One flu shot produces two claim lines, one registry submission, one inventory decrement, and at least three vendor touchpoints before lunch. If your front desk, your medical assistant, and your biller each handle a different piece of that, the odds of a clean claim and a clean privacy trail depend entirely on how you wrote the workflow.

This guide is for practice administrators, billing leads, and privacy officers. It covers how a practice determines and documents the cpt code for immunization encounters, what documentation the coder needs before the claim leaves, where protected health information exits the building on the way to a state registry or a school, and which vendors in that chain need a Business Associate Agreement. It is administrative guidance. It does not tell you which code fits a given patient — your coding policy and your clinicians do that.

What Is the CPT Code for Immunization? (Short Answer)

There is no single code. A vaccine encounter is normally reported as two components:

  • The vaccine product — the biologic itself, reported from the vaccine/toxoid product code family (the 90476–90756 range in CPT), which distinguishes the specific product, formulation, dosage, and route.
  • The administration — the act of giving it, reported from the immunization administration families (90460–90474 in CPT), which distinguish factors such as patient age, whether counseling by a qualified provider was performed and documented, route of administration, and whether the dose is a first or additional component.

Payers layer their own rules on top. Medicare Part B pays administration of certain vaccines through HCPCS G-codes rather than the CPT administration family. Vaccines for Children (VFC) doses are federally purchased, so the product is not billed to the payer at all — only the administration fee, often with a state-required modifier. So the practical answer to "what is the cpt code for immunization" is: whichever product-plus-administration pair your documentation supports, adjusted for that payer's rules, verified against the current-year code set.

Where the Code Set Changes Under You

Vaccine product codes do not follow the tidy annual cycle the rest of CPT follows. The AMA releases new and revised vaccine codes on an accelerated schedule, with publication dates and separate effective dates — a code can be published months before it is billable, sometimes contingent on FDA action. Two consequences for your operation:

Someone owns the code-set check twice a year, minimum. Assign it by name, not by department. That person confirms the practice's charge master, the EHR's immunization order set, and the clearinghouse's edits all reflect the same effective dates.

Retired and deleted codes are a denial factory. When a product code is deleted and a replacement takes effect mid-year, a favorite saved order in the EHR will keep firing the old code until someone kills it. Put "retire deleted vaccine codes from favorites and standing orders" on the same checklist.

For Medicare-specific administration and coverage mechanics, CMS maintains a Part B immunization billing reference that your billing lead should read once a year rather than relying on hallway knowledge: Medicare Part B Immunization Billing (MLN908764).

Payer Overlays Your Biller Should Have on a One-Page Grid

  • Medicare Part B — covers a defined set of vaccines; administration reported per CMS instruction. Other vaccines route to Part D, which usually means a different claim path entirely and a different patient conversation at the desk.
  • Medicaid and VFC — eligibility screening at check-in determines whether the dose comes from state-supplied stock. Administration-only billing plus the state's modifier convention. Your VFC provider agreement also obligates you to specific storage, inventory, and record-retention practices that your compliance calendar should track.
  • Commercial plans — most cover ACIP-recommended vaccines as preventive services without cost sharing when delivered in network, but product-code specificity and site-of-service edits vary. Track denials by payer and code monthly; patterns show up fast.

The Documentation Your Coder Needs Before the Claim Goes Out

Code selection is a documentation problem before it is a coding problem. Build the immunization note template so the following are captured at the point of care, not reconstructed later:

  1. Product name, manufacturer, lot number, expiration, and NDC.
  2. Dose, route, and anatomic site.
  3. Date administered and the name and credential of the person who administered it.
  4. The Vaccine Information Statement edition date and the date it was provided.
  5. Whether counseling was performed and by whom, when the practice reports from a counseling-based administration family.
  6. Vaccine source — privately purchased versus state-supplied stock.
  7. Consent, or a documented refusal with the reason as stated by the patient or guardian.

That list is also your audit defense. When a payer requests records on a vaccine-heavy claim run, the practices that respond in days are the ones whose template forced these fields rather than leaving them to free text.

Worked Example: A Two-Vaccine Well Visit

A four-year-old comes in for a well-child visit and receives two vaccines, one of them a combination product. The chart now needs: the preventive visit documentation, two product entries with lots and NDCs, VIS edition dates for each, the counseling documentation, and the eligibility screening result that determined VFC versus private stock. Your coder then builds the claim from that record — product lines, administration lines reflecting the components documented, and any state modifier for the state-supplied dose.

Nothing about that chain is clinical judgment on the biller's part. It is transcription discipline. Where practices get burned is when the MA documents one product and the inventory system decrements another, and the reconciliation happens six weeks later during a VFC site visit.

The Registry Handoff: Where PHI Leaves Your Building

Every vaccine you give probably generates a submission to a state or regional Immunization Information System. That is a disclosure of protected health information, and it is permitted without patient authorization under the public health activities provision of the Privacy Rule when made to a public health authority authorized to collect it. HHS guidance on disclosures for public health activities is the citation your privacy officer should keep on file.

