Indiana Travel Immunization Records Privacy Laws: Step-by-Step Compliance Checklist

Overview of Indiana Immunization Registry CHIRP

What CHIRP is and why it matters for travel

The Children and Hoosier Immunization Registry Program (CHIRP) is Indiana’s statewide system for recording vaccinations given by healthcare providers and pharmacies. For travel, CHIRP helps you verify doses, generate official records, and coordinate with clinicians who administer destination-specific vaccines.

MyVaxIndiana PIN Access

Patients and parents can view CHIRP records through the consumer portal using a unique MyVaxIndiana PIN. You distribute the PIN securely to let families download immunization histories for schools, camps, or international travel documentation without exposing other medical details.

Step-by-step compliance checklist

• Designate authorized CHIRP users and assign the minimum necessary access for staff who schedule, vaccinate, or release records.
• Execute required user agreements and keep role-based permissions and audit logs current.
• Configure your EHR to submit doses to CHIRP accurately (patient identifiers, CVX codes, lot numbers, and dates).
• Offer MyVaxIndiana PINs at checkout and verify identity before issuing or reissuing access credentials.
• Document parental notification practices and honor Parental Consent Opt-Out preferences in the registry.
• Train staff annually on privacy, identity verification, and Indiana-specific rules that affect travel documentation.

Parental Consent and Opt-Out Provisions

How consent and opt-out work

Indiana uses an opt-out framework for CHIRP. By default, a child’s vaccinations flow into the registry; a parent or legal guardian may exercise a Parental Consent Opt-Out to limit registry sharing and visibility. Opt-out does not erase a provider’s clinical chart; it restricts how the registry discloses the record.

Step-by-step compliance checklist

• Provide clear notice at intake that immunizations are reported to CHIRP and explain opt-out choices in plain language.
• Offer a simple opt-out form and accept written or documented verbal requests from a parent or guardian.
• Capture, date, and store the opt-out request; update the patient’s registry status promptly.
• Explain the impact: reduced registry visibility may slow school, camp, or travel documentation unless the parent retains personal copies.
• Allow rescission at any time; document the reversal and confirm restored access in CHIRP/MyVaxIndiana.

Accessing Immunization Records Securely

Identity verification and secure release

Before releasing an immunization history, verify identity using government ID for adults and appropriate documentation for parents or legal guardians. When using MyVaxIndiana PIN Access, treat the PIN as sensitive data; deliver it in a way that prevents interception and confirm the recipient’s identity.

Technical and administrative safeguards

• Enforce unique logins, strong passwords, and role-based access for staff who view or export CHIRP records.
• Use encrypted channels to transmit records and avoid unencrypted email attachments containing protected data.
• Log each disclosure (who, what, when, why) to support audits and traveler documentation requests.
• Apply the minimum necessary standard: release only the immunization details needed for the stated purpose.

Travel-ready documentation tips

• Provide a concise immunization summary showing vaccine names, dates, and lot numbers suitable for consulates or airlines.
• When applicable, issue the International Certificate of Vaccination or Prophylaxis (ICVP “yellow card”) and store a copy in the patient’s chart.
• For minors with an opt-out, remind families to retain personal copies for camps, colleges, and international trips.

Disclosure Rules to Schools and Educational Entities

What schools may receive

Schools typically require proof of immunization for enrollment or activities. Providers may disclose the specific vaccines required for attendance, and school nurses may access necessary information consistent with their roles in CHIRP and applicable privacy rules.

HIPAA Authorization Exceptions

Under HIPAA, a formal, signed authorization is not always required to share immunization information with a school when state law requires proof and a parent or guardian agrees to the disclosure. Document the parent’s agreement (verbal or written), the date, and the recipient entity.

Step-by-step compliance checklist

• Confirm the requestor’s authority (school nurse, registrar) and verify identity before disclosure.
• Record the parent agreement and transmit only the immunization details needed for enrollment.
• Send records through secure channels; avoid handing original documents to students without sealed envelopes.
• Note that once the school stores the record, FERPA Educational Records Privacy governs the school’s handling and redisclosure.

Prohibitions on Immunization Passports

Indiana Immunization Passport Prohibition

Indiana law restricts government entities from issuing or requiring an “immunization passport” as a condition to access services. For private entities, vaccination-status policies must be crafted carefully to avoid functioning as prohibited passports and should treat vaccination data as confidential medical information.

Step-by-step compliance checklist

• Public agencies and political subdivisions: do not require proof of vaccination for access to services or facilities unless another law expressly permits it.
• Private organizations: if you collect vaccination status for employment or safety, separate it from HR files, limit access, and avoid conditioning general public access on vaccination proofs.
• Travel clinics: issuing an ICVP or travel letter to a patient is permissible documentation for international requirements and is not a domestic “passport.”
• Review signage, event policies, and vendor contracts to ensure they do not mandate or reference “immunization passports.”

FERPA vs HIPAA in Immunization Record Privacy

Who is covered by which law

When a healthcare provider maintains an immunization record, HIPAA applies. When a school maintains a student’s immunization information as part of the education record, FERPA applies and the record is generally excluded from HIPAA. Knowing which law controls at each point prevents over- or under-sharing.

Practical distinctions for compliance

• HIPAA: rely on minimum necessary, maintain disclosure logs, and use the school disclosure pathway with parent agreement where required.
• FERPA: schools must protect education records, obtain consent for most redisclosures, and provide parent or eligible student access upon request.
• Crosswalk: once a record moves from the provider to the school, your HIPAA duties continue as a provider, but the school’s handling is governed by FERPA.

Record Retention and Compliance Requirements

Immunization Record Retention Policies

Maintain immunization documentation in accordance with Indiana record-retention schedules and your malpractice carrier’s guidance. As a best practice, keep adult records at least 7–10 years after the last encounter and retain minor records longer (for example, until several years after the patient reaches the age of majority). Registry entries persist within CHIRP for continuity of care.

Program governance and audits

• Adopt written policies covering CHIRP data entry, corrections, opt-outs, and consumer access via MyVaxIndiana.
• Run periodic audits to confirm accurate submissions, user access rights, and disclosure logs.
• Maintain a documented breach response plan and complete workforce privacy training annually.
• Review traveler documentation workflows each spring and fall to align with school and college deadlines.

Conclusion

To comply with Indiana travel immunization records privacy laws, use CHIRP effectively, honor Parental Consent Opt-Out choices, secure access with MyVaxIndiana PINs, disclose only what schools need under the HIPAA/FERPA framework, avoid prohibited “passport” practices, and retain records under clear policies. Consistent training and auditable processes keep your organization confident and compliant.

FAQs

What is the role of CHIRP in Indiana immunization records?

CHIRP centralizes vaccination data so providers, pharmacies, and authorized public health users can ensure complete, accurate histories. For families, it supports MyVaxIndiana access to quickly obtain official records for school, camp, college, and international travel, reducing errors and duplicate shots.

How can parents opt out their children from CHIRP?

Parents submit an opt-out request to their provider or through the process the provider supports. The request is documented, the child’s registry status is updated to limit sharing and visibility, and parents are advised to keep personal copies for school or travel needs. Opt-out can be rescinded later.

Can schools access immunization records without HIPAA authorization?

Yes. When state law requires proof of immunization for school entry, a provider may disclose the necessary immunization information with the parent’s agreement, even without a full HIPAA authorization. After the school receives it, FERPA governs how the school protects and rediscloses the record.