1

Section IX. 2016 Immunization Information Systems Annual Report (IISAR)

What is the Immunization Information Systems Annual Report (IISAR)? 

The IISAR is an annual survey that assesses immunization program performance in developing, maintaining, and 

enhancing Immunization Information Systems activities for a given calendar year. It is a reporting requirement for the 64 

immunization programs that receive funding under section 317b of the Public Health Service Act.

A brief note on methods

•

•

The IISAR is a self-reported, self-validated survey administered by CDC and answered by immunization program

awardees. CDC may contact you with questions after submission in order to continue data validation.

Data are collected prior to Census estimates are released for the year of the survey. For this reason, we include

Census estimates in the survey for the year prior to provide preliminary estimates for some measures. These

preliminary estimates are revised when the final Census data are released, approximately in June/July each year

for the prior years’ data. CDC provides preliminary estimates on the IISAR to ensure the estimates are

concordant with the program and past years’ data.

Changes in 2016

The IISAR underwent significant revisions in 2013 to address the new Functional Standards for IIS, 2013–2017 available 

at: It is not intended to be comprehensive in addressing 

all areas within each Functional Standard, and is not meant to imply that some Functional Standards are more 

important than others. The IISAR is one tool among many that is used to gather information that is used to monitor 

awardee progress in achieving the new Functional Standards. 

https://www.cdc.gov/vaccines/programs/iis/func-stds.html.

This year’s survey has several changes compared with the 2015 survey. Changes are summarized here and new 

questions are indicated in red text throughout the survey. 

•

•

•

Functional Standard 1 – Two new items (Q.13 and Q.14) about the AIRA transport layer assessment have been

added.

Functional Standard 3 – Logic guidance for child, adolescent, and adult enrollment and participation has been

expanded to better clarify the instructions from past years. Logic guidance for middle name fields for Q.54, 60,

and 61 have been added.

Functional Standard 5 – User access to IIS data item has been redesigned to provide clearer response options.

Instructions

•

•

•

•

All awardees that conduct IIS activities in their state/city/territory are required to complete this report.

All awardees with IIS in transition are required to complete questions 1 through 7 and should consult with their

IISSB Project Officer to discuss completing other data elements on the questionnaire.

Items in italics are completed by CDC; awardees only need to respond to questions that are NOT italicized.

Throughout the IISAR questionnaire, age ranges are described as from age X through Y months/years. This

terminology is consistent with language used by the Advisory Committee on Immunization Practices and

indicates the lower and upper age limits for who should be included in data collection. In all cases, age X is the

lower bound and age Y is the upper bound. For example, adolescents aged 11 through 17 years should include
 

2

adolescents at least 11 years old and less than 18 years of age. Those younger than 11 years, or 18 years or 

older, would not be included in this group.

•

•

•

•

Submission of the final Immunization Information Systems Annual Report must be done by the Immunization 

Program Manager or their designee. 

Only one Annual Report will be accepted per awardee. If awardees receive information from other regions or 

counties in their jurisdiction, the awardee must compile the information into one Annual Report. 

The Annual Report is due on March 31, 2017; the year of performance is calendar year 2016. CDC IISSB staff will 

contact each IIS after March 31 with questions and/or comments about the report and data submitted for 

calendar year 2016. After March 31, 2017, the submission data will be corrected and revised. Any revised

submissions from awardees should correct issues with the submitted data as of March 31 ONLY. When 

submitting revisions, do NOT submit additional 2016 data that were uploaded AFTER the March 31 cutoff date. 

Please contact Terence Ng, CDC/NCIRD/IISSB (contractor) at VFK5@cdc.gov or Lauren Shaw, CDC/NCIRD/IISSB at 

ILV6@cdc.gov to expand on any answers, document an answer you feel is more appropriate than the category 

provided, if the answer to a question is unknown or data are not available, or if you need clarification on a 

question or answer choice.
 

3

CONTACT INFORMATION and SCOPE OF IIS

 

Logic Guidance:

Questions 1–7 are required to be completed by all awardees, including those with IIS in transition or temporarily inactive 

List ONLY government employee contacts in questions 5 and 6. 

 

1. Awardee_______________________

2. Name of IIS_______________________

3. IIS web address (If none, include Immunization Program web address) _______________________ 

4. Name of person(s) submitting this report_______________________

5. Programmatic IIS contact person (a manager or administrator who coordinates IIS activities): 

a. First Name: _______________________ g. City:______________________________

b. Last Name: _______________________ h. State: 

c. Title: ____________________________ i. Zip: _______________________________

d. Affiliation:________________________ j. Phone:________________ k. Ext: _______

e. Address:_________________________ l. Fax:_______________________________

f. Address 2:________________________ m. Email:____________________________

n. Check if contact person for questions about this report

6. Technical IIS Contact Person (coordinator of IIS software and/or hardware) : 

Check if same as programmatic contact (if yes, autopopulate a-m)

a. First Name: _______________________ g. City:______________________________

b. Last Name: _______________________ h. State: 

c. Title: ____________________________ i. Zip: _______________________________

d. Affiliation:________________________ j. Phone:________________ k. Ext: _______

e. Address:_________________________ l. Fax:_______________________________

f. Address 2:________________________ m. Email:____________________________

n. Check if contact person for questions about this report

7. There is no IIS in this state/city/territory. (If yes, block out entire report)

Select

Select
 

4

FUNCTIONAL STANDARD 1: Support the delivery of clinical immunization services at the point of 

immunization administration, regardless of setting

1.1 The IIS provides individual immunization records accessible to authorized users at the point and time 

where immunization services are being delivered.

1.2 The IIS has an automated function that determines vaccines due, past due, or coming due (“vaccine 

forecast”) in a manner consistent with current ACIP recommendations. Any deficiency is visible to the 

clinical user each time an individual’s record is viewed.

1.3 The IIS automatically identifies individuals due/past due for immunization(s), to enable the 

production of reminder/recall notifications from within the IIS itself or from interoperable systems.

1.4 When the IIS receives queries from other health information systems, it can generate an automatic 

response in accordance with interoperability standards endorsed by CDC for message content/format and 

transport.

1.5 The IIS can receive submissions in accordance with interoperability standards endorsed by CDC for 

message content/format and transport.

