Evidence-Based Policy as the Path Forward State and territorial health agencies are foundational to preventing the spread of infectious diseases through vaccine education and administration. ASTHO has identified public health expertise in developing vaccination policy as one of three recommended strategies that prioritize evidence-based public health authority and support agencies to protect and improve health. As this landscape further evolves, ASTHO will continue tracking legislative and executive action on this important public health issue. article yes
Explore how states are enacting legislation to help justice-involved people avoid overdose illness and death and foster a smooth transition after release.
State Policy Trends in Cybersecurity and Public Health Preparedness Maggie Nilz Learn how states are including cybersecurity in their emergency preparedness work in this Health Policy Update. Cybersecurity is an increasingly important component of public health preparedness as state cybersecurity policy intersects with public health agency responsibilities. Public health agencies rely on interconnected digital systems and critical infrastructure for disease surveillance, laboratory reporting, emergency communications, and health data management, making cybersecurity critical to maintaining these functions. Beyond compromising sensitive data and potentially harming patients, cyber incidents can disrupt essential public health services, including emergency response operations. Health care data breaches have steadily increased over the last 15 years, highlighting growing risks for government and health systems. A recent report showed that more than 7,000 health care data breaches were reported to the Department of Health and Human Services since 2009, and reported HIPAA data breaches in 2023 were nearly double the number recorded in 2018. Meanwhile, preparedness capacity has lagged: as of 2022, only 13% of local health departments reported being prepared for cyber-related disruptions, and recent scans show cybersecurity is rarely included in emergency preparedness planning. In response at the federal level, HHS recently announced it is undoing a 2024 reorganization by returning department-wide technology responsibilities to the Office of the Chief Information Officer while refocusing the Office of the National Coordinator for Health Information Technology on improving nationwide health IT interoperability and data sharing. In recent years, state and territorial legislatures have begun to address these gaps by incorporating cybersecurity into preparedness, health care oversight, and statewide governance structures. These legislative trends signal a need to integrate cybersecurity into emergency operations plans, strengthen cross-sector coordination, and safeguard the continuity of public health services. Some of the most recent policies considered and enacted by legislatures treat cyber incidents as emergencies, expand reporting requirements, and strengthen cyber governance. Cyber Incidents Are Being Built into Emergency Preparedness Frameworks In response to these growing threats, jurisdictions have begun incorporating cyber response into emergency plans and strategies, reinforcing cybersecurity as essential to preparedness. These developments highlight growing awareness that cyber incidents can disrupt critical services, much like natural disasters. In 2025, New York enacted S 7672, which requires municipal entities and public authorities report cybersecurity incidents and demands for ransom to the state Division of Homeland Security and Emergency Services. In addition, it directs the Director of the Office of Information Services to establish cybersecurity training and protection standards for state systems as well as require cybersecurity training for state and local government employees. Virginia is currently considering HB 83, which would establish a volunteer Cyber Civilian Corps within the state IT agency to provide rapid assistance during cybersecurity incidents affecting municipalities, nonprofits, education, and critical infrastructure. Preparedness efforts also extend beyond legislation to executive action. In February 2026, Minnesota Governor Tim Walz authorized $1.2 million in state disaster assistance to support response efforts and restore critical systems in response to a cyber incident that disrupted digital services in Saint Paul on July 29, 2025. Additionally, the National Governors Association has included cybersecurity as a primary consideration for planning and preparedness in their latest edition of the Public Health Emergency Playbook. Health care and Public Health Critical Sectors Are Facing New Cyber Requirements Beyond emergency response frameworks, jurisdictions are also adopting cybersecurity reporting and planning requirements for health care and public health organizations. Companion bills in Tennessee (HB 511/SB 555) would require health care providers and facilities to notify their contracted health insurers of cybersecurity incidents. In Maine, LD 2103 would require hospitals to adopt cybersecurity plans to protect patient data and maintain operations, and must include cybersecurity training for employees and board members. New Jersey is looking to adopt and implement a more comprehensive cybersecurity plan across all sectors. This session, legislators have introduced