A claim for an adolescent well visit comes back denied. The vaccine product line paid; the administration line did not. Your biller re-reads the encounter note and finds no documentation of who counseled the patient and family, so the age-based administration code the system auto-selected cannot be supported. Multiply that by the forty Tdap doses your practice gave last quarter and you have a rework queue. This guide walks administrators and billing staff through how a Tdap CPT code gets selected, documented, and defended — and then through the privacy obligations that attach to every immunization record you create, transmit to a state registry, or hand to a school.

What the Tdap CPT Code Set Actually Contains

Immunization billing almost always requires two lines, not one. The vaccine product is reported with its own CPT code, and the act of administering it is reported separately. Practices that submit only one line generate predictable denials.

Product codes

The AMA publishes distinct product codes for the tetanus-diphtheria-pertussis family, and the descriptors themselves carry age and formulation limits. CPT 90715 describes tetanus, diphtheria toxoids and acellular pertussis vaccine (Tdap) for intramuscular use in individuals 7 years or older. CPT 90714 describes a preservative-free Td formulation for the same age band. CPT 90700 describes DTaP for individuals younger than 7 years. The descriptor language is what your payer's edits read against, which is why a mismatch between patient age and product code is one of the most common front-end rejections your team will see.

Administration codes

Administration is reported with a separate code family. CPT 90471 and 90472 describe percutaneous, intradermal, subcutaneous, or intramuscular immunization administration for a first and each additional vaccine. CPT 90460 and 90461 describe administration through age 18 when the physician or other qualified health care professional provides face-to-face counseling, reported per vaccine component. That counseling requirement is documentation-dependent, not automatic, and it is exactly where the denial in the opening paragraph came from.

The Tdap CPT code for the vaccine product itself is 90715 — "tetanus, diphtheria toxoids and acellular pertussis vaccine (Tdap), when administered to individuals 7 years or older, for intramuscular use." It covers the product only. A separate immunization administration code (from the 90460–90461 or 90471–90472 families, depending on patient age, counseling documentation, and payer policy) is reported alongside it. Practices should confirm the current-year CPT descriptor, their payer's administration-code policy, and any required NDC or modifier reporting before submitting. Code selection is determined by the documented encounter, not by the scheduling reason.

Who Decides Which Tdap CPT Code Goes on the Claim

Assign this in writing. In most practices the chain runs: the clinician documents what was given, the lot, the route, the site, and any counseling; the medical assistant records administration in the EHR immunization module; the biller or coder maps that documentation to a product code and an administration code; and a designated reviewer audits a sample monthly.

Your coding policy should say who resolves ambiguity. When the note does not support the administration code the EHR suggests, the biller queries the clinician — the biller does not upgrade or downgrade the code on their own judgment. Write that rule down. It is the single cheapest defense you have if a payer audits your immunization lines.

Keep a one-page internal reference that lists the tdap cpt code options your practice actually uses, the age bands in the descriptors, and the payer-specific quirks below. Update it every January when new CPT codes take effect, and date-stamp the version so an auditor can see which reference was in force during the period under review.

Payer Rules That Trip Up Front Desks

Medicare Part B versus Part D

Medicare Part B pays for a short list of preventive vaccines — influenza, pneumococcal, hepatitis B for at-risk beneficiaries, and COVID-19 — and CMS documents the billing rules for that list in its Part B immunization billing guidance. Routine Tdap generally falls outside that list and sits under Part D, which means your medical claim may not be the right destination at all. Tetanus vaccination furnished as part of treating an injury is handled differently. Train your front desk to flag Medicare patients presenting for a routine Tdap so someone verifies coverage before the dose is drawn, not after.

Vaccines for Children

For VFC-eligible pediatric patients, the vaccine product is state-supplied and the practice bills only administration, subject to your state's cap. Many state Medicaid programs require the product line to be reported at zero or nominal charge with a state-designated modifier. VFC also requires eligibility screening at every immunization visit and retention of those screening records — which means your practice is creating a second document set tied to each dose, with its own retention and access obligations.

Modifiers, NDCs, and units

Commercial plans that process the vaccine as an ACA preventive service frequently expect modifier 33. Many payers require the 11-digit NDC and unit qualifier on the product line. If a separately identifiable evaluation and management service occurred, modifier 25 on the E/M line is the standard convention. None of these are clinical decisions; they are claim-formatting rules your billing lead should maintain in a payer matrix and review quarterly.

The Registry Report Is a Disclosure — Log It Like One

Every Tdap dose you record probably goes to a state immunization information system. That transmission is a disclosure of protected health information. It is permitted without patient authorization under the public health provisions of the Privacy Rule, and HHS explains the scope in its guidance on disclosures for public health activities. Permitted is not the same as invisible.