Logic Guidance: 

• Q10–11: 

o Consider ONLY your system’s capability to use HL7. DO NOT consider flat-file or web-interface 

transactions.

o Consider message exchanges that occurred in CY2016 only. DO NOT consider messages exchanged 

AFTER December 31, 2016. 

o Consider ONLY messages received or sent by your production IIS, NOT a test system.

o Refer to NCIRD’s Implementation Guide for Immunization Data Transactions for more information on 

using Version 2.5.1 of the Health Level Seven (HL7) Standard Protocol 

(http://www.cdc.gov/vaccines/programs/iis/technical-guidance/hl7.html) and to the SOAP 

Implementation Resources, Formal Specification, and Mini-Guide documents for more information on 

SOAP (https://www.cdc.gov/vaccines/programs/iis/technical-guidance/soap/services.html) 

• Q13–14: 

o These questions refer to EHR-IIS interface assessment conducted by the American Immunization 

Registry Association (AIRA) to evaluate SOAP and WSDL transport messaging.

o More information can be found here: http://www.immregistries.org/resources/airainitiatives/assessment

8. In 2016, could users accessing the IIS through the user interface view a vaccination forecast on the same screen as the 

individual’s vaccination record, without having to navigate to other screens in the IIS? Yes / No 

9. In 2016, did your IIS send an immunization forecast to another system via HL7? Yes / No

10. In CY2016 could your IIS send an HL7 v2.5.1 outbound message to another system in production? Yes/No(If No, 

skip table and go to next question)

(If No, skip table and go to next question)
 

5

HL7 v2.5.1 Messages SENT by 

IIS to another system

In CY2016, could your IIS send this 

message type to another system?

In CY2016, did your IIS send this 

message type to another system?

ADT a.  Yes  No b.  Yes  No

RSP c.  Yes  No d.  Yes  No

ACK e.  Yes  No f.  Yes  No

11. In CY2016, could your IIS receive an HL7 v2.5.1 inbound message from another system in production? 

Yes/No (If No, skip table and go to next question)

HL7 v2.5.1 Messages 

RECEIVED by IIS from another 

system

In CY2016, could your IIS receive this 

message type from another system?

In CY2016, did your IIS receive this 

message type from another 

system?

VXU a.  Yes  No b.  Yes  No

ADT c.  Yes  No d.  Yes  No

QBP e.  Yes  No f.  Yes  No

ACK g.  Yes  No h.  Yes  No

12. What protocol do you use to transport data between your IIS and health information systems? Please choose all 

that apply:

o

o

o

o

o

o

o

o

o

ebXML

HTTPS/REST 

sFTP

SOAP/XMLP

Message queuing

Email/SMTP

MLLP

Other 

Does not apply

13. Have you implemented changes to your IIS in response to AIRA’s transport layer assessment? (Select one)

o

o

o

o

o

Yes, we have implemented all recommended message transport changes in our IIS.

Yes, we have implemented some, but not all, of the recommended message transport changes in our IIS.

No, we have not implemented any of the recommended changes in our IIS.

Not applicable. Our participation did not result in any recommended changes for our IIS.

Not applicable. We did not participate in AIRA’s assessment for message transport.

14. If you selected “Yes, we have implemented some, but not all of the recommended message transport changes in 

our IIS” or "No, we have not implemented any of the recommended message transport changes in our IIS” in 

Question 13, what barriers have prevented you from implementing all of the recommended changes? (Check all 

that apply)

The recommended message transport changes are not a current priority for our program.

Additional funds would be necessary to implement recommended message transport changes.

Additional human resource skills (e.g. training, technical assistance) would be necessary to implement 

recommended message transport changes.

Implementation has been planned for a later date. 

 Specify date in box: 
 

6

Other 

Notes for Functional Standard 1 Please provide any relevant notes or comments for data provided for 

Functional Standard 1.
 

7

FUNCTIONAL STANDARD 2: Support the activities and requirements for publicly-purchased vaccine, 

including Vaccines for Children (VFC) and state purchase programs

2.1 The IIS has a vaccine inventory function that tracks and decrements inventory at the provider site 

level according to VFC program requirements. 

2.2 The IIS vaccine inventory function is available to direct data entry users and can interoperate with 

EHR or other inventory systems. 

2.3 The IIS vaccine inventory function automatically decrements as vaccine doses are recorded.

2.4 Eligibility is tracked at the dose level for all doses administered.

2.5 The IIS interfaces with the national vaccine ordering, inventory, and distribution system (currently 

VTrckS).

2.6 The IIS can provide data and/or produce management reports for VFC and other public vaccine 

programs.

Logic Guidance: 

The following questions refer only to functions for publicly-purchased vaccines. 

• Q16 and Q18: Availability of a function refers to the presence of a function, not necessarily the use of that 

function. 

• Q18: Examples of the interaction between the vaccine inventory function and the electronic health record 

(EHR) include but are not limited to automatic decrementing of doses, and the ability to see inventory within 

the EHR.

• Q20: Please see Chapter 5 of the MIROW guide Immunization Information System Collaboration with Vaccines 

For Children Program and Grantee Immunization Programs for more information on the reports at 

http://www.immregistries.org/AIRA-MIROW_IIS-VFC_Best_Practice_Guide_04-14-2011.pdf 

• Q21: Please see Chapter 6 of the MIROW guide MIROW Inventory Management Operations Best Practices for 

more information on the reports at http://www.immregistries.org/AIRA-MIROW-Inventory-Managementbest-practice-guide-06-14-2012.pdf

15. In 2016, did your IIS have a vaccine inventory function that tracked inventory at the provider site level? Yes / No

16. If Yes to #15, was your vaccine inventory function available to direct data entry users? Yes / No

17. If Yes to #16, if an immunization was recorded by a direct entry user, did your inventory function 

automatically decrement that dose from the computerized inventory? Yes / No

18. If Yes to #15, was your vaccine inventory function available to EHR users via HL7 linkage? Yes / No

19. If Yes to #18, if an immunization was reported to the IIS from an EHR, did your inventory function 

automatically decrement that dose from the IIS’s computerized inventory? Yes / No
 

8

20. In 2016, did your IIS produce reports [1], or were the data in your IIS used to produce reports, that 

supported the process of (check all that apply):

a. Producing estimates for the number of vaccines that will be administered to specified age 

groups by individual VFC provider organizations during the upcoming year 

b. Producing estimates for the aggregated total of the number of vaccines that will be 

administered to specified age groups by all VFC provider organizations in your jurisdiction 

during the upcoming year 

c. Detailing vaccine doses administered by individual VFC provider organizations

[1] From MIROW guide Immunization Information System Collaboration with Vaccines For 

Children Program and Grantee Immunization Programs, 

http://www.immregistries.org/AIRA-MIROW_IIS-VFC_Best_Practice_Guide_04-14-

2011.pdf

21. In 2016, did your IIS produce reports [2], or were data in the IIS used to produce reports that supported vaccine 

inventory management including (check all that apply):

a. Accountability reports to support inventory management (for purposes other than ordering and 

reconciliation)

b. Reconciliation reports 

c. Accountability reports for ordering (reports that support the ordering process)

[2] From MIROW Immunization Information System Inventory Management Operations, 

http://www.immregistries.org/AIRA-MIROW-Inventory-Management-best-practice-guide06-14-2012.pdf

22. In 2016, did your IIS maintain a list of vaccines available for ordering by uploading the current Federal Vaccines 

List? Yes / No

23. In 2016, did your IIS use VTrckS shipment data to (check all that apply): 

a. Notify provider organizations of vaccine inventory in transit

b. Allow provider organizations to acknowledge receipt of vaccine,

c. Transfer doses to available inventory at the provider organization level

24. In 2016, could provider organization staff print a shipping manifest (along with VTrckS return tracking number, 

which is available in the returns mapping file) from the IIS to accompany vaccines returned to the distributor?

