Does the HIPAA Privacy Rule require schools to maintain student immunization records?


No; however, State or other applicable laws may impose retention requirements for such records.  Further, in most cases, the Privacy Rule will not provide protections to the immunization records maintained by a school because: (1) the school is not a HIPAA covered entity; or (2) the records are maintained by an educational institution or agency to which the Family Educational Rights and Privacy Act (FERPA) applies and, thus, are protected by FERPA and not HIPAA.

Content created by Office for Civil Rights (OCR)
Content last reviewed on September 18, 2013