at least two cyber security bills: A 3231 would require “sensitive businesses” (defined as those engaged in financial, essential infrastructure, or health care industries) to report cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) when they are aware of their occurrence and would require NJCCIC to conduct a cybersecurity audit within 30 days of notification. A 3283 would require the same “sensitive businesses” to implement cybersecurity programs in accordance with standards adopted by NJCCIC and certify compliance annually. As states expand reporting and cybersecurity requirements, these obligations may intersect with public health reporting and continuity planning. States Are Strengthening Government Cyber Governance and Coordination In addition to sector-specific requirements, jurisdictions are also strengthening the governance structures responsible for coordinating cybersecurity, improving their ability to respond to large-scale incidents affecting public systems. Legislation enacted recently in Texas and California aim to improve coordination among state government by establishing a state agency centralizing cybersecurity incident prevention and response (Texas HB 150) and mandating the development of a cybersecurity playbook to strengthen information sharing (California AB 979). A 2024 bill enacted in Puerto Rico (PC 1530) requires commonwealth agencies to develop and implement a cybersecurity program, which must include a yearly risk assessment as well as vulnerability assessment. At least three jurisdictions are currently considering bills strengthening established cybersecurity programs, with two states recently passing legislation. Utah recently enacted a bill authorizing the Utah Cyber Center to conduct voluntary cybersecurity risk assessments for critical infrastructure and coordinate with government entities on infrastructure safety (HB 165). Utah also enacted legislation creating a specific funding stream for the Center to use for various activities, including implementing a statewide cybersecurity plan and conducting assessments for governmental entities (SB 123). Kansas enacted HB 2574, which would require chief information security officers for the executive, legislative, and judicial branches to adopt cybersecurity programs based on a nationally recognized standard for governmental entities. Finally, Florida recently passed SB 7024, which would expand the state’s public record exemption to include risk assessments, information related to cybersecurity breaches, and information related to data protection, ensuring the confidentiality of sensitive cybersecurity information held by state agencies; the bill is with the governor for final consideration. Key Takeaways for Preparedness Leaders Cybersecurity is critical for preparedness across multiple policy areas, and requires new planning, coordination, and oversight responsibilities. By including cyber incidents into disaster frameworks, standards for health care organizations, and governance, preparedness leaders may find themselves more directly engaged in integrating cybersecurity into emergency operations, exercises, and cross-sector partnerships. For state and territorial health agencies beginning to incorporate cybersecurity into their preparedness plans, agencies such as the Cybersecurity and Infrastructure Security Agency provide jurisdictional support and resources to guide this work. article yes
Learn how states can leverage policy to reduce ACEs and improve children's well-being in this Health Policy Update.
This ASTHOReport serves as a primer for state and territorial health agencies seeking to assess the public health impacts of lead exposure in drinking water.
This infographic highlights 10 high-level strategies to advance work in school behavioral health.
Explore the transformative power of community engagement and community power building in public health research, and learn how these initiatives can enhance racial and health equity. Discover strategies for addressing structural determinants of health and empowering communities to drive positive change.
During the early months of the COVID-19 pandemic, the federal government enacted the Coronavirus Aid, Relief, and Economic Security (CARES) Act, temporarily expanding the use of telehealth technologies by removing various requirements and waiving certain restrictions. Many states also expanded telehealth access through changes to state Medicaid laws. These temporary policy changes created an uptick of telehealth use that improved access to care for millions of Americans—but questions remain about which policy changes will stick around beyond the pandemic. Currently, states are making decisions about what temporary policies to permanently implement and which policies to end without disrupting the delivery of care and further exacerbating health disparities.
With data showing the number of the opioid overdose deaths escalated during the COVID-19 pandemic, access to naloxone, a medication that can reverse an opioid overdose, continues to be an important topic for policy makers. The number of laws and policies to increase access to naloxone have grown over the past several years. Policy makers across the country have expanded access to naloxone by allowing third-party prescriptions for friends, family, and other people who may encounter those at risk of an opioid overdose.