Yes/No

Notes for Functional Standard 2 Please provide any relevant notes or comments for data provided for 

Functional Standard 2.
 

9

FUNCTIONAL STANDARD 3: Maintain data quality (accurate, complete, timely data) on all immunization and 

demographic information in the IIS

3.1 The IIS provides consolidated demographic and immunization records for persons of all ages in its 

geopolitical area, except where prohibited by law, regulation, or policy.

3.2 The IIS can regularly evaluate incoming and existing patient records to identify, prevent, and resolve 

duplicate and fragmented records.

3.3 The IIS can regularly evaluate incoming and existing immunization information to identify, prevent, 

and resolve duplicate vaccination events.

3.4 The IIS can store all IIS Core Data Elements.

3.5 The IIS can establish a record in a timely manner from sources such as Vital Records for each 

newborn child born and residing at the date of birth in its geopolitical area.

3.6 The IIS records and makes available all submitted vaccination and/or demographic information in a 

timely manner. 

3.7 The IIS documents active/inactive status of individuals at both the provider organization/site and 

geographic levels.

Age groups

25. Which age groups are included in your IIS? Select one: 

a. Birth through 59 months of age

b. Birth through 18 years of age

c. All ages, including adults

d. Other (specify)______________

Logic Guidance: 

• For Q27–28, include:

Children known to have been born in and residing in the state/city on the date of birth.

Children known to have been born in the state/city, whose state/city of residence on the date of birth 

is unknown but who currently are known to reside in your jurisdiction.

Children known to have been residing in the state/city on the date of birth but whose state of birth is 

unknown.

Children whose state/city of birth and state/city of residence on the date of birth are both unknown 

but who currently are known to reside in your jurisdiction.

If a patient record comes to the IIS through other birth record sources, but is later verified by Vital 

Records, consider the patient record to have come from Vital Records.

If a patient record comes to the IIS through other birth record sources ONLY, consider the patient 

record to have come from other record sources.

• Exclude: 

Children who are known to have been born outside the state/city.

Children known to have been residing outside of the jurisdiction on the date of birth.

o

o

o

o

o

o

o

o
 

10

Birth population capture

26. Number of children in the geopolitical area born from January 1 through December 31, 2016 (2016 Census Data)

27. Number of patient records created in your IIS for children born and residing in your geopolitical area and born 

from January 1 through December 31, 2016 from Vital Records _____________

28. Number of patient records created in your IIS for children born and residing in your geopolitical area and born 

from January 1 through December 31, 2016 from sources other than Vital Records _______________

a. Proportion of children in the IIS born from January 1 through December 31, 2016 with records created in 

the IIS from Vital Records (Q27/Q26)

b. Proportion of children in the IIS born from January 1 through December 31, 2016 with records created in 

the IIS from all sources (Q27+Q28 / Q26)
 

11

Child Participation in IIS (aged 4 months through 5 years) 

Logic Guidance: 

• For children born from January 1, 2011 through August 31, 2016. 

Enrollment:

• Include:

o Children enrolled in the IIS, regardless of having only travel vaccines, only non-vaccine products, or no 

vaccines in the vaccine record.

• Exclude:

Children with addresses outside of your state or geopolitical area. Geopolitical area is defined as the area 

that contains the population of children residing in the geopolitical location covered by the IIS.

INACTIVE children in the IIS. Children are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

Demographic records belonging to those with only an H1N1 vaccination record.

Participation:

• Include:

All doses (valid and invalid) administered before January 1, 2017, including those recorded in the IIS after 

December 31, 2016. 

• Exclude:

Children with addresses outside of your state or geopolitical area. Geopolitical area is defined as the area 

that contains the population of children residing in the geopolitical location covered by the IIS.

INACTIVE children in IIS. Children are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

Demographic records belonging to those with only an H1N1 vaccination record.

H1N1 vaccines administered

Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbook-home 

Non-vaccine products (e.g. immune globulins, PPD) 

29. Number of children aged 4 months through 5 years in the geopolitical area (2016 Census Data)

30. Child enrollment: Number of children aged 4 months through 5 years (born from January 1, 2011 through Aug 

31, 2016) in both in your geopolitical area AND in your IIS__________

a. Proportion of children aged 4 months through 5 years in both your geopolitical area AND in your IIS 

(Q30/Q29)

31. Child participation: Number of children in question 30 (children born from January 1, 2011 through Aug 31, 2016

that are both in your geopolitical area AND in your IIS) that have 2 or more immunizations recorded in your IIS 

(Healthy People 2020 objective) __________

a. Proportion of children aged 4 months through 5 years in your geopolitical area and IIS that have 2 or 

more immunizations recorded in your IIS (Q31/29)

o

o

o

o

o

o

o

o

o

o
 

12

Adolescent Participation in IIS (aged 11 through 17 years)

Logic Guidance — Adolescent participation in IIS

• Skip this section if you answered 'a' on question 25. 

• For adolescents born from January 1, 1999 through December 31, 2005

Enrollment:

• Include:

o Adolescents enrolled in the IIS, regardless of having only travel vaccines, only non-vaccine products, or no 

vaccines in the vaccine record.

• Exclude:

o Adolescents with addresses outside of your state or geopolitical area. Geopolitical area is defined as the 

area that contains the population of adolescents residing in the geopolitical location covered by the IIS.

o INACTIVE adolescents in IIS. Adolescents are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

o Demographic records belonging to those with only an H1N1 vaccination record.

Participation:

• Include:

All doses (valid and invalid) administered before January 1, 2017, including those recorded in the IIS after 

December 31, 2016. 

Adolescent doses ONLY if they were administered from age 9 through 17 years. Only include: Tdap/Td, 

HPV, meningococcal, seasonal influenza, pneumococcal, HepA, HepB, polio, MMR, and varicella. 

(http://www.cdc.gov/vaccines/schedules/hcp/child-adolescent.html#printable) 

• Exclude:

Doses administered to adolescents before the child’s 9th birthday.

Adolescents with addresses outside of your state or geopolitical area. Geopolitical area is defined as the 

area that contains the population of adolescents residing in the geopolitical location covered by the IIS.

INACTIVE adolescents in IIS. Adolescents are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

Demographic records belonging to those with only an H1N1 vaccination record.

