Does the HIPAA Privacy Rule require schools to maintain student immunization records?

Answer:

No; however, State or other applicable laws may impose retention requirements for such records.  Further, in most cases, the Privacy Rule will not provide protections to the immunization records maintained by a school because: (1) the school is not a HIPAA covered entity; or (2) the records are maintained by an educational institution or agency to which the Family Educational Rights and Privacy Act (FERPA) applies and, thus, are protected by FERPA and not HIPAA.