Vaccine Administration Documentation: What to Record

For every vaccine you give, the chart needs the date, the manufacturer, the lot number, the name, address and title of the person who gave it, and the edition date of the Vaccine Information Statement (VIS) you handed over, with the date you handed it over. Federal law requires those items for vaccines covered by the National Vaccine Injury Compensation Program. CDC best practice adds route, dose and anatomic site. Add screening, consent and the follow-up steps below, and the record also holds up when a payer, a state program or an auditor asks for it.

This guide walks through each element, shows what a complete entry looks like, and explains where federal rules end and state or program rules begin.

TL;DR

• Federal law requires the administration date, vaccine manufacturer, lot number, and the name, address and title of the administrator for VICP-covered vaccines, plus the VIS edition date and the date it was given.
• CDC best practice also calls for route, dose and anatomic site on every record, and for documenting screening and any adverse event.
• Your state's immunization information system (IIS) rules and any program you enroll in, such as Vaccines for Children, decide reporting duties and retention periods. Federal law does not set them for you.
• The same chart entry that satisfies public health also supports the vaccine administration claim. Missing fields are a common source of avoidable denials.

Table of Contents

• The federal minimum for each dose
• Fields to capture in every vaccine entry
• Documenting the Vaccine Information Statement
• Screening, consent and clinical details before the dose
• What to document after the dose
• Federal rules, state rules and program rules
• Reporting to the immunization information system
• How long to keep vaccine records
• Documentation that supports the claim
• Our perspective: treat vaccine charting as a revenue process
• See where documentation gaps cost you
• A workflow your staff can follow
• FAQ
• Sources

The federal minimum for each dose

Under the National Childhood Vaccine Injury Act, providers who give vaccines covered by the VICP must record the date of administration, the vaccine manufacturer, the lot number, and the name and address of the person administering it, along with a professional title where appropriate. CDC's vaccination records guidance lists these items and notes that federal law also requires the VIS edition date and the date the VIS was given.

Two points trip up practices:

• The address is the practice address. You do not need the clinician's home address. Many practices keep the address in the EHR facility record so it populates automatically.
• "All vaccines" is the safe rule. CDC advises that all vaccines administered should be fully documented, even where the federal statute does not strictly reach them. A chart that records some vaccines fully and others loosely is the one that creates questions later.

CDC also points out that accurate, timely records help patients get the doses they need without excess doses, which controls cost and reduces adverse reactions. That is a clinical reason to care, before any audit reason.

Fields to capture in every vaccine entry

The CDC's Vaccine Administration Record for Adults shows the level of detail a clean entry carries. The Pink Book chapter on vaccine administration recommends documenting route, dosage and the specific anatomic site, for example right arm or left thigh.

The adult record form asks for the funding source as F (federal), S (state) or P (private). If your practice enrolls in a publicly funded program, that field matters for accountability.

Use a vaccinator reference list

Standardized forms are tight on space. CDC's record form explains that a practice may keep a reference list of vaccinators, with their signatures or initials and professional titles, so initials on the chart can be traced to a full name and title. Keep that list current. When a medical assistant leaves or a new nurse starts, update it the same week.

Make the EHR do the work

Most EHRs can scan a vaccine barcode into the lot, manufacturer and expiration fields. If yours can, turn it on. Typed lot numbers are the most frequent source of mismatches between inventory logs and charts. Where barcode scanning is not available, a second staff member reading the lot number back before charting takes seconds.

Documenting the Vaccine Information Statement

Providers must document the edition date of the VIS they distributed and the date they gave it to the patient or the patient's legal representative. CDC states this is required by law for vaccines covered by the Act. A VIS goes out before each dose, and the edition date is printed on the sheet itself, usually in the footer.

CDC's instructions for using VISs cover several situations that come up in a physician practice:

• Combination vaccines. If there is no VIS for the specific combination product, use the VISs for each of its component vaccines, and record each edition date.
• Adults who cannot consent for themselves. Give the relevant VIS to the legal representative. In long-term care, the instructions allow VISs to be provided at admission or at consent, instead of before every dose.
• Emergency Use Authorization products. When a vaccine is given under an EUA and no standard VIS exists yet, CDC's VFC compliance requirements say to provide the EUA Fact Sheet for Recipients.

For a practical look at how COVID-19 vaccine guidance has shifted over time, these COVID-19 vaccine updates show why checking the current VIS or fact sheet edition each season matters.