H1N1 vaccines administered

Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbook-home

Non-vaccine products (e.g. immune globulins, PPD)

32. Number of adolescents aged 11 through 17 years in your geopolitical area (2016 Census Data) 

33. How many adolescents aged 11 through 17 years (born from January 1, 1999 through December 31, 2005) are 

both in your geopolitical area AND in your IIS? ______________

a. Adolescent enrollment: Proportion of adolescents aged 11 through 17 years that are both in your 

geopolitical area AND in your IIS (Q33/Q32) 

34. How many adolescents in question 33 (adolescents born from January 1, 1999 through December 31, 2005 that 

are both in your geopolitical area AND in your IIS) have 2 or more adolescent immunizations administered from 

age 9 through 17 years recorded in your IIS? (Healthy People 2020 objective) ______________

o

o

o

o

o

o

o

o

o
 

 

13

a. Adolescent participation: Proportion of adolescents aged 11 through 17 years in your geopolitical area

and IIS that have 2 or more adolescent immunizations recorded in your IIS (Q34/Q32)
 

14

Adult Participation in IIS (aged 19 years and older) 

Logic Guidance — Adult Participation in IIS

• Skip this section if you answered 'a' or 'b' on question 25.

• For adults born on or before December 31, 1997

Enrollment:

• Include:

Adults enrolled in the IIS, regardless of having only travel vaccines, only non-vaccine products, or no 

vaccines in the vaccine record.

• Exclude:

Adults with addresses outside of your state or geopolitical area. Geopolitical area is defined as the 

area that contains the population of adults residing in the geopolitical location covered by the IIS.

INACTIVE adolescents in IIS. Adolescents are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

Demographic records belonging to those with only an H1N1 vaccination record.

Participation:

• Include:

All doses (valid and invalid) administered before January 1, 2017, including those recorded in the IIS 

after December 31, 2016. 

Adult doses ONLY if they were administered from age 19 years and older. Only include: seasonal 

influenza, Tdap/Td, varicella, HPV, zoster, MMR, pneumococcal, meningococcal, HepA, and HepB 

http://www.cdc.gov/vaccines/schedules/downloads/adult/adult-schedule.pdf 

• Exclude:

Doses administered before 19 years of age.

Adults with addresses outside of your state or geopolitical area. Geopolitical Area is defined as the 

area that contains the population of adults residing in the geopolitical location covered by the IIS.

INACTIVE adults. Adults are considered inactive for this report if they are (1) inactive permanently, or 

(2) have moved or gone elsewhere from the geopolitical area covered by the IIS. 

Demographic records belonging to those with only an H1N1 vaccination record.

H1N1 vaccines administered

Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbookhome 

Non-vaccine products (e.g. immune globulins, PPD)

35. Number of adults aged 19 years and older in your geopolitical area (2016 Census Data) 

36. How many adults aged 19 years and older (born on or before December 31, 1997) are both in your geopolitical 

area AND in your IIS? 

a. Adult enrollment: Proportion of adults aged 19 years and older that are both in your geopolitical area 

AND in your IIS (Q36/Q35)

o

o

o

o

o

o

o

o

o

o

o

o

o
 

15

37. How many adults in question 36 (born on or before December 31, 1997 who are both in your geopolitical area 

AND in your IIS) have 1 or more adult immunization(s) administered at 19 years and older recorded in your 

IIS?_____________

a. Adult participation: proportion of adults aged 19 years and older in your geopolitical area and IIS that 

have 1 or more adult immunization(s) recorded in your IIS (Q37/Q35)
 

16

Provider Site Participation

Logic Guidance 

• Immunization Site: A service delivery location (public or private) that maintains permanent records (excluding 

temporary or mobile immunization clinics, health fairs, etc.). 

• Public Provider Immunization Site: an immunization site funded by a governmental agency directly; a unit of 

government is responsible for managing operations.

• Private Provider Immunization Site: an immunization site funded privately and or indirectly by a 

governmental agency (e.g., CMS); a non-governmental unit is responsible for managing operations.

• Include:

 All provider sites enrolled in your IIS, regardless of age group served by those sites or your IIS. 

 All provider sites enrolled in the IIS as of December 31, 2016. 

• Exclude:

Provider sites that only enrolled to provide emergency vaccines such as during pandemic response 

scenarios. (e.g., exclude a community center that only enrolled due to the 2010 H1N1 influenza pandemic and 

does not provide other immunizations. However, include a pediatrician that enrolled due to the 2010 H1N1 

influenza pandemic if they also continue to provide routine immunizations.)

Examples of Public Provider Sites Examples of Private Provider Sites

Public health department operated clinic Private practice (solo, group, or HMO)

Public health department clinic as agent for 

FQHC/RHC

Private practice (solo or group) as agent 

for FQHC/RHC

Public hospital Private hospital

FQHC/RHC (community, migrant, or rural) Special vaccine clinics, e.g. flu clinics

Community health center Pharmacy

Tribal or Indian Health Service clinic Other private health facility

WIC

STD/HIV

Family planning

Juvenile detention center

Correctional facility (all ages)

Drug treatment facility

Military health care facility

NOTE: Examples are not mutually exclusive. For example, correctional facilities/drug treatment facilities/Community 

Health Centers/family planning clinics/etc. can be either public or private depending on funding source.

PUBLIC Provider Sites

VFC Sites Non-VFC Sites

38. Number of public provider sites in your geopolitical area enrolled in your

IIS as of December 31, 2016

a. b.

39. Number of enrolled public provider sites reporting data to your IIS at least 

once from July 1, 2016–December 31, 2016

a. b.

PRIVATE Provider Sites

VFC Sites Non-VFC Sites

40. Number of private provider sites in your geopolitical area enrolled in 

your IIS as of December 31, 2016

a. b.
 

17

41. Number of enrolled private provider sites reporting data to your IIS at 

least once from Jul 1, 2016 – December 31, 2016

a. b.

4:3:1:3:3:1:4 Series Coverage (for children aged 19 through 35 months) 

Logic Guidance:

• Coverage is defined as the number of individuals in a certain age group who received an immunization(s)

divided by the Census-based estimate of persons in that age group in your geopolitical area.

• For children born from January 1, 2014 through May 31, 2015. 

• Doses administered before January 1, 2017, including those recorded after December 31, 2016.

• The 4:3:1:3:3:1:4 series includes 4 or more DTaP/DTP/DT, 3 or more Polio, 1 or more MMR, 3 or more Hepatitis 

B, ≥3 or ≥4 of Hib*, 1 or more Varicella†, and 4 or more pneumococcal containing vaccine).

*When calculating Hib doses, include children who received 4+ Hib-containing vaccine doses (includes any 

type of Hib vaccine, including Hib, unspecified formulation) or 2 Hib-OMP doses (manufactured by Merck; 

includes PedVaxHib and Comvax) followed by ≥1 Hib dose of any type. 

Valid Doses: 

• Include: 

Doses that were administered according to ACIP routine recommendations that meet criteria to satisfy 

requirements for series completion.

† When counting Varicella, INCLUDE those with history of disease.

