This article reports on a study of laws, regulations, and policies governing Immunization Information Systems (IIS, also known as “immunization registries”) in states and selected urban areas of the United States. The study included a search of relevant statutes, administrative codes and published attorney general opinions/findings, an online questionnaire completed by immunization program managers and/or their staff, and follow-up telephone interviews. The legal/regulatory framework for IIS has changed considerably since 2000, largely in ways that improve IIS’ ability to perform their public health functions while continuing to maintain strict confidentiality and privacy controls. Nevertheless, the exchange of immunization data and other health information between care providers and public health and between entities in different jurisdictions remains difficult due in part to ongoing regulatory diversity. To continue to be leaders in health information exchange and facilitate immunization of children and adults, IIS will need to address the challenges presented by the interplay of federal and state legislation, regulations, and policies and continue to move toward standardized data collection and sharing necessary for interoperable systems.