Build the edition date into the EHR template. If the template stores only "VIS provided: yes," a reviewer cannot tell which edition the patient received, and the record is incomplete for any VICP-covered vaccine.

Screening, consent and clinical details before the dose

The federal statute does not list every clinical field, but CDC best practice is clear: screen every patient before every dose. CDC's guidance on screening before giving a vaccine says to screen for contraindications and precautions each time, because a patient's health status, or the recommendations themselves, may have changed since the last dose. It recommends a standardized screening tool for consistent results, and CDC publishes screening checklists for children, teens and adults.

A defensible pre-dose record usually includes:

1. Immunization history reviewed, including doses recorded in the IIS.
2. Screening completed, with the checklist attached or the answers captured in structured fields (illness today, allergies, prior reactions, pregnancy where relevant, immune status).
3. Contraindication or precaution findings, and the decision made. If a dose is deferred, record the reason and the plan.
4. VIS given and questions answered, with the edition date.
5. Consent, in the form your state and your own policy require. Federal law requires the VIS, not a particular consent form. Some states and some programs have their own consent rules, so confirm yours with your state immunization program.

A screening form with a signature and date, stored in the chart, is stronger than a one-line note saying "screened, no contraindications."

What to document after the dose

CDC advises updating the permanent medical record with any documented adverse events after vaccination, and with serologic test results relevant to vaccine-preventable diseases. Its after-vaccination guidance also says providers must report certain vaccine administration errors and adverse events to VAERS, and encourages reporting any clinically significant adverse event even when causation is uncertain.

In practice, add these items:

• Observation period and outcome, where your protocol includes one.
• Any reaction, its treatment and the clinician who evaluated it.
• The VAERS report, if filed, noted in the chart.
• Any administration error (wrong site, wrong dose, wrong product, expired product) with the corrective action taken.

Correcting an error in the record

Never overwrite or delete a wrong entry. Use your EHR's amendment function so the original stays visible, the correction carries a date and the author's identity, and the reason is stated. If a lot number was mistyped, the amendment should show the original value, the corrected value and who verified it against the vial or inventory log. If the wrong information also went to the IIS, send the correction there as well.

Federal rules, state rules and program rules

Federal law sets the minimum for VICP-covered vaccines. Beyond that, CDC tells providers to be aware of state or regional IIS reporting requirements. The CDC's IIS policy page explains that jurisdictions decide whether participation rests on implicit consent, explicit opt-in or mandatory inclusion. That means two practices in different states can have different duties for the same dose.

A simple way to sort your obligations:

State programs can add their own duties. Massachusetts, for example, publishes guidelines for compliance with federal vaccine administration requirements. They make the medical director responsible for ensuring that the schedule, dosage and contraindications followed comply with ACIP standards, and for the staff who order, store, administer and report on vaccines. Whatever your state, name one person who owns that oversight in writing.

Reporting to the immunization information system

IIS data sharing consolidates a person's immunization history across providers and helps manage public health emergencies, according to CDC. For your practice, this means two things. First, the chart and the IIS entry should match. Second, if your state requires reporting, the clock starts at administration, so build reporting into the same workflow as charting. Most EHRs can send HL7 messages to the state registry automatically. Check the interface for rejected messages each week, because a rejected record looks like a reported record unless someone reviews the error queue.

How long to keep vaccine records

Retention depends on the program and the state, so there is no single federal number for every practice. Two examples from the sources:

• Vaccines for Children providers must keep all relevant records, including eligibility and accountability documentation, for at least three years, or longer if state law requires, per CDC's VFC compliance requirements.
• Under the Massachusetts program, providers keep all program records, documentation and temperature logs for at least three years.

Medical record retention for your state's medical board, your malpractice carrier and your payer contracts may be longer. Where periods differ, follow the longest one, and keep temperature logs and inventory records together with the administration records they support.

Documentation that supports the claim

A vaccine claim has two parts: the product and the administration. Billing for the administration depends on what the chart shows. For pediatric codes 90460 and 90461, Physicians Practice explains that the count of vaccine components, not the number of vaccines, drives the units, and that the record must substantiate what was given and by what route. A chart that says "vaccines given" cannot support that count. A chart with product, components, route and counseling by a physician or qualified professional can.

