Revenue Cycle Insider

Don’t overlook the CDC vaccine schedule and your HIPAA practices.

If you’ve been paying attention to the news recently, you’ll know that measles outbreaks are on the rise. The Centers for Disease Control and Prevention (CDC) reports there have been 14 outbreaks of the illness reported in 2025 up to the end of May (compared to 16 for the whole of 2024), with 1,088 cases confirmed in 32 states.

That means now is a good time to refresh your memory of measles coding. In this, the first of two articles, we’ll look at vaccine administration coding for measles, touching on the CDC’s recommended vaccine schedule for children and adults, your use of CPT^® and ICD-10-CM codes to document the patient’s vaccination, and your practice’s HIPAA responsibilities in releasing that information to an outside entity.

Know the Current Vaccination Schedule

For children and adolescents, the CDC recommends a two-dose series of the measles, mumps, rubella (MMR) vaccine, with one dose being administered between the ages of 12-15 months and a booster between the ages of 4-6 years. For older children and adolescents who are unvaccinated, they recommend a two-dose series at least four weeks apart.

For adults born in 1957 or later who “lack documentation of vaccination or lack evidence of immunity,” meaning there is no “laboratory evidence of immunity or disease,” the CDC recommends one or two doses of the MMR vaccine “depending on indication.”

Then Understand Vaccine and Administration Coding

Coding for the MMR vaccine is straightforward, but coding for its administration is not. For the vaccine, you’ll use 90707 (Measles, mumps and rubella virus vaccine (MMR), live, for subcutaneous use) no matter what the age of the patient.

Coding for the administration is dependent on the patient’s age.

Administration for children under the age of 18: You’ll use 1 unit of 90460 (Immunization administration through 18 years of age via any route of administration, with counseling by physician or other qualified health care professional; first or only component of each vaccine or toxoid administered) and 2 units of +90461 (… each additional vaccine or toxoid component administered (List separately in addition to code for primary procedure), as the provider is administering three vaccines and providing counseling to the patient or the patient’s parent or guardian on the vaccine.

Administration for adults 18 and over: You’ll simply report 1 unit of 90471 (Immunization administration (includes percutaneous, intradermal, subcutaneous, or intramuscular injections); 1 vaccine (single or combination vaccine/toxoid)).

Take This Z Code Refresher

In addition to using CPT^® codes to document measles immunization for billing purposes, you’ll also need to use a variety of Z codes to document the encounter.

If a patient’s immunization goes ahead without an issue, you’ll use Z23 (Encounter for immunization). However, if that visit is a part of a routine preventive health care, visit such as a well-baby visit, ICD-10-CM guideline I.C.21.c.2 tells you to code Z23 as a secondary code to the appropriate code from Z00.- (Encounter for general examination without complaint, suspected or reported diagnosis) to describe the encounter.

Additionally, if the provider counsels the patient or the patient’s parent or caregiver on the safety of the MMR vaccine and you have used 90460 to document that as a part of the vaccine administration, you’ll need add Z71.85 (Encounter for immunization safety counseling). But adding the code isn’t as simple as you think.

ICD-10 guideline I.C.21.c.10 tells you Z71.85 only applies “for counseling of the patient or caregiver regarding the safety of a vaccine” (emphasis added). The guideline also tells you that the code “should not be used for the provision of general information regarding risks and potential side effects during routine encounters for the administration of vaccines.”

Understand Your Practice’s HIPAA Responsibility

Once a patient has been immunized against measles, it’s important to know your patient’s and practice’s rights regarding what information you can provide about that immunization, who you can provide it to, and what procedures you need to follow if and when another entity, such as an educational institution, asks your practice to provide the information.

Immunization status is an important exception to a patient’s protected health information (PHI) and may, depending on the circumstances, not be protected under the HIPAA Privacy Rule. The U. S. Department of Health and Human Services (HHS) has issued some comprehensive guidelines on the subject. Simply put, a covered entity, such as your medical practice, “may disclose proof of a student’s immunizations directly to a school nurse or other person designated by the school to receive immunization records.”

First, however, you must get permission, either orally or in writing, to do so. If the patient is “an adult or emancipated minor, the provider may make the disclosure with the agreement of the student herself,” per the HHS guidelines. However, in the case of a child, the HHS guidelines go on to tell you to first ensure you have permission from “a parent, guardian, or other person acting in loco parentis,” to release the information.

Next, documentation of that permission must appear in the patient’s medical record, either by notation for an oral agreement or by placement of a copy of the agreement directly in the record.

Once that is achieved, your practice may release the record, but only to an institution that is “required by law to have proof of immunizations in order to admit the child,” according to HHS.

Next month: We’ll take a look at ICD-10-CM coding for measles and history of measles. We’ll also look at the Z codes that apply if a patient or the patient’s caregiver refuse the MMR vaccine or when an immunization cannot go through as planned.

Bruce Pegg, BA, MA, CPC, CFPC, Managing Editor, AAPC