A 71-year-old patient gets a shingles vaccine at your clinic on a Tuesday. Your biller sends it to Part B. It denies. Two weeks later the same patient calls your front desk asking why she owes $214 for a vaccine your website said was free, and your MA is already loading next week's flu clinic supplies into a tote bag with a paper roster in it.

That single sequence touches coverage rules, claim routing, patient-facing communication, and at least four vendors. This guide walks through Medicare Part B vaccine coverage from the administrator's chair: which vaccines route to Part B versus Part D, how roster billing changes your workflow, what documentation your coders rely on, and where the privacy and vendor exposures sit. It is administrative guidance, not clinical guidance — clinical indication and code selection stay with your clinicians and certified coders.

What Vaccines Does Medicare Part B Cover?

Part B pays for a short, fixed list of preventive vaccines. Everything else commercially available generally routes to Part D.

  • Influenza — seasonal, once per flu season (and additional doses when medically necessary).
  • Pneumococcal — per current schedule.
  • Hepatitis B — for beneficiaries at medium or high risk.
  • COVID-19 — moved under the Part B preventive benefit and paid as such.

For those four, the Part B deductible and coinsurance do not apply when the provider accepts assignment. Separately, Part B covers vaccines administered as treatment of an injury or direct exposure — the classic examples are post-exposure rabies prophylaxis and tetanus after a wound. Those are not preventive services, so the deductible and 20% coinsurance do apply. That distinction is the single most common source of surprise-balance calls at the front desk.

Medicare Part B Vaccine Coverage vs. Part D: Who Bills What

Shingles, Tdap given routinely, RSV, and most other adult vaccines fall under Part D. Since the Inflation Reduction Act provisions took effect in January 2023, ACIP-recommended adult vaccines under Part D carry no cost sharing for the beneficiary — but only when the claim goes through the Part D plan, which usually means the pharmacy benefit rather than your medical claim.

Operationally, that means your practice has three possible paths for any given adult vaccine, and your staff needs to know which one applies before the vial leaves the fridge:

  1. Bill Part B directly — the four preventive vaccines above, plus injury/exposure-related vaccines with cost sharing.
  2. Bill the Part D plan — requires pharmacy-benefit claim capability or a contracted arrangement. Many practices simply do not have this, which is a legitimate operational answer.
  3. Refer out — send the patient to a pharmacy for Part D vaccines and document the referral.

Write the decision down before flu season

Pick your lane per vaccine, put it in a one-page grid, and post it at the vaccine fridge and the check-out desk. Include what the patient is told. "We can't bill your Part D plan here; a pharmacy can give this at no cost to you" is a script, and scripts prevent both billing errors and the patient-complaint emails that land on your desk.

Confirm current coverage detail and payment methodology against your MAC's guidance and CMS's Medicare Learning Network materials each year. Payment for the vaccine product under Part B follows a methodology separate from the physician fee schedule, and rates change annually.

Roster Billing: The Workflow That Trades Speed for Data Risk

If your practice vaccinates five or more Medicare beneficiaries on the same date at the same location, you may qualify as a mass immunizer and use simplified roster billing for influenza, pneumococcal, and COVID-19 vaccines. Roster billing requires that you accept assignment and bill only the covered vaccine and its administration — nothing else on that claim.

Practices operating across three or more payment localities can request centralized billing so all roster claims go to a single MAC instead of several. That is worth pursuing if you run health-fair or senior-center clinics across state or locality lines.

What the roster form actually holds

A roster line contains the beneficiary's name, Medicare Beneficiary Identifier, date of birth, sex, date of service, and the vaccine given. That is protected health information sitting on a clipboard, usually in a hallway, usually handled by whichever staff member is free. Treat the roster as a chart, not a sign-in sheet.

Three controls that cost nothing:

  • Sequential control. Number roster pages before the clinic and reconcile the count at the end. A missing page should trigger your incident process the same day, not at month-end close.
  • No shared visibility. One patient, one line, shielded. If patients sign a common sheet, the sheet captures name and arrival time only — not vaccine type, not MBI.
  • Chain of custody. Name the person who carries rosters back to the office and where they are stored until the claim is filed. Write it into the clinic-day checklist.

Documentation Your Coders Rely On

Your job is not to decide which code fits a clinical scenario. Your job is to make sure the record contains what a coder needs to make that decision defensibly, and that the decision is reproducible on audit.

For Part B vaccines, the elements coders and auditors typically look for are: vaccine name and manufacturer, lot number and expiration, dose, route and site, administering staff member, date and time, VIS edition date provided to the patient, and — for hepatitis B — the documented basis for medium or high risk. Administration is reported using the HCPCS administration codes designated for Part B vaccines, and product codes come from the current code set. Which codes apply in a given encounter is a coding determination made from the documented record, not a front-desk judgment call.

