Last October your practice pushed 140 doses through a Saturday flu clinic in the back parking lot. Ninety-one of those patients were Medicare beneficiaries. Two things went wrong, and neither was clinical: a roster form with 38 names on it rode home in a per-diem nurse's tote bag, and a third of the claims came back because the front desk never confirmed which immunizations covered by Medicare Part B actually bill to Part B versus Part D. This guide is for the administrator who owns both of those problems.

What follows is the operational mechanics — coverage buckets, eligibility triage, roster billing, code-selection documentation — and then the privacy, records, and vendor consequences that ride along with every vaccine encounter. Nothing here is clinical guidance. It is how you build the workflow and prove you followed it.

Which Immunizations Are Covered by Medicare Part B?

Part B covers a short, specific preventive list plus a treatment-related category. Everything else commercially available for adults generally falls to Part D.

  • Seasonal influenza — preventive, covered under Part B.
  • Pneumococcal — preventive, covered under Part B.
  • Hepatitis B — covered under Part B for beneficiaries at medium or high risk, as defined in CMS coverage policy.
  • COVID-19 — covered under Part B.
  • Vaccines furnished as treatment — for example, immunization directly related to an injury or a documented direct exposure. These are covered under Part B but as treatment, which means the deductible and coinsurance apply.

The preventive vaccines above are generally furnished with no deductible and no coinsurance when your practice accepts assignment. Shingles, RSV, Tdap given routinely, hepatitis A, and similar adult vaccines are Part D benefits, and since January 1, 2023 the Inflation Reduction Act eliminated cost sharing for ACIP-recommended adult vaccines under Part D. Verify current specifics against the CMS Part B immunization billing guidance and your MAC's local instructions before each season — the list is stable but the operational detail is not.

The Part B/Part D Split Is a Front-Desk Problem, Not a Billing Problem

By the time a Part D vaccine reaches your billing queue as a Part B claim, you have already lost the encounter. The triage has to happen at scheduling or check-in.

Give your front desk a one-page decision sheet, not a policy manual. Column one: the vaccines your practice stocks that bill to Part B. Column two: the vaccines you stock that do not, with the script for what the patient is told about where to get it and what it will cost them. Column three: what to do when the answer is unclear — which is escalate to the billing lead, not guess.

The same sheet needs a line about hepatitis B risk documentation. Coverage for that vaccine under Part B depends on documented risk status, and the documentation lives in the chart, not in the billing note. If your clinical team does not record it, your biller cannot support the claim on audit.

Eligibility checks and minimum necessary

Staff will run eligibility through your clearinghouse or MAC portal. Two rules to put in writing: pull only the coverage fields the decision requires, and do not paste eligibility screenshots into scheduling notes where the whole staff can browse them. Minimum necessary applies to internal use, not just external disclosure, and eligibility portals surface more than vaccine coverage.

Roster Billing Creates a Multi-Patient PHI Document You Probably Do Not Track

For mass immunization events, CMS permits simplified roster billing for influenza and pneumococcal vaccines by entities that qualify as mass immunizers and accept assignment. Operationally it is efficient: one roster, many beneficiaries, one claim submission path. Privately, it is the single riskiest artifact your vaccine program generates.

A roster form is a list of names, Medicare identifiers, dates of birth, and a service that discloses a health status. One page equals dozens of patients. Treat it like you would treat a payroll register.

  • Chain of custody. Name one person per event who signs the roster in and out. Rosters do not travel in personal bags, car trunks, or unlocked totes.
  • Copy discipline. If you scan rosters for the billing vendor, the scan goes through your sanctioned channel — not a personal phone camera, not email to a home address.
  • Disposal. Once the claim is paid and the roster is imaged into the system of record, shred the paper on a documented schedule.
  • Incident path. A lost roster is a potential breach of dozens of records at once. Your risk assessment under the Breach Notification Rule has to run on it, and the arithmetic changes fast when one document carries 38 people.

Also worth flagging: sign-in sheets at off-site clinics. A clipboard where the eleventh patient reads the first ten names is an avoidable disclosure. Use single-slip forms or a tablet with a screen timeout you have actually tested.

Code Selection Is a Documented Process, Not a Cheat Sheet Taped to a Monitor

Do not let anyone in your practice treat code selection as a lookup exercise. Medicare pays vaccine product and administration separately, and the administration side uses HCPCS codes that CMS maintains and updates. Product codes change as manufacturers and formulations change. Your job is to build the process that keeps the mapping current and provable.

Assign these steps to named roles:

  1. Annual refresh (billing lead, each July). Pull current CMS and MAC immunization billing guidance, reconcile against every vaccine on your stock list, and version the internal mapping document with a date.
  2. Charge-master update (practice manager). Retire codes for products you no longer carry. Stale entries are how the wrong code gets picked at 4:40 p.m.
  3. Documentation standard (clinical lead). Product, lot, expiration, site, route, dose, administering staff, and the risk documentation where coverage depends on it. Coders select from what is documented; they do not infer.
  4. Pre-bill review (biller, first two weeks of each season). Sample claims against chart documentation before volume builds. Fix the pattern, not the individual claim.
  5. Denial loop (billing lead, monthly). Categorize denials by cause. Part D vaccines billed to Part B and missing risk documentation are process failures with named owners, not payer noise.