Three operational consequences follow. First, a state health department acting as a public health authority is generally not your business associate, so you will not have a BAA with the registry itself — but the HIE, interface engine, or integration vendor that moves the message on your behalf usually is. Second, your Notice of Privacy Practices should describe public health reporting in plain language, and your staff should be able to explain it at the front desk without improvising. Third, your accounting-of-disclosures process needs to account for registry submissions in the categories where the rule requires it; if your answer to "how would we produce that" is a shrug, fix it before someone asks.

When Schools, Employers, and Camps Ask for the Vaccine Record

Immunization records generate more outbound requests than almost any other document in a primary care practice. Sort them into three buckets and train to the buckets.

  • The patient or personal representative asks. This is a right-of-access request. You owe the record within 30 days, with one 30-day extension available, and fee limits apply. HHS's right of access guidance is the controlling reference, and immunization records are among the easiest requests to fulfill quickly through the portal.
  • A school asks directly. Many states have statutes that permit disclosure of immunization records to schools under defined conditions, sometimes with documented agreement from a parent or the patient. Know your state's rule, document how consent was obtained, and never let a phone caller talk your receptionist into faxing without verification.
  • An employer asks. A general employer request for a patient's vaccine record needs a valid HIPAA authorization. The narrow workforce-medical-surveillance exception applies when you are providing occupational health services under contract to that employer — a different arrangement with different paperwork. If your practice does employer physicals, keep those records and workflows separated from your general patient population.

Misdirected immunization faxes and portal messages sent to the wrong guardian are ordinary, unglamorous breaches. Each one still requires a documented four-factor risk assessment before you conclude notification is unnecessary. Keep the assessment form in your incident file, not in someone's memory.

Your Vendor List: Everyone Who Touches the Immunization Line

Walk one Tdap encounter end to end and write down every outside party that sees identifiable data. A typical list looks like this: the EHR host, the billing company or outsourced coder, the clearinghouse, the immunization registry interface vendor, the patient-reminder texting platform, the eligibility verification service, the vaccine inventory system if it stores patient-level administration data, and the release-of-information vendor if you use one. Cold-chain temperature monitoring usually does not touch PHI — verify rather than assume.

Every one of those is a business associate unless you can articulate why not. If your list has gaps — and after an EHR migration or a billing-vendor change it usually does — close them before your next risk analysis. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, which is faster than chasing a vendor's legal team for a template they will amend anyway. For the broader document set — risk analysis, policies, workforce training records — automated HIPAA compliance documentation covers the same ground at the organization level.

One more vendor category deserves attention: analytics and marketing scripts on the pages where patients schedule vaccine appointments. OCR's position on online tracking technologies has been contested in litigation, but the underlying exposure has not changed — a third-party script on a scheduling page can transmit identifiers alongside the reason for the visit. Inventory your web pixels the same way you inventory your BAAs.

Patient Access, Portals, and Information Blocking

Immunization data sits squarely in the interoperability data classes covered by federal information blocking rules. If your practice delays portal release of vaccine records, requires an in-person visit to obtain them, or routes every request through a paper form when an electronic copy exists, you should be able to point to a defined exception. ONC maintains the current framework at healthit.gov's information blocking resources. Review your portal release settings for immunization results specifically — many practices configured them years ago and never revisited the defaults.

A 20-Minute Self-Audit You Can Run This Week

  1. Pull ten immunization encounters from the last 60 days. Confirm each has both a product line and an administration line, and that the documentation supports the administration code family used.
  2. Check that the product code on each claim matches the patient's age against the current CPT descriptor.
  3. Confirm NDC and modifier requirements for your top five payers are documented in a matrix with a revision date.
  4. Verify your registry interface vendor has a current, signed BAA — and that the signatory still works there.
  5. Time your last three immunization record requests from receipt to fulfillment. If any exceeded 30 days, find out why.
  6. Confirm your VFC eligibility screening records are retained and retrievable for the required period.
  7. Ask your front desk what they say when a school calls for a vaccine record. Listen to the actual answer.

The tdap cpt code on your claim is the visible end of a workflow that also touches public health reporting, state consent law, patient access rights, and half a dozen vendor relationships. Practices that treat it as purely a billing question tend to discover the rest during an audit.

Next Step

Start with the vendor list, because it is the piece that fails silently. Map every party that touches an immunization encounter, confirm each has a current agreement on file, and produce the missing Business Associate Agreements in an afternoon rather than a quarter. Then re-run the ten-chart coding sample next month and see whether your denial queue shrank.