One Tdap dose generates at least seven data events in your practice: a chart note, an inventory decrement, two claim lines, an HL7 message to the state immunization registry, a lot-number log entry, and — if your recall system is turned on — a text message five years from now. Every one of those events is a place where the tdap vaccine cpt code either matches the record or doesn't, and where protected health information either moved under a permitted disclosure or moved because nobody checked.

This guide is for practice administrators, billing leads, and privacy officers. It covers how practices determine and document code selection for Tdap, what the National Childhood Vaccine Injury Act requires you to keep, and which of the vendors in that data chain need a Business Associate Agreement on file before the next dose goes into an arm.

What Is the Tdap Vaccine CPT Code?

CPT 90715 is the product code whose descriptor covers tetanus, diphtheria toxoids and acellular pertussis vaccine (Tdap), for intramuscular use, when administered to individuals 7 years or older. It identifies the vaccine product only. It does not include the work of giving the injection.

Adjacent product codes exist for related but distinct vaccines — CPT 90714 for tetanus and diphtheria toxoids (Td) and CPT 90700 for DTaP in the younger pediatric range, among others. Which product code applies to any given encounter is determined by the vaccine actually drawn and administered, documented by the clinician, and reconciled against the NDC on the vial. Your billing staff transcribe that determination; they do not make it.

CPT is maintained by the AMA and descriptors change annually. Verify code descriptors against the current year's code set before you hard-code anything into a charge template.

Two Line Items, Not One

The most common claim denial your team will see on immunization encounters is a missing or mismatched administration line. The vaccine product and the act of administering it are billed separately.

Administration code families

Practices generally choose from two families:

  • 90471 / 90472 — immunization administration by percutaneous, intradermal, subcutaneous, or intramuscular injection; 90471 for the first vaccine, 90472 as an add-on for each additional vaccine at the same encounter.
  • 90460 / 90461 — immunization administration through age 18 when the physician or other qualified health care professional provides counseling; 90460 for the first component, 90461 as the add-on for each additional component of the same vaccine.

The distinction between these families turns on patient age and whether face-to-face counseling by a qualified professional was performed and documented. That determination lives in the clinical note. Your job as an administrator is to make sure the note contains enough detail for the coder to apply the payer's rules without guessing — and to make sure the template doesn't auto-populate counseling language that nobody actually delivered. Auto-populated counseling attestations are a documented audit failure mode.

When the visit includes an E/M service

If a separately identifiable evaluation and management service occurs on the same date, payers typically expect modifier 25 on the E/M line. Whether the service qualifies as separately identifiable is a documentation question, not a billing preference. Write your internal policy so that the modifier follows the note, not the revenue target.

Diagnosis coding and the NDC

Immunization encounters are commonly reported with ICD-10-CM Z23 (encounter for immunization). Many Medicaid programs and managed care plans also require the 11-digit NDC and unit qualifier on the claim line for the vaccine product. Build the NDC capture into the administration workflow at the point of draw, not as a back-office lookup — retroactive NDC assignment is how the wrong lot ends up on a claim and in the registry.

Medicare: know which part you're billing

Adult Tdap is a recurring payer-mapping headache. Medicare Part B covers a narrow set of vaccines directly; many routine adult immunizations, including Tdap in non-injury circumstances, fall to Part D. Tetanus toxoid furnished as treatment for an injury is handled differently. Have your billing lead document, per payer, which benefit applies and how the claim routes, and re-verify it annually. Do not let front-desk staff quote coverage from memory.

The Records NCVIA Requires You to Keep

Federal vaccine law imposes a permanent-record obligation independent of your coding workflow. For each covered vaccine dose, the person administering it must record in the patient's permanent medical record:

  1. The vaccine's name and the manufacturer
  2. The lot number
  3. The date of administration
  4. The name, address, and title of the person administering the dose
  5. The edition date of the Vaccine Information Statement and the date it was provided to the patient or parent

That list is your audit spine. When a VFC reviewer, a payer auditor, or a plaintiff's attorney asks about a dose from 2019, this is what you produce. Assign one person — usually the clinical supervisor, not the biller — to spot-check twenty randomly selected immunization entries per quarter against all five elements and log the result.

The retention question then becomes a records-management question. State medical record retention statutes vary widely; immunization documentation is frequently held longer than the general chart minimum. Write your retention schedule down, apply it to backups and to any archived system you migrated off, and make sure your data-destruction procedures reference it.

VFC and State-Supplied Stock: The Ledger Nobody Owns

If your practice participates in the Vaccines for Children program, publicly supplied doses must be tracked separately from privately purchased stock. Program rules govern eligibility screening, storage and temperature logging, borrowing between inventories, and how administration is reported. Payers and state programs differ on modifiers and on how a zero-cost product line is submitted.

