Skip to main content
U.S. flag

An official website of the United States government

Return to Search

FAQ 1511 Must a provider obtain parental agreement for student immunization?

This is HIPAA Guidance for state laws regarding school immunizations.


Issued by: Office for Civil Rights (OCR)

If a state law requires a covered health care provider to disclose proof of a student’s immunizations directly to a school without the affirmative permission of a parent or guardian, must the health care provider also obtain the agreement of a parent or guardian in accordance with 45 CFR 164.512(b)(1)(vi) of the Privacy Rule prior to making the disclosure?


No.  The Privacy Rule permits a covered entity to use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of that law.  See 45 CFR 164.512(a).  In such cases, the covered entity is not required to also meet the conditions of 45 CFR 164.512(b)(1)(vi) in making the required by law disclosure.

HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.