Before claims go out, a quick check catches most problems:

1. Does the chart show every product billed, with lot number and manufacturer?
2. Does the number of components or vaccines match the units on the claim?
3. Is the route recorded, and does it fit the administration code chosen?
4. For pediatric counseling codes, does the note show counseling occurred?
5. Does the visit have a separately identifiable evaluation, if an E/M is also billed? See our guide to why documentation affects reimbursement.

Vaccine charting has the same weaknesses as any other documentation. Templates that default to "normal," staff who chart from memory, and structured fields that never populate all lead to claims that do not match the record. If you want to measure how complete your notes are, our documentation quality scoring playbook shows a 30-day approach, and the documentation education guide covers training clinicians and staff.

Our perspective: treat vaccine charting as a revenue process

Most practices think of vaccine documentation as a public health duty. We think of it as a revenue and defense process, and the two overlap completely. Vaccines are high volume and low complexity. That makes them easy to chart quickly and easy to chart incompletely. Each missing lot number or vague "VIS given" is small, but across thousands of doses a year it adds up to claims that cannot be defended and records that cannot be produced when a payer or program asks.

We built HIMShield for independent practices that cannot hire a full compliance department. Our approach is to scan EHR data before claims go out, find the gaps in coding, documentation and charge capture, and quantify what they cost by provider and payer. For vaccines, the usual finds are administration charges that never reached a claim, entries without the fields the record needs, and counseling documented in a way that does not support the code. Practices already know the rules. What they lack is time to check every chart.

Our advice: pick five fields (lot, manufacturer, site and route, VIS edition date, administrator title), make them required in the EHR, and audit a sample of 20 vaccine charts each quarter. Fix the template first and retrain second. Templates change behavior faster than reminders do.

— Elena

See where documentation gaps cost you

If you want to know how many vaccine and visit charts have gaps that could cause denials or weaken an audit response, our free 30-day Revenue Leakage Audit reviews your EHR data and reports at-risk reimbursement by provider and payer, with no new staff or software training required. You can also learn more about our HIM compliance engagement for ongoing support.

A workflow your staff can follow

Here is a short sequence that works for most practices:

1. At check-in: pull the IIS history and flag vaccines due.
2. At rooming: complete the screening checklist and give the current VIS. Record its edition date.
3. At administration: scan the barcode or read the lot back, then chart product, manufacturer, lot, dose, route, site, time and administrator.
4. After the dose: record observation and any reaction. Send the entry to the IIS.
5. Before billing: run the claim check above.
6. Monthly: reconcile the inventory log, temperature log and charted doses.

Write it down, train from it, and give each step an owner.

FAQ

Do I have to document the VIS for every vaccine?

Federal law requires you to record the VIS edition date and the date you gave it for vaccines covered by the National Vaccine Injury Compensation Program. CDC advises fully documenting all vaccines you administer, so recording it for every dose is the safer habit.

Is a signed consent form required by federal law?

Federal law requires that you provide the VIS and document it. It does not prescribe a consent form. Your state, your program agreements and your own policies may require written or verbal consent, so confirm with your state immunization program.

How long do I keep vaccine administration records?

It depends on the program and state. Vaccines for Children providers must keep records for at least three years, or longer if state law requires. Your state medical board, malpractice carrier and payer contracts may require more, so follow the longest period.

What do I do if I find a wrong lot number in a chart?

Amend the entry using the EHR's correction function so the original stays visible and the change shows the date, the author and the reason. Verify the right lot against the vial or inventory log, and send the correction to the IIS if the wrong data was reported.

Does the person giving the vaccine have to sign every entry?

The record must identify the administrator and title. CDC's adult record form says a practice may use a reference list of vaccinators with signatures or initials and titles, so initials on the chart can be traced to a full name.

Sources

• Vaccination Records, CDC
• Vaccine Administration: After Giving Vaccine, CDC
• Vaccine Administration: Before Giving Vaccine, CDC
• Vaccine Administration Record for Adults, CDC
• Chapter 6: Vaccine Administration, Pink Book, CDC
• Instructions for Using VISs, CDC
• 2025-2026 CDC VFC Compliance Visit Requirements and Recommendations
• IIS Policy and Legislation, CDC
• Guidelines for Compliance with Federal Vaccine Administration Requirements, Massachusetts
• Correct Coding for Vaccine Administration, Physicians Practice

Recommended

• Medical Necessity Documentation Examples: 2026 Guide
• Chronic Care Management Documentation: Five Records Medicare Requires
• A Documentation Improvement Plan: Your 90-Day Action Guide
• RADV Audit Process Explained for Physician Practices