Two operational failures show up in nearly every VFC site visit finding I've seen described: eligibility screening not documented at each visit, and inventory reconciliation performed by whoever happens to be free. Name an owner. Put the reconciliation on a fixed weekly cadence with a second signature. Keep the temperature excursion log where a reviewer can find it in under five minutes.

Where the Tdap Vaccine CPT Code Meets HIPAA

Immunization data leaves your practice through more channels than almost any other encounter type. Each channel needs a documented legal basis.

The registry is a public health authority. Your interface vendor is not.

Reporting doses to a state or jurisdictional Immunization Information System is generally permitted as a disclosure to a public health authority authorized to collect the information, without patient authorization. HHS maintains guidance on HIPAA and public health disclosures that your privacy officer should read alongside your state's reporting statute.

Here is the distinction practices miss: the registry itself is not your business associate, but the middleware, interface engine, or health information exchange that formats and transmits your VXU messages usually is. So is the vendor hosting your EHR. If a third party touches the PHI on its way to the registry, that party needs a signed BAA, and your privacy officer should be able to name it without opening a filing cabinet.

School, camp, and employer proof of immunization

The Privacy Rule includes a specific provision allowing a covered entity to disclose proof of immunization to a school where state or other law requires the school to have it before admitting the student — provided the practice documents agreement from the parent, guardian, or the adult student. Agreement can be oral, but it must be documented. Build a field for it. "Mom said it was fine" recorded nowhere is not documentation.

Employer requests are different. An employer asking for a staff member's Tdap status is not covered by that school provision and generally requires a valid authorization. Train your front desk to route employer and third-party requests to the privacy officer rather than faxing a record because the caller sounded official.

Recall texting and reminder vendors

Tdap recall intervals mean your reminder platform holds patient identifiers, phone numbers, and vaccine-specific due dates for years. That is PHI in a vendor's database. It needs a BAA, a defined retention period, and a written answer to the question "what happens to this data when we switch vendors?"

Your Vendor List for a Single Dose

Walk one Tdap encounter end to end and list every organization that touches identifiable data:

  • EHR host and any coding or charge-capture module
  • Clearinghouse and any claim-scrubbing service
  • Registry interface engine or HIE connector
  • Vaccine inventory and temperature-monitoring platform, if it stores patient-level administration data
  • Patient reminder, recall, and texting vendor
  • Billing service or outsourced coder
  • Release-of-information vendor, if you use one
  • Any analytics or reporting tool pulling immunization rates

Every one of those needs an executed BAA with current contact information, and every subcontractor beneath them needs a downstream agreement. If you found a vendor on that list without one, you can produce a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — rather than routing a redline through counsel for a low-risk texting vendor. HHS also publishes sample business associate agreement provisions for comparison against whatever your vendor sends you.

The 30-Day Clock When a Patient Asks for Their Immunization Record

A parent needs a shot record for a school deadline. That is a right-of-access request, and it runs on the same clock as any chart request: 30 days, with one 30-day extension available if you notify the individual in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount, and you must provide the record in the form and format requested if you can readily produce it. OCR's right of access guidance is the reference to hand your front desk.

Practical build: keep an immunization-only export path in your EHR so staff can fulfill these in minutes without releasing the full chart, log the request and the fulfillment date in the same disclosure log you use for everything else, and never condition release on payment of an outstanding balance.

A 30-Day Cleanup Plan

Week 1 — Billing lead. Pull ninety days of immunization claims. Confirm every vaccine product line has a matching administration line, that NDCs are populated where required, and that modifier 25 usage on same-day E/M is supported by the note. Document the error rate.

Week 2 — Clinical supervisor. Audit twenty immunization entries against the five NCVIA elements. Fix the template fields that failed. Confirm VIS edition dates in use are current.

Week 3 — Privacy officer. Map the data flow for one dose. Match every hop to a signed BAA or a documented permitted disclosure. Add the school-immunization agreement field if you don't have one.

Week 4 — Administrator. Update the payer matrix for adult Tdap coverage, re-verify Part B versus Part D routing, and confirm your VFC inventory reconciliation has a named owner and a signature line. Then schedule the same four weeks for next quarter.

Interoperability requirements around immunization data continue to tighten; ONC's interoperability resources are worth reviewing before your next EHR contract renewal, because registry reporting capability is now a contract negotiation point rather than an assumed feature.

Next Step

Coding the tdap vaccine cpt code correctly is the easy half. The harder half is proving, on demand, that every system holding that dose record is under contract and every disclosure had a basis. Start with the vendor list — if any name on it lacks a current agreement, generate and execute a BAA this week. If your broader policy set and risk analysis haven't been refreshed since your last EHR change, automate the full compliance document set rather than rebuilding it by hand.