States Pursue Policy Options to Support Access to Over-the-Counter Contraception State Policy to Support Over-the-Counter Contraception Access Christina Severin Learn about state policy options that can help to support over-the-counter contraception access including levers within Medicaid programs. Effective contraceptive care improves maternal health outcomes by helping individuals plan if and when they become pregnant. Additionally, some contraceptive methods may reduce the risk of certain cancers and protect against sexually transmitted infections. While the most effective methods generally require a visit to a health care provider, over-the-counter (OTC) options may address certain barriers to accessing contraception (e.g., taking time off work for a medical appointment and lack of health insurance or access to health care providers/settings). The New Age of Nonprescription Oral Contraceptives A significant change in the marketplace of OTC options occurred in 2023 when FDA approved the first daily non-prescription oral contraceptive. This progestin-only pill —known as Opill — is considered both safe and highly effective at preventing pregnancy when taken correctly. Opill reached stores in early 2024 and has a suggested retail price of about $20 per month or $50 for a three-month supply. While OTC oral contraceptives like Opill may improve access among individuals not currently using contraception or those using a less effective method, high out-of-pocket costs can be a barrier. One way to limit out-of-pocket costs is to require private health insurance coverage of contraception without cost-sharing. ACA requires most private health insurance plans to do this, but it does not extend to all health insurances or contraceptives. For OTC contraceptives, the landscape is even more complex: While plans are encouraged to cover OTC emergency contraception at no cost and without a prescription, it is not required. HHS and the Departments of Labor and Treasury issued a proposed rule in 2023 that would have required broader coverage of OTC contraception without a prescription or cost-sharing, but the rule was later withdrawn. Without a federal mandate, states can pursue coverage requirements through the health insurance products they regulate. Jurisdictions can also support OTC contraception access in their Medicaid programs. While Medicaid requires coverage of family planning supplies without cost-sharing, jurisdictions have some flexibility in how they design this benefit, and the scope of coverage depends on jurisdiction and state plan-specific factors. Jurisdictions also have flexibility in determining how they provide prescription drug coverage for contraceptive medications and what OTC products are covered. State Legislative Action Legislation is one way for states to promote access to OTC contraceptives, including hormonal contraceptives, through state-regulated plans and provider scope of practice considerations. Since 2024, several states have enacted laws requiring coverage of OTC hormonal contraception, including Delaware (SB 232), which directs insurance carriers to cover FDA-approved OTC contraception with or without a prescription, and Maine (LD 163), which requires coverage of nonprescription oral hormonal contraception. At least two states have clarified the role of pharmacists in supporting access to OTC contraceptives. Massachusetts (HB 4800) allows pharmacist dispensing of OTC oral contraception per a standing order and provides liability protections, while California (AB 50) allows pharmacists to furnish self-administered OTC hormonal contraception without complying with the state’s protocols for prescription-only oral contraceptives. States have also enacted laws to explore or support broader access to OTC contraception, including at least three bills enacted in Maryland since 2024: HB 367/SB 527 requires community colleges to develop an OTC contraception access plan and allows the health department to serve as a resource, including for consultation on vending machine access. HB 1171/SB 944 allows local health department registered nurses to dispense OTC contraception. SB 674/HB 939 creates a collaborative tasked with studying and making recommendations on OTC contraceptive access, with a final report due to the governor and legislature by Jan. 1, 2027. Other Policy Levers Legislation isn’t the only policy lever available to jurisdictions looking to support OTC contraception access. A number of states have taken executive actions to improve access, including (but not exclusively) through Medicaid. While jurisdictions already have the flexibility to support OTC contraceptive access in their Medicaid programs, Medicaid rules require a prescription even for OTC products, which may present a barrier for some individuals. One potential solution is to use standing orders, which allow individuals direct access to OTC products at a pharmacy, without having to visit a separate provider for a prescription first. To ease access to OTC hormonal contraception specifically, several states have recently utilized standing orders that facilitate Medicaid coverage, including Wisconsin, Massachusetts, and New Mexico. Additionally, in 2024, North Carolina announced that it was removing barriers to OTC oral contraception, and would cover condoms and spermicide as OTC products. Outside of Medicaid, several other states have taken action to support access to OTC hormonal contraception: In 2024, the Governor of Arizona issued an executive order directing the Department of Administration to designate Opill and OTC hormonal contraception as a no-cost essential health benefit for state employees, among other actions to expand coverage and access. Also in 2024, Pennsylvania issued guidance to health insurers encouraging coverage of OTC hormonal contraception and highlighting two insurers intending to comply with the guidance. Finally, Michigan’s health agency, in partnership with the Governor’s office, implemented a Take Control of Your Birth Control campaign. This initiative distributed OTC contraception at hundreds of community sites across the state, with a stated goal of connecting individuals to insurance coverage, including Medicaid. While the campaign recently ended, the state distributed more than 400,000 OTC contraceptive resources (e.g., condoms, emergency contraception, and oral contraceptives) and saw an increased number of Medicaid applications. Jurisdictions can play a significant role in connecting public health and health care industry leadership, providers, and other experts — promoting awareness, increasing utilization, and encouraging connection to existing resources. Related Content - Blog - State Policy to Support OTC Contraception Access article yes
This brief outlines some of the barriers that pregnant and postpartum women with opioid use disorder face, as well as examples of state legislation passed to address recovery program implementation, treatment funding and insurance coverage, and provider education.
This brief highlights four top takeaways from the experience of six public health agencies working to establish and strengthen their own performance management systems.
PrEP is a powerful tool to reduce new HIV infections; expanding access to PrEP is a priority within the federal Ending the HIV Epidemic in the U.S. initiative. One way to increase access to PrEP is by allowing pharmacists to prescribe and dispense it.
Conditioning school attendance on student vaccinations is an evidence-based way of maintaining and increasing vaccine coverage. State law establishes school vaccination requirements which apply not only to public schools but often to private schools and childcare facilities as well. All states allow an exemption for those where a vaccine poses a medical risk. Several states also allow non-medical exemptions, often based on an asserted religious, philosophical, or personal belief of the parents or child opposing vaccinations. However, a few states have recently abolished all non-medical exemptions.
The COVID-19 pandemic has exasperated challenges around access to nutritious and affordable foods. In response, the federal government has taken action to increase funding and access to programs to strengthen food security.
How to Support Youth Post COVID-19 With More Flexible Policies Caitlin Langhorne Griffith, Victoria Pless, Martha Yeide Over the past few months, COVID-19 has highlighted how current policies and funding do not support an equitable approach to health. However, states and territories have begun to leverage statutory and regulatory flexibilities to improve health outcomes for the disproportionately affected during this pandemic. One of the ways that states and territories can support these groups and maximize these flexibilities during and post-COVID-19 is by deploying a Shared Risk and Protective Factor (SRPF) Framework to address negative health outcomes. Research has demonstrated that addressing both the risk and protective factors across sectors can lead to multiple improved health outcomes, including heart disease, asthma, depression, and substance use. Because youth are at increased risk of exposure to Adverse Childhood Experiences (ACEs), and have fewer supportive resources, they are a particularly vulnerable group potentially affected by COVID-19 policies and funding. ACEs are a risk factor shared across numerous health outcomes, such as substance use disorder, chronic disease, and mental health. However, implementing the SRPF Framework can promote protective factors in upstream ways, like reducing and mitigating the impact of ACEs. During the COVID-19 response, some areas where state officials can take advantage of policy flexibilities to better support youth and reduce some ACEs include youth experiencing food insecurity, youth with incarcerated parents, and youth witnessing violence in the home. Ultimately, these examples illustrate the benefits of extending innovative policies to decrease negative outcomes and promote health across the lifespan beyond COVID-19. Youth and Food Insecurity Food insecurity is a public health issue that plagues the United States and has been associated with negative health outcomes including obesity and unhealthy brain development. More than 11 million children in the U.S. live in food insecure homes, with an estimated 11 percent of households reporting food insecurity at least some time during 2018. New data show that food insecurity has increased for youth during the COVID-19 pandemic, with almost one in five of mothers — 17.4 percent —with children ages 12 and younger reporting their children were undereating because they could not afford enough food. When state officials closed schools to prevent the spread of COVID-19, food access was upended for youth who participate in free-or-low-cost school meal programs. States can mitigate this disruption by safeguarding access and expanding these programs to ensure the continued physical and mental development of youth. Jurisdictions have implemented innovative practices allowed under expanded flexibilities to ensure that youth receive regular nutrition during COVID-19. Vermont is conducting telephone appointments for the Women, Infants and Children (WIC) nutrition program due to social distancing, and has also expanded the list of foods available through WIC during the COVID-19 pandemic. Forty-seven states and territories have implemented the Pandemic Electronic Benefit Transfer (EBT) benefit passed as part of the CARES Act. This allows households to offset the cost of meals that would have been consumed at school by youth. Wyoming has adapted its WIC program services, which includes providing curbside deliveries and conducting phone screenings. Youth with Incarcerated Parents It is estimated that between 1.7-2.7 million youth have incarcerated parents. This leaves them at a higher risk of adverse outcomes, including mental health problems, poor school-based