• Exclude:

Exclude doses administered that are considered valid according to ACIP recommendations BUT that do 

not contribute to series completion (e.g. doses administered for increased/high risk conditions). 

Example: A valid MMR dose administered to a 6 month old prior to international travel does not 

contribute to the childhood standard measles, mumps, rubella series — another MMR dose would still 

be needed at 12 months. The 6 month dose would not be included when calculating the 4:3:1:3:3:1:4 

series. 

All Doses: 

• Include:

Both valid and invalid doses.

† When counting Varicella, EXCLUDE those with history of disease.

For Both Columns (Valid and All Doses):

• Exclude: 

Children with addresses outside of your state or geopolitical area. Geopolitical area is defined as the 

area that contains the population of children residing in the geopolitical location covered by the IIS.

INACTIVE children in IIS. Children are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

Valid 

doses 

All 

doses

42. Number of children aged 19 through 35 months in your geopolitical area (2016 Census Data) -- --

o

o

o

o

o

o

o
 

18

43. How many children born during January 1, 2014 through May 31, 2015 that are in your 

geopolitical area have received the complete 4:3:1:3:3:1:4 series? 

 a. Coverage – proportion of children aged 19 through 35 months in the 

population that have completed the 4:3:1:3:3:1:4 series (Q43/Q42)

-- --
 

19

Adolescent Immunization Coverage (for adolescents aged 13 through 17 years) 

Logic Guidance — Adolescent Immunization Coverage in IIS

• Skip this section if you answered 'a' on question 25. 

• For adolescents born from January 1, 1999 through December 31, 2003

• Coverage is defined as the number of individuals in a certain age group who received an immunization(s) divided 

by the census-based estimate of persons in that age group in your geopolitical area.

Valid Doses

• Include:

Doses that were administered according to ACIP routine recommendations that meet criteria to satisfy 

requirements for series completion.

Doses administered before January 1, 2017, including those recorded after December 31, 2016. 

Valid ACIP recommended adolescent doses administered at any time before the child’s 18th birthday 

• Exclude:

Doses administered that are considered valid according to ACIP recommendations BUT that do not

contribute to series completion (e.g. doses administered for increased/high risk conditions). 

All Doses (Valid and Invalid)

• Include:

Doses administered before January 1, 2017, including those recorded after December 31, 2016. 

All ACIP recommended adolescent doses administered at any time before the child’s 18th birthday

For Both Columns (Valid and All Doses)

• Exclude:

Adolescents with addresses outside of your state or geopolitical area. Geopolitical area is defined as the 

area that contains the population of children residing in the geopolitical location covered by the IIS.

INACTIVE adolescents in IIS. Adolescents are considered inactive for this report if they are (1) inactive 

permanently, or (2) have moved or gone elsewhere at a jurisdictional level.

44. Number of adolescents aged 13 through 17 years in your geopolitical area (2016 Census 

Data)

--

Valid 

doses 

All 

doses

45. How many adolescents aged 13 through 17 years (born from January 1, 1999 through 

December 31, 2003) that are both in your geopolitical area AND in your IIS have at least one 

dose of Tdap/Td?

a. Coverage — Proportion of adolescents aged 13 through 17 years in the population that 

have at least one dose of Tdap/Td. (Q45/Q44)

-- --

46. How many adolescent FEMALES aged 13 through 17 years are in your geopolitical area? (2016 

Census Data)

--

47. How many adolescent FEMALES aged 13 through 17 years (born from January 1, 1999 through 

December 31, 2003) that are both in your geopolitical area AND in your IIS have at least 3 

doses of HPV?

a. Coverage — Proportion of adolescent FEMALES aged 13 through 17 years in the 

population that have at least 3 doses of HPV (Q47/Q46)

-- --

o

o

o

o

o

o

o

o
 

20

48. How many adolescent MALES aged 13 through 17 years are in your geopolitical area? (2016 

Census Data)

--

49. How many adolescent MALES aged 13 through 17 years (born from January 1, 1999 through 

December 31, 2003) that are both in your geopolitical area AND in your IIS have at least 3 

doses of HPV?

a. Coverage — Proportion of adolescent MALES aged 13 through 17 years in the population 

that have at least 3 doses of HPV (Q49/Q48)

-- --

Core Data Elements—Patient Records

Logic Guidance: Core Data Elements – Patient Records

• Please fill in the following on each core data element field included in your IIS database.

• For children with date of birth from January 1 through December 31, 2016. 

• Exclude:

o Children who are known to have been born outside the state/city.

o Children known to have been residing outside of the jurisdiction on the date of birth.

o Children with addresses outside of your state or geopolitical area. Geopolitical area is defined as the area 

that contains the population of children residing in the geopolitical location covered by the IIS. 

o INACTIVE children in IIS. Children are considered inactive for this report if they are (1) inactive permanently, 

or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

o H1N1 vaccines administered and demographic records belonging to those with only an H1N1 vaccination 

record.

o Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbook-home 

o Non-vaccine products (e.g. immune globulins, PPD)

50. Based on the exclusion criteria above, what is the number of patient records in the IIS for all children with date 

of birth from January 1, 2016 through December 31, 2016? _____________________________

Patient-level core data elements Field Status (check one)

Number of child records with date 

of birth from January 1 through 

December 31, 2016, with field 

populated with data

Percentage of child records 

with date of birth from 

January 1 through

December 31, 2016 with 

field populated with data. 

Denominator from Q50 

(auto-calculated)

51. Patient ID

(e.g., can be the IIS ID, or other 

type)

a.  Field present  No field 

52. Patient ID — Assigning 

Authority (i.e., owning source)

(e.g., could be the IIS, or other)

a.  Field present  No field 

53. Patient ID — Type (e.g. 

medical record number, IIS ID) a.  Field present  No field 
21

54. Patient Name

Logic guidance: Consider Middle 

Name to be populated if the field is 

populated with the patient’s 

middle initial.

a. First Name 

 Field present  No field

b. Middle Name 

 Field present  No field

c. Last Name 

 Field present  No field

d. #

e. #

f. #

g. Q54/(Q50)

h. –

i. --

55. Patient Alias Name

a. First Name 

 Field present  No field

b. Middle Name 

 Field present  No field

c. Last Name 

 Field present  No field

56. Patient Date of Birth a.  Field present  No field b. # c. --

57. Patient Gender a.  Field present  No field b. # c. --

58. Patient Multiple Birth Indicator a.  Field present  No field

59. Patient Birth Order a.  Field present  No field

60. Responsible Person Name

Logic guidance: if there is more than 

one responsible person name in 

your IIS, only include one person per 

child record. Examples of 

responsible persons include 

guardian, adoptive or foster parent

Consider Middle Name to be 

populated if the field is populated 

with the responsible person’s 

middle initial.