Write down which guidance you relied on and when you checked it. That record is what turns "we picked a code" into "we followed a documented process."

The Registry Disclosure That Does Not Need an Authorization

Most states require or permit reporting adult immunizations to a state immunization information system. That disclosure is permitted to a public health authority under the Privacy Rule's public health provisions — you do not need patient authorization to send it. HHS lays out the boundaries in its guidance on disclosures for public health activities.

Three operational consequences your staff will trip over anyway:

Your Notice of Privacy Practices should describe it. If registry reporting is not reflected in your NPP, update it. Patients ask, and front desk should not be improvising.

The transport path may involve a business associate. If an intermediary, HIE connector, or interface vendor moves the data on your behalf, that vendor is handling PHI for you and needs an agreement — even though the ultimate recipient is a public health authority.

Opt-out is a state-law question. Some registries allow patients to decline participation or restrict provider access. Your staff needs to know your state's answer and where the election is recorded, because "I asked you not to report it" becomes a complaint fast.

Every Vendor Touching Your Vaccine Workflow — and Which Ones Need a BAA

Walk the whole path and you find more vendors than you expected. A typical Part B immunization program involves some combination of:

  • Billing company or revenue-cycle vendor handling roster and claim submission
  • Clearinghouse running eligibility and claim transmission
  • Staffing agency supplying per-diem nurses for off-site clinics
  • Interface or HIE vendor pushing registry submissions
  • Reminder and recall vendor sending texts, calls, or postcards
  • Document scanning or shredding service processing paper rosters and consents
  • Tablet or kiosk vendor collecting intake at the clinic site

Each of those creates, receives, maintains, or transmits PHI on your behalf, which makes each a business associate. A per-diem nurse placed through an agency and working under your direction may be workforce rather than a business associate — that distinction depends on the contract, so read it rather than assuming. Where the agency also handles scheduling, records, or billing functions, you need an agreement.

A retail pharmacy you refer Part D vaccines to is a different animal: it is a separate covered entity, and sending a patient there for treatment or payment purposes is a permitted disclosure, not a business associate relationship. Do not paper it as one.

If your seasonal vendor list has grown faster than your contract file — and for most practices running fall clinics, it has — you can produce a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX for the staffing agency or scanning service you onboarded three weeks before the clinic. One-time purchase, no subscription, which matters when the need is seasonal. HHS also publishes sample business associate agreement provisions if you want to see the required elements before you draft.

Reminder Campaigns: Treatment Communication, Not Marketing

Telling your Medicare panel that flu clinic opens October 4 is a treatment communication under the Privacy Rule, not marketing, so it does not require authorization. That is the easy part.

The hard parts are the vendor and the consent trail. If a third party sends the texts, it holds your patient list and needs a BAA. If the message names a vaccine, treat it as PHI in transit and confirm how the vendor stores delivery logs and for how long. And telephone consumer protection rules on texting live outside HIPAA entirely — your marketing coordinator does not get to skip them because the message is clinical.

One more line for the policy: do not let a vaccine reminder list get repurposed into a general practice-promotion list. That is where a permitted treatment communication becomes marketing that needs authorization.

When a Patient Asks for Their Immunization Record

The right of access clock runs 30 days from the request, with one 30-day extension available if you notify the patient in writing. An immunization history is a common, easy request — which is exactly why it gets left on a sticky note. See the HHS individual right of access guidance for fee limits and format obligations.

Practical points for vaccine records specifically: patients often want the record sent to an employer, a long-term care facility, or a travel program, and that direction has to be in writing. Your fee, if any, stays within the limited cost-based ceiling. And if the record lives partly in a registry rather than your chart, you still owe the patient what you hold.

On retention: keep the documentation that supports Medicare claims — rosters, administration records, risk documentation — for at least as long as your state medical-records rule and Medicare's documentation requirements demand, and confirm both rather than defaulting to whatever your imaging system does. Audit requests arrive years after the dose.

A Six-Week Pre-Season Checklist With Owners Attached

Week 6 (billing lead): Refresh the immunization coverage and code mapping against current CMS and MAC guidance. Version and date it.

Week 5 (practice manager): Reconcile the vendor list against executed BAAs. Anyone new since last season gets an agreement before the first dose.

Week 4 (privacy officer): Confirm the NPP reflects registry reporting. Review the roster chain-of-custody procedure and name event owners.

Week 3 (clinical lead): Train staff on documentation elements, including risk documentation where coverage depends on it.

Week 2 (front desk supervisor): Roll out the Part B versus Part D decision sheet and the escalation script. Role-play five patient questions.

Week 1 (privacy officer): Walk the off-site clinic layout. Sign-in method, tablet timeouts, roster storage, shred bin, incident reporting path.

Week 0 (billing lead): Sample the first 20 claims against chart documentation. Correct the pattern before volume triples.

Close the Vendor Gap Before the Season Opens

The immunizations covered by Medicare Part B are a short list; the operational surface around them is not. Coverage triage, roster handling, registry disclosure, reminder vendors, and records requests all touch PHI, and the piece that most often goes missing is the paperwork with the vendors you onboarded in a hurry.

Start there. Build the BAA for every vendor on your vaccine workflow list, and if your broader policy set and risk analysis have not been refreshed since the last reorganization, automate the risk analysis and compliance document set rather than rebuilding it from scratch in September.