Reporting vaccinations to the state immunization registry is one of the interfaces every ambulatory EMR is expected to support and one of the most frequently broken. The messages are standardized, the registries are well documented, and the failures are almost always in configuration details on the practice side. This guide covers how the interface works, what the onboarding process looks like, and the handful of errors that account for most rejected records.
What an immunization information system is
An immunization information system, or IIS, is a confidential population-based database run by a state or large local health department that consolidates vaccination records from providers across the jurisdiction. Providers report doses administered; the registry deduplicates patients, merges histories, and forecasts which doses are due. Clinicians can then query the registry to see a patient's complete history, including doses given elsewhere.
Reporting is required or strongly encouraged under most state laws, and the ONC certification program includes a criterion for transmitting immunization data to a registry using the national standard. The CMS Promoting Interoperability program has also required active engagement with an IIS as a public health measure. So the interface serves three purposes at once: legal reporting, program credit, and better clinical decisions.
The messages: VXU, QBP, and acknowledgments
Registries accept immunization data as HL7 version 2.5.1 messages following the CDC's implementation guide. The message types are worth knowing by name because they appear in every error log.
- VXU (Unsolicited Vaccination Record Update) is the outbound message the EMR sends when a dose is administered, historical doses are recorded, or a patient's demographics change. It carries patient identification, the vaccine product, lot number, administration date, route, site, the administering provider, and funding source.
- QBP (Query by Parameter) asks the registry for a patient's record. The registry responds with an RSP containing the history and, usually, the forecast of due doses. Together these make the interface bidirectional.
- ACK is the registry's acknowledgment of a VXU. An application accept means the record was stored; an application error or reject means it was not, and the ACK includes error segments describing why.
Transport is typically the CDC's SOAP-based web service specification over HTTPS, with credentials issued by the registry. Some registries also accept batch file uploads, which is useful for historical backfill but not a substitute for real-time reporting.
Onboarding with the registry
Every registry runs a structured onboarding process, and it cannot be skipped by a practice that has done it before with a different EMR. A typical sequence is as follows.
- Register the practice and each site with the IIS and sign the registry's provider agreement.
- Submit a request to begin electronic data exchange, naming the EMR product and version. Registries maintain lists of vendors already validated, which shortens testing.
- Complete structural and content testing. The registry provides test scenarios; the EMR sends VXU messages to a test endpoint, and the registry reviews them for conformance.
- Run a parallel period in which production messages are sent and reviewed for data quality before the registry marks the site as live.
- If bidirectional query is desired, complete a separate validation for QBP and RSP.
Expect the process to take weeks to months, mostly waiting in the registry's queue. Start early in an implementation and assign one person to own the correspondence.
EMR configuration that makes or breaks the feed
The registry cannot store what the EMR does not send correctly. The following settings deserve a careful check before testing.
- Vaccine product mapping. Each product in the EMR's immunization dictionary must map to the correct CVX code, and ideally an MVX manufacturer code and NDC. A locally created product with no CVX will be rejected on every dose.
- Lot number and expiration. Registries validate that lot numbers are present for administered doses and often that expiration dates are reasonable.
- Administered versus historical. Doses the practice gave and doses reported by the patient from elsewhere must be flagged differently. Historical doses do not require lot numbers but must not be reported as administered.
- Patient demographics. Name, date of birth, sex, and address are the deduplication keys. Missing or placeholder values create duplicate patients in the registry. Mother's maiden name and multiple birth indicators improve matching for infants.
- Funding source and eligibility. Vaccines for Children program eligibility must be captured at the visit level and sent; registries use it for program accountability.
- Consent and protection indicators. States with opt-out or opt-in rules require the EMR to send the appropriate protection indicator so the registry handles the record correctly.
- Sending facility identifiers. Each site must send the identifier the registry assigned it, not a generic organization code.
A workflow gap is as damaging as a mapping error. If doses are charted from a paper log at the end of the day, or recorded in a nursing note instead of the immunization module, the interface never sees them.
Common rejections and how to fix them
| ACK error text (typical) | Likely cause | Fix |
|---|---|---|
| Invalid or missing CVX code | Product not mapped, or a compounded or custom product | Map the product in the immunization dictionary; retire local duplicates |
| Lot number required | Dose recorded as administered without a lot | Make lot a required field on administration; correct and resend |
| Patient could not be matched or created | Missing DOB, sex, or placeholder name | Fix demographics; resend after registration is complete |
| Administration date after message date or before DOB | Date entry error or timezone mismatch | Correct the encounter; check interface timezone setting |
| Unknown sending facility | Site identifier not registered | Confirm the facility ID with the registry and update the interface profile |
| Message rejected, authentication failed | Expired credentials or certificate | Renew with the registry; check for scheduled password rotation |
Rejected messages should never be silently discarded. The interface engine or EMR should hold them in an error queue that someone reviews, and the registry will usually accept a corrected resend of the same dose without creating a duplicate, because the message carries the EMR's immunization record identifier.
Keeping the interface healthy
An immunization feed fails quietly. Credentials expire, a vendor update changes a segment, a new vaccine product is added without a code, and nobody notices until a program audit or a parent asks why a dose is missing from the school form. Build three habits. Review the error queue weekly and trend the reasons. Reconcile monthly by comparing doses administered in the EMR against the count the registry shows for the site; most registries provide a data quality report. And query the registry on every patient at the start of a well visit, which both improves care and reveals immediately when the connection has stopped working.
Common questions
Do we have to report doses to the state immunization registry?
Most states require or strongly encourage provider reporting, and ONC-certified EMRs must support it. Requirements and consent models vary by state, so check the registry's provider agreement. The Promoting Interoperability program has also required active engagement with an IIS.
What is the difference between a CVX code and an NDC?
CVX is the CDC code for a vaccine type, such as a specific influenza vaccine formulation. NDC is the FDA national drug code for the exact product and package. Registries key on CVX and use NDC and the MVX manufacturer code to refine it; the EMR product dictionary should carry all three.
Why does the registry show duplicate patients for our practice?
Usually because messages were sent with inconsistent or incomplete demographics, so the registry could not match them. Fix demographics at the source, and ask the registry to merge the duplicates; most have a process for provider-requested merges.
Is the immunization registry interface covered by HIPAA?
Reporting to a public health authority is a permitted disclosure under the Privacy Rule, so no patient authorization is needed. The transmission itself must still be secured, which is why registries require HTTPS transport and issued credentials.