a. First Name 

 Field present  No field

b. Middle Name 

 Field present  No field

c. Last Name 

 Field present  No field

d. Relationship to patient 

 Field present  No field

e. # Responsible Person First Name 

f. # Responsible Person Middle 

Name 

g. # Responsible Person Last Name

h. # Responsible Person 

Relationship

i.—

j.—

k.—

l.—

61. Mother’s Name

Logic guidance: Consider Middle 

Name to be populated if the field is 

populated with the mother’s middle 

initial.

a. First Name 

 Field present  No field

b. Middle Name 

 Field present  No field

c. Last Name 

 Field present  No field

d. Maiden Last Name 

 Field present  No field

e. # Mother’s First Name 

f. # Mother’s Middle Name 

g. # Mother’s Last Name

h. # Mother’s Maiden Name

i.—

j.—

k.—

l.—

62. Address (Street, City, State, 

Country, Zip, County)

Logic guidance: if there is more than 

one address listed per child, only 

include one per child record

a. Street: Field present  No field

b. City:  Field present  No field

c. State:  Field present  No field

d. Country: Field present  No 

field

e. Zip:  Field present  No field

f. County: Field present  No 

field

g. # Street

h. # City

i. # State

j. # Country

k. # Zip code

l. # County

m. –

n. –

o. –

p. –

q.—

r. –
22

63. Race a.  Field present  No field b. # c. --

64. Ethnicity

• Hispanic or Latino [A person of 

Cuban, Mexican, Puerto Rican, 

South or Central American, or other 

Spanish culture or origin, regardless 

of race] 

• Not Hispanic or Latino

a.  Field present  No field b. # d. --

65. Birthing Facility Name a.  Field present  No field

66. Patient Birth state a.  Field present  No field

67. Patient Primary Language

Logic guidance: refers to the 

language listed for either the 

patient or the parent/responsible 

person

a.  Field present  No field

68. Patient Telephone Number 

Logic guidance: refers to the 

telephone number of either the 

patient or the parent/responsible 

person

a.  Field present  No field b. # c.--

69. Phone Number Type (e.g. 

home, cell) a.  Field present  No field --

70. Patient E-mail address

Logic guidance: refers to the 

language of either the patient or the 

parent/responsible person

a.  Field present  No field b. # c.--

71. Patient status indicators: 

Definition: A field to denote the 

status of a patient. 

Examples: 

• Active

• Inactive

• Inactive – Lost to follow-up 

(cannot contact)

• Inactive – Moved or gone 

elsewhere (transferred)

• Inactive – Permanently inactive 

(deceased)

NOTE: If the patient has more than 

one patient status indicator in your 

IIS (e.g. for multiple provider sites), 

include the patient in the numerator 

if they have at least one active or 

inactive status indicated in their 

record.

a. Provider facility level: 

 Field present  No field 

b. IIS (Jurisdictional) level: 

 Field present  No field

c. Provider level #

d. Jurisdictional level #

e. –

f. --

72. History of Vaccine Preventable 

Disease (e.g., varicella) a.  Field present  No field --
 

23

73. Date of History of Vaccine 

Preventable Disease a.  Field present  No field --
 

24

Core Data Elements — Vaccination Records

Logic Guidance: Core Data Elements — Vaccination Records

• Please fill in the following on each core data element field included in your IIS database.

• These questions pertain to all vaccinations administered to from January 1, 2016 through December 31, 2016, for 

persons of all ages. 

• Exclude:

Persons with addresses outside of your state or geopolitical area. Geopolitical area is defined as the area 

that contains the population of children residing in the geopolitical location covered by the IIS.

INACTIVE persons in IIS. Persons are considered inactive for this report if they are (1) inactive permanently, 

or (2) have moved or gone elsewhere from the geopolitical area covered by the IIS.

H1N1 vaccines administered and demographic records belonging to those with only an H1N1 vaccination 

record.

Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbook-home 

Historical vaccinations

Non-vaccine products (e.g. immune globulins, PPD)

74. What is the number of vaccination records in the IIS for vaccines administered to all children, adolescents and 

adults in the IIS from January 1, 2016 through December 31, 2016? _________________________

Vaccination core data elements Field Status (check one)

Number of vaccination records with 

vaccine date of administration from 

January 1 through December 31, 

2016, for persons of all ages, with 

field populated with data

Percentage of 

vaccination records 

with vaccine date of 

administration from 

January 1 through

December 31, 2016 

with field populated 

with data. 

Denominator from 

Q74 (autocalculated)

75. Vaccine Product Type Administered a.  Field present  No field b. # c.--

76. Vaccination Administration Date a.  Field present  No field b. # c.--

77. Vaccine Manufacturer Name a.  Field present  No field b. # c.--

78. Vaccine Lot Number a.  Field present  No field b. # c.--

79. Vaccine Expiration Date a.  Field present  No field b. # c.--

80. Vaccine Dose Volume

Note: 

• If the IIS captures actual dose volume (ex. 

“0.5 mL”), answer “Field present”

• If the IIS captures actual dose volume (ex. 

“0.5 mL”) and also uses a generic dose 

system (ex. “full” or “half”), answer “Field 

present”

• If IIS captures actual dose volume (ex. “0.5 

mL”) BUT only captures it outside the IIS 

(such as in a reference table), answer “No 

field”

a.  Field present  No field

o

o

o

o

o

o
 

25

• If IIS ONLY uses a generic dose system (ex. 

“full” or “half”, but does NOT capture actual 

dose volume (ex. ““0.5 mL””), answer “No 

field”

81. Vaccine Dose Unit

Definition: The actual unit of measurement. Ex: 

“mL”

a.  Field present  No field

82. Vaccine Site of Administration a.  Field present  No field b. # c.--

83. Vaccine Route of Administration a.  Field present  No field b. # c.--

84. Vaccine Ordering Provider Name a.  Field present  No field b. # c.--

85. Vaccine Administering Provider Name a.  Field present  No field b. # c.--

86. Vaccine Administering Provider Suffix (e.g. 

MD, RN, LPN) a.  Field present  No field

87. Vaccination Event Information Source (i.e. 

administered or historical) a.  Field present  No field

88. VIS Type a.  Field present  No field b. # c.--

89. VIS Publication Date a.  Field present  No field b. # c.--

90. VIS Date Given to Patient a.  Field present  No field b. # c.--

91. Contraindication(s) / Precaution(s) a.  Field present  No field

92. Contraindication(s) / Precaution(s) 

Observation Date(s) a.  Field present  No field

93. Exemption(s) / Parent Refusal(s) of Vaccine a.  Field present  No field

94. Date of Exemption(s) / Parent Refusal(s) of 

Vaccine a.  Field present  No field

95. Vaccine Reaction(s) a.  Field present  No field
 

26

Vaccination core data element for VFC/awardee program vaccine eligibility at the dose level

Logic Guidance: Vaccination core data element for VFC/awardee program vaccine eligibility at the dose level

• If VFC/awardee program vaccine eligibility is stored in the IIS at the dose level (i.e. a VFC/awardee program 

vaccine eligibility status is assigned to and stored for every administered dose recorded in the IIS), answer 

‘field present’ and complete questions b,c, e and f. This is true if the eligibility status is collected and stored 

by the IIS for each uniquely administered dose, or if eligibility is collected at the vaccination event/visit level 

(i.e. for all vaccinations administered during a single vaccination event) and is translated by the IIS to the dose 

level (e.g. the eligibility status for the event is recorded as VFC-Medicaid and the IIS assigns this status to a 

vaccination record indicating DTaP administered during the visit but not to a vaccination record indicating 

yellow fever vaccine administered during the same visit). If VFC / awardee program eligibility is stored in the 

IIS at the vaccination event/visit level and not translated by the IIS to each unique administered dose, answer 

‘no field’ present.