Three operational points administrators miss:

The registry is a public health authority. The interface is often not. If a health information exchange, an integration vendor, or a middleware platform transmits, transforms, or stores your submissions on the way to the state, that entity is handling PHI on your behalf. It needs a Business Associate Agreement. "The state told us to use them" is not a substitute for the contract.

State consent rules vary and they are not HIPAA. Some jurisdictions require opt-in for adult records, some allow opt-out, some restrict who may query. Your registry SOP should name the state rule you are following and where the patient's election is recorded in the chart.

Query is a disclosure risk too. Staff who can look up any resident's immunization history in a statewide system need access reviews and audit-log review on the same cadence as your EHR. Terminated employees with live registry credentials are a recurring finding in practices that never built an offboarding checklist for non-EHR systems.

Schools, Camps, Daycares, and Employers

Proof-of-immunization requests arrive constantly, and they are not all the same transaction. The Privacy Rule permits disclosure of proof of immunization to a school where state or other law requires the school to have it, provided the practice obtains and documents agreement from the parent, guardian, or the individual — documented agreement, not a signed authorization. "Documented" means your front desk writes down who agreed, when, and how.

Employer requests are different. When an employer asks for a roster of which employees got a flu shot at your onsite clinic, treat that as a disclosure that generally needs a valid authorization unless a specific exception applies and your privacy officer has documented the analysis. Build the authorization into the event registration form before the clinic, not after HR calls asking for the spreadsheet.

Records Requests: The 30-Day Clock and the Immunization Card

A parent emails asking for their child's immunization record so they can register for kindergarten. That is a right-of-access request. You have 30 days, with one 30-day extension available if you notify the requester in writing of the reason and the new date. You must provide it in the form and format requested if readily producible — including electronic copies and including transmission to a third party the individual designates in writing.

Fees are limited to a reasonable, cost-based amount. "$25 flat records fee" applied to a one-page immunization printout is the kind of practice that has drawn enforcement attention under OCR's right-of-access initiative. Review your fee schedule against the HHS individual right of access guidance and make sure the front desk knows immunization records are not exempt from it.

Log every request with date received, date fulfilled, format delivered, and fee charged. When a complaint lands, that log is the whole case.

Your Vendor List for a Single Vaccine Visit

Walk the data, not the org chart. For one immunization encounter, PHI may touch:

  • The EHR or practice management platform
  • The clearinghouse and any billing service submitting the claim
  • The registry interface or HIE vendor
  • The inventory or vaccine-management system that tracks lots by patient
  • The reminder/recall vendor sending second-dose texts
  • Any temporary staffing agency working a mass-vaccination event
  • The document storage or scanning vendor holding paper consents and VIS acknowledgments
  • IT support and backup providers with access to any of the above

Each of those creates, receives, maintains, or transmits PHI on your behalf, which means each needs a signed BAA on file with a copy you can produce in under five minutes. Practices routinely have the EHR agreement and nothing else — no BAA with the reminder vendor, none with the staffing agency, none with the shredding company. If you find gaps, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX for countersignature. One-time purchase, and it beats emailing a fifteen-year-old template you inherited.

Add one column to your vendor inventory that most practices skip: which data element that vendor actually needs. A reminder-text vendor needs a name, a phone number, and a due date. It does not need lot numbers or diagnosis codes. Minimum necessary is a configuration setting, and nobody will tighten it for you.

Three Failure Modes That Cost More Than the Claim

The mass-clinic sign-in sheet. A clipboard where forty patients see the thirty-nine names above theirs is an incidental-disclosure problem you designed on purpose. Use single-slip check-in or a tablet.

The emailed spreadsheet. Reconciliation lists sent to a school nurse, an employer, or a partner pharmacy as unprotected attachments. Route these through your standard secure channel and get the authorization first.

Orphaned registry credentials. Covered above, and worth repeating because it shows up in access reviews long after the person left.

A 12-Month Operating Calendar

  • January — load annual code-set changes; retire deleted vaccine codes from favorites and standing orders; update the charge master and fee schedule.
  • Spring — VFC re-enrollment and provider agreement review; storage and temperature-log audit; reconcile state-supplied inventory against administered doses.
  • Mid-year — check for accelerated-release vaccine codes with upcoming effective dates; confirm clearinghouse edits match.
  • Pre-season, before the fall respiratory push — confirm payer grids, refresh mass-clinic consent and authorization forms, verify BAAs for staffing and event vendors.
  • Quarterly — registry and EHR access reviews; right-of-access log review; denial pattern review by payer and code.
  • Annually — refresh the security risk analysis and the policy set that supports all of the above. If yours is a stale Word document, automating the risk analysis and policy set gets you to a current, defensible baseline faster than another all-staff meeting.

Getting the cpt code for immunization encounters right pays the practice. Getting the documentation, registry handoff, records response, and vendor contracts right is what keeps a clean claim from turning into a breach notification eighteen months later. Same workflow, two different auditors.

Start with the vendor list. Walk one vaccine encounter end to end this week, write down every system and every company that touched the record, and check each against your BAA file. Where you find a gap, build the agreement and get it signed before flu season staffing decisions make the list longer.