Can you fax immunization records to a school?

Yes, when three conditions hold: the fax carries only proof of immunization, a state or other law requires the school to have that proof before admitting the student, and the practice has obtained and documented a parent's or guardian's agreement (or the student's own, for an adult or emancipated minor). No signed authorization is needed under 45 CFR 164.512(b)(1)(vi).

What does HIPAA require before you send immunization records to a school?

The school provision in 45 CFR 164.512(b)(1)(vi) allows the disclosure when all three of these hold:

1. The fax contains proof of immunization and nothing else about the student.
2. A state or other law requires the school to have that proof before it admits the student, who can be enrolled or prospective.
3. The practice (the rule's covered entity) obtained and documented the agreement of a parent, guardian or other person acting as the child's parent, or of the student if an adult or emancipated minor.

HHS reports that most states have school-entry laws that keep a child out of class without proof of immunization (HHS guidance on student immunizations). The provision names no delivery method, so the conditions are the same for a fax as for a mailed copy.

Do you need a signed authorization?

No, when the three conditions hold. Section 164.512 is the part of the Privacy Rule for disclosures that need neither a written authorization nor an opportunity to agree or object, and HHS's FAQ 1507 answers yes to sending a school proof of a child's immunizations without a HIPAA authorization when a law requires the school to have it and a parent has agreed.

The agreement is lighter than an authorization. The section's opening paragraph says an agreement it calls for may be given verbally, so a parent's phone call can supply it. FAQ 1508 says the record needs no signature and none of the content a formal authorization must carry. It names two records that suffice: a kept copy of the parent's written or emailed request, and a note of the phone call in the chart or elsewhere.

HHS's guidance says the agreement stays effective until the parent, guardian or student revokes it, and FAQ 1510 says one agreement can cover several disclosures over time, such as updates after a vaccine series. Do you need patient consent to fax medical records? covers consent and authorization in general.

Why does the CDC's FAQ sound more cautious?

The CDC's FAQ on HIPAA and access to patient records during IQIP and VFC visits has one answer about schools. It says providers may disclose immunization information to schools without authorization if state law permits or requires it, and that without such a law "it appears that such disclosures to schools will require individual authorization." That wording makes a state law the way around an authorization.

The regulation sets a different test: a law that requires the school to hold the proof before admission, plus the practice's documented agreement. It asks for no state law that permits the disclosure itself. HHS applies that test in FAQ 1507. A state law that requires the practice to send the proof is a separate route, and the agreement condition does not also apply there (45 CFR 164.512(a); FAQ 1511).

Which route fits the school's situation?

FAQ 1512 limits the provision to a school that a state or other law requires to have the proof before admission. A school outside that description falls into the third row. When a parent signs the authorization for a minor, the form must also describe the parent's authority to act for the child (164.508(c)(1)(vi)). A parent who asks for a copy to carry in is usually acting as the child's personal representative (45 CFR 164.502(g)(3)). How to respond to a medical records request by fax covers that request.

Can state law add requirements?

Yes. The second condition turns on state or other law, so the school's admission requirement comes from outside HIPAA. A state privacy law that is more stringent than the Privacy Rule is not preempted (45 CFR 160.203(b)), so it applies alongside the three conditions. The federal rule lists no states, and the laws differ from state to state.

How do you fax the proof and keep the record?

Two steps cover the fax.

1. Get the school's fax number from the school, on its website or in the instructions it gave the parent, and call to confirm it before you send. Among HHS's examples of reasonable fax safeguards is the sender checking that the number is correct for the receiving office (FAQ 356; 45 CFR 164.530(c)). The rule does not fix which school employee receives the proof: under FAQ 1509, anyone the parent's request or the school's instructions identify is a permitted recipient. Is a fax sent to the wrong number a HIPAA breach? covers what a misdial sets off.
2. Keep the delivery certificate in the chart. In Fax Pigeon, open the sent fax and choose View delivery proof. The certificate shows the date and time of delivery, the pages transmitted, the call duration, a confirmation ID and the recipient number, partly masked.

The certificate proves delivery. It does not record the agreement, which the rule requires the practice to document. FAQ 1508 says that record is kept for six years, and 45 CFR 164.530(j) counts the six years from the later of the record's creation and the date it last was in effect. How long must you keep fax records under HIPAA? sets out the other periods.

Once the proof is at the school, HHS says the Privacy Rule in most cases no longer protects that copy, because the school is not a covered entity or FERPA governs the record (FAQ 1513).

Fax Pigeon signs a BAA at signup on every plan, and a fax service that stores faxes is a business associate under 45 CFR 160.103.

* Fax Pigeon prices and plan terms as of October 14, 2026.