• For this question only, please limit to doses administered from January 1 through December 31, 2016 to 0–18 

year olds (date of birth January 1, 1998 through December 31, 2016) as only this age group is eligible for VFC.

• Provider is counted as VFC provider if enrolled as such during the entire calendar year

• Exclude historical doses

Vaccination core data element Field status 

(check one) VFC providers only Non-VFC providers only

96. VFC/Awardee Program 

Vaccine Eligibility at Dose 

Level

Examples: 

• Not VFC eligible

• VFC eligible — Medicaid

• VFC eligible — Uninsured

• VFC eligible — American 

Indian/Alaskan Native

• VFC eligible — Underinsured 

(FQHC/RHC/Provider with 

delegated authority)

• VFC eligible — State- or 

Local-specific eligibility

• Eligible for a non-VFC 

funding source (e.g., state or 

locally defined)

a.  Field 

present 

 No field

b. # numerator (number of 

vaccination records with 

vaccine date of 

administration from January 1 

through December 31, 2016, 

administered to persons aged 

0 through 18 years (DOB 

January 1, 1998 through 

December 31, 2016), by VFC 

providers only with this field 

populated with data) 

c. # denominator (number of 

vaccination records 

administered to persons aged 

0 through 18 years (DOB 

January 1, 1998 through 

December, 31, 2016) by VFC 

providers only in the IIS in

2016) 

d. percent 

vaccination 

records with 

vaccine date of 

administration 

from January 1 

through 

December 31, 

2016 

administered 

to persons 

aged 0 through 

18 years with 

field populated 

with data 

(Q96b/c)

e. # numerator (number of 

vaccination records with 

vaccine date of 

administration from 

January 1 through 

December 31, 2016, 

administered to persons 

aged 0 through 18 years 

(DOB January 1, 1998 

through December 31, 

2016), by non-VFC 

providers only with this 

field populated with data) 

f. # denominator (number 

of vaccination records 

administered to persons 

aged 0 through 18 years 

(DOB January 1, 1998 

through December 31, 

2016) by non-VFC providers 

only in the IIS in 2016)

g. percent 

vaccination 

records with 

vaccine date 

of 

administrati

on from 

January 1, 

2016 

through 

December 

31, 2016 for 

persons 

aged 0 

through 18 

years with 

field 

populated 

with data 

(Q96e/f) 
 

27

Timeliness of birth records in IIS

Logic Guidance

• Other birth record source includes birthing hospitals, perinatal or newborn screening programs.

• Day 0 refers to the date of birth.

• Days listed refer to calendar days.

• Columns a and b are mutually exclusive.

• Include:

Records that were reported after December 31, 2016 for CY2016 births born in the catchment area.

Children born from January 1 through December 31, 2016. 

When determining whether a record was established by Vital Records or other birth record sources, 

consider which source the birth record was established by FIRST. Therefore, regardless of whether a 

birth record is later established by Vital Records, if it was first established by Other Record sources, 

consider it established by Other Record Sources. Only consider a record established by Vital Records if 

it was established in the IIS by Vital Records FIRST.

• Exclude: 

Children who are known to have been born outside the state/city

Children known to have been residing outside of the jurisdiction at the date of birth. 

INACTIVE children in IIS. Children are considered inactive for the purposes of this reporting if they are 

(1) inactive permanently, or (2) have moved or gone elsewhere at a jurisdictional level.

97. For children born January 1, 2016–December 31, 2016 born and residing in the IIS’s geopolitical area , what 

number had a record established in the IIS within the following days after birth:

a. Number of 

children with 

record 

established 

from vital 

records

b. Number of 

children with 

record 

established from 

sources other 

than vital 

records

Percentage of 

children with 

records 

established in

the specified 

timeframe (autocalculated)

≤1 day a. b. c. (a+b)/(s+t)

>1 day - ≤7 days d. e. f. (d+e)/(s+t)

>7 days - ≤14 days g. h. i. (g+h)/(s+t)

>14 days - ≤30 days j. k. l. (j+k)/(s+t)

>30 days - ≤45 days m. n. o. (m+n)/(s+t)

>45 days p. q. r. (p+q)/(s+t)

Total (auto-calculated) s.-- t.--

o

o

o

o

o

o
 

28

Timeliness of vaccination records in IIS

Logic Guidance

• Age at which vaccine is administered should be determined by the date of vaccine administration during 

CY2016. 

• A person who receives a vaccination in more than one of the age groups listed below will be counted in more 

than one category. For example, an 18 year old who receives a vaccination at age 18 years, then turns 19 

years old during CY2016 and has another vaccination at age 19 years, will be counted in both columns.

• Timeframes listed refer to calendar days.

• Include:

o

o

o

o

o

o

o

o

Doses that were reported after December 31, 2016 but administered during CY2016. 

Vaccinations administered in CY2016 for all persons in the IIS

All doses (valid and invalid)

• Exclude: 

o INACTIVE persons in IIS. Persons are considered inactive for the purposes of this reporting if they are 

(1) inactive permanently, or (2) have moved or gone elsewhere at a jurisdictional level.

Persons with addresses outside of your state or geopolitical area. Geopolitical Area is defined as the 

area that contains the population of people residing in the geopolitical location covered by the IIS.

H1N1 vaccines administered and demographic records belonging to those with only an H1N1 

vaccination record. 

Travel vaccines (yellow fever, typhoid, etc.) See: http://wwwnc.cdc.gov/travel/page/yellowbookhome-2016 

Historical records

Non vaccine products

98. For vaccinations administered in CY2016 to all persons in the IIS, list the number of vaccine doses reported to 

the IIS within the following time frames:

Number of vaccine 

doses administered to 

children and 

adolescents aged 0 

through 18 years (i.e. 

non-historical) during 

CY2016

Number of 

vaccine doses 

administered 

to adults aged 

19 years and 

older (i.e. nonhistorical)

during CY2016

Percentage of doses 

reported for 

persons aged 0 

through 18 years 

for the specified 

timeframe (autocalculated)

Percentage of doses 

reported for adults 

aged 19 years and 

older for the 

specified timeframe 

(auto-calculated)

≤1 day A B M (A/K) N (B/L)

>1 day–≤7 

days

C D O (C/K) P (D/L)

>7 days–≤14 

days

E F Q (E/K) R (F/L)

>14 days–≤30 

days

G H S (G/K) T (H/L)

>30 days I J U (I/K) V (J/L)
 

29

Total (autocalculated)K L

Notes for Functional Standard 3 Please provide any relevant notes or comments for data provided for 

Functional Standard 3.