Build the fields into your template so they are captured at the point of care. Retrofitting a lot number three weeks later from a fridge log is how practices end up with records that do not support the claim.

Retention

Keep documentation supporting Medicare claims for the period your MAC and state law require — many practices standardize on the longer of the two and document the rationale. Immunization records frequently have their own state retention rule that outlasts the general medical record rule. Confirm both; do not assume your EHR's default purge setting matches either.

The Vendor List Behind a Single Flu Shot

Map the vendors that touch PHI in this workflow. A typical primary care practice running Part B vaccine billing has more than it thinks:

  • The eligibility verification service that confirms Part B enrollment and MBI.
  • The clearinghouse that transmits roster and standard claims.
  • The EHR or practice management host, including any cloud storage of scanned rosters.
  • The patient outreach vendor sending flu-clinic reminder texts and emails.
  • The document scanning or shredding vendor handling paper rosters.
  • Any staffing agency supplying nurses for off-site clinics, depending on the arrangement.
  • Your billing company, if roster claims are outsourced.

Each of those is a business associate if it creates, receives, maintains, or transmits PHI on your behalf. HHS's business associate guidance is the reference to hand your practice manager. If you added a reminder-text vendor or a seasonal staffing agency for last season's clinics and never papered the relationship, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription. That closes the gap faster than routing a redline through counsel for a $400 texting tool.

Where a BAA is the wrong instrument

If a pharmacy chain administers vaccines inside your building under its own provider number, it is a covered entity performing treatment — not your business associate. Disclosures between you for treatment purposes do not need a BAA. What they do need is a written operating agreement covering space, patient flow, records, and who answers a records request. Get that in writing even though HIPAA does not require a BAA.

Likewise, reporting doses to your state immunization information system is a permitted disclosure to a public health authority, not a vendor relationship. No BAA. Do confirm the reporting is scoped to what the state requires, consistent with the minimum necessary standard, and that your interface is not pushing the entire encounter note along with the dose.

Off-Site and Employer Clinics: The Roster Nobody Should Get

You contract with a manufacturing plant to vaccinate employees. HR asks for a list of who showed up. Do not send it.

Employees you vaccinate are your patients. Their vaccination status goes to the employer only with a valid authorization from each individual, or as a limited workplace-medical-surveillance disclosure where that narrow exception genuinely applies. Aggregate counts — "142 doses administered" — are the safe deliverable, and you should say so in the contract before the clinic, not in an awkward call afterward.

Same principle at senior centers, churches, and housing sites. The host organization gets a count and an invoice. It does not get the roster.

When the Patient Calls About a $214 Balance

Back to the shingles vaccine. That call is a billing inquiry today and potentially a right-of-access request tomorrow. Billing records sit inside the designated record set, so a request for "everything about that visit and that charge" runs on the access clock: 30 days, with one 30-day extension if you notify the patient in writing with a reason.

Train the front desk to recognize the transition. "Send me my records for that visit" is a request under the access right even when it arrives inside a complaint about a bill. Log it, route it to the privacy officer, and start the clock on the date received — not the date someone finally opened the voicemail.

A Twelve-Month Calendar and Who Owns Each Line

  • May–June: Practice administrator refreshes the Part B/Part D vaccine grid against current CMS and MAC guidance. Update front-desk scripts.
  • July: Privacy officer reviews the vendor inventory for anything added since last season. Confirm an executed agreement exists for each business associate and that the signer is still with the vendor.
  • August: Billing lead confirms roster billing enrollment, centralized billing status if applicable, and that assignment acceptance is configured correctly.
  • August: Clinical lead validates EHR template fields — lot, expiration, site, route, VIS date, administering staff.
  • September: Ten-minute staff training on roster handling, chain of custody, and what the host site does not receive. Document attendance.
  • October–December: Weekly roster reconciliation during clinic season. Any unaccounted page goes to the privacy officer within 24 hours.
  • January: Post-season review — denial patterns by vaccine, patient complaints about balances, and any incident involving vaccine records. Feed findings into the annual risk analysis.

None of this is exotic. It is the difference between a season where 900 doses go out cleanly and a season where you are reconstructing a lost clipboard for a breach assessment in February.

Next Step

Pull your vendor inventory and put it next to the flu-clinic workflow you actually ran last October. Every vendor that touched an MBI, a roster, or a reminder message needs a current agreement on file. Where one is missing, draft and export the BAA in a single sitting, then log the executed copy with a review date. If your broader documentation set — risk analysis, policies, workforce training records — is also overdue for a refresh, automating the compliance document set beats another quarter of good intentions.