outcomes, and increased antisocial behavior later in life. Parental closeness between incarcerated parents and youth can be an effective strategy to promote resiliency, and jurisdictions are implementing programs focused on connecting the incarcerated individuals with loved ones. The Pennsylvania Department of Corrections has created a virtual visitation program for all state-run facilities, and all inmates are eligible to participate. In Connecticut, organizations such as Children with Incarcerated Parents have created programs that provide free calls with incarcerated parents each month during the COVID-19 pandemic. Other innovative avenues to connect children with incarcerated parents include the Governor of Illinois issuing an executive order suspending the transfer of some inmates from county jails into the Illinois Department of Corrections during the public health emergency. This approach may increase the likelihood that inmates remain geographically closer to home. Washington executive order 20-47 suspended statutes that limit an individual’s ability to receive post-conviction relief, as well as prosecutors’ and courts’ ability to file and process criminal cases. Washington executive order 20-50 broadened the Governor’s authority to grant clemency to reduce the prison population. New Jersey Gov. Phil Murphy issued an executive order establishing an Emergency Medical Review Committee, which will review which inmates can be released to home confinement—identified by the Board of Parole—and outlined the process for ensuring those who are released are aware of reentry benefits. Youth Witnessing Violence in the Home Witnessing violence at home also is associated with a higher risk of negative health outcomes, as well as experiencing or perpetrating violence later in life. "Stay at home" or "shelter in place" orders during the COVID-19 response has corresponded with increased risk of family violence and increased calls to domestic violence hotlines, posing another public health crisis as many children have been exposed to violence in their homes. While trends also show a decrease in reports of child neglect and abuse, this decline may be due to restrictions on the child welfare surveillance systems that monitor and intervene in situations of abuse and neglect. State lawmakers have offered help to those experiencing domestic violence, despite restrictions on travel. Massachusetts and Maine ordered all state hotels to only provide rooms for vulnerable populations or essential workers, including those that may be experiencing domestic violence. New Hampshire established the COVID-19 Emergency Domestic and Sexual Violence Services Relief Fund for shelters across the state to aid those who may be experiencing domestic or sexual violence. Nevada developed a process for individuals to file online temporary domestic violence protective orders. The District of Columbia developed a process so individuals can file an extreme risk protection order through an online form and phone call, which can remove firearms from individuals who may be dangerous. Finally, California released a safety planning guide for those who may be experiencing domestic violence. The COVID-19 response has prompted states to provide flexibilities in funding and suspend or modify policies that would have made it more difficult to protect the public’s health — and in turn would have exacerbated negative health outcomes among youth. Through innovative practices these efforts have worked to mitigate the negative impacts of food insecurity, youth with incarcerated parents, and youth experiencing violence in the home. Health officials can be at the forefront of this innovation to ensure that protective factors are leveraged to reduce disparities and impact multiple outcomes with upstream approaches for youth. website
This Health Policy Update is an overview of state legislative activity to increase financial stability for families during the COVID-19 pandemic which may help to prevent adverse childhood experiences.
Several states and territories, as well as many local governments, are going beyond recommendations and requiring individuals to wear face coverings when they are in public settings and spaces (i.e. grocery stores, retail stores, restaurants, public and private transportation services, parks, etc.). Ongoing research and evidence suggests the relationship between mandatory face coverings and declines in daily COVID-19 growth rates is statistically significant.
The 2020 holiday season is coinciding with a nationwide surge of COVID-19 cases. With great concern that holiday travel to see loved ones may exacerbate community spread of the virus, many states are increasing public health measures before the winter holiday season. As of November 16, 2020, 13 states and D.C. had a quarantine requirement for out-of-state travelers. The U.S. territories also have instituted travel restrictions to limit the spread of COVID-19.