Functional Standard 4: Preserve the integrity, security, availability and privacy of all personally-identifiable 

health and demographic data in the IIS
 

30

Functional Standard 4: Preserve the integrity, security, availability and privacy of all personally-identifiable 

health and demographic data in the IIS

4.1 The IIS program has written confidentiality and privacy practices and policies based on applicable 

law or regulation that protect all individuals whose data are contained in the system. 

4.2 The IIS has user access controls and logging, including distinct credentials for each user, leastprivilege access, and routine maintenance of access privileges.

4.3 The IIS is operated or hosted on secure hardware and software in accordance with industry 

standards for protected health information, including standards for security/encryption, uptime and 

disaster recovery. 

99. Have the IIS's written confidentiality and privacy policies been reviewed by the health department counsel or 

other appropriate authority? Yes/No

100. Must all IIS users affirmatively assent to the confidentiality and privacy policies before being granted access to 

the IIS? Yes/No

101. Does every individual who accesses the IIS through the user interface (UI) have unique log-in credentials (i.e. 

credentials are not shared by multiple IIS users, even within a provider organization)? Yes/No

102. Does every provider organization/other IIS user that accesses the IIS electronically (e.g. HL7, flat file) have 

unique site-level credentials? 

103. Does the IIS currently tier access to the system according to defined user roles, and grant access to each 

individual user according to their mutually agreed upon role? Yes/No

104. Can the IIS audit any of the following, including the date, time and IIS user who took the action? (Check all that 

apply)

a. Creation of an IIS record

b. Viewing of an IIS record

c. Editing of an IIS record

105. Are individual- and organization-level access privileges reviewed at least annually to deactivate users that are 

no longer authorized to access the IIS? Yes/No

106. Is personally identifiable information (PII)/protected health information (PHI) encrypted at-rest (i.e. on the disk) 

and on-the-fly (i.e. in transit between the server and user)? Yes/No

107. Does the IIS have a written agreement with provider organizations/other IIS users on the level of uptime 

expected/required, and time-to-recovery for system failure? Yes/No

108. Does the IIS have a written agreement with the IT office/vendor that supports the IIS on the level of uptime 

expected/required, and time-to-recovery for system failure? Yes/No
 

31

109. Is data backup implemented according to a written policy and schedule? Yes/No

110. Is data backup implemented with routine (at least annual) testing to validate that the data can be restored 

from backups? Yes/No

111. Does that IIS have a disaster recovery plan established for a full recovery from catastrophic failure (i.e. loss of 

hardware, software, and data) (“bare metal restore” plan), which identifies required equipment and procedures 

and agrees on a maximum allowable downtime/time-to-restore? Yes/No

112. Is the hardware/data center secured with physical access controls and power management? Yes/No

Notes for Functional Standard 4 Please provide any relevant notes or comments for data provided for 

Functional Standard 4.
 

32

Functional Standard 5: Provide immunization information to all authorized stakeholders

5.1 The IIS can provide immunization data access to healthcare providers, public health, and other 

authorized stakeholders (e.g., schools, public programs, payers) according to law, regulation or policy.

5.2 The IIS can generate predefined and/or ad hoc reports (e.g., immunization coverage, vaccine usage, 

and other important indicators by geographic, demographic, provider, or provider groups) for authorized 

users without assistance from IIS personnel.

5.3 With appropriate levels of authentication, IIS can provide copies of immunization records to 

individuals or parents/guardians with custodial rights.

5.4 The IIS can produce an immunization record acceptable for official purposes (e.g., school, child care, 

camp).

113. In 2016, which level of data access did the following user types have to your IIS? Select one.

User type ReadOnly 

(Some)

ReadOnly (All)Update 

(Some)

Update 

(All)

Varied 

(Some)

Both No 

Access

N/A

Some are 

granted 

read-only 

access to 

IIS data. All 

others 

have no 

access to 

IIS data.

All are 

granted 

read-only 

access.

Some are 

granted the 

ability to 

read and

update a 

record. All 

others 

have no 

access to 

IIS data.

All are 

granted the 

ability to 

read and

update a 

record.

Some have no 

access to IIS 

data, some 

are granted 

read-only 

access to IIS 

data, and 

some are 

granted the 

ability to read 

and update a 

record.

Some are 

granted readonly access to 

IIS data and 

some are 

granted the 

ability to read 

and update a 

record, but ALL

have some 

level of access 

to IIS data.

The user 

type 

exists but 

none are 

enrolled 

or 

otherwise 

granted 

access to 

IIS data.

The user 

type is 

inactive or 

does not 

exist in your 

geopolitical 

area.

a. Hospitals

b. Daycare/

Headstart

c. Elementary schools

d. Middle schools

e. High schools

f. WIC

g. STD/HIV

h. Long-term care 

facilities

i. Health plans

j. IHS/Tribal/Urban

k. Veterans 

administration

l. Family planning
 

33

m. Medicaid

n. Medicare

o. Retail 

clinic/Pharmacy

Report type 114. In 2016, did your IIS 

provide a predefined / 

automated report on 

the following topics?

115. If yes, in 2016 who was able 

to run these reports? Please 

check all applicable:

Immunization coverage by geography 

(e.g. zip code, county)

a. Yes / No a.IIS staff / Immunization providers / 

Other users

Immunization coverage by provider site b. Yes / No b.IIS staff / Immunization providers / 

Other users

Vaccine usage

Logic guidance: vaccine usage refers to a 

report of doses administered, such as by 

age or vaccine

c. Yes / No c. IIS staff / Immunization providers / 

Other users

Line List 

(e.g., to facilitate a vaccine recall, outbreak 

management)

d. Yes / No d.IIS staff / Immunization providers / 

Other users

Healthcare Effectiveness Data and 

Information Set (HEDIS)

Logic guidance: For more information on 

HEDIS see 

http://www.ncqa.org/HEDISQualityMeasureme

nt/WhatisHEDIS.aspx and 

http://www.ncqa.org/portals/0/Childhood%20I

mmunization%20Status.pdf

e. Yes / No e.IIS staff / Immunization providers / 

Other users

116. If your IIS needed to run a report not previously defined in the above table, can immunization program staff 

construct and run this report without assistance from an external party (e.g., IIS vendor)? 

Always / Most of the time / Sometimes / Never

Logic guidance for question 117: Access credentials for individuals or parents/guardians may be granted through a 

screening process facilitated by the immunization program / IIS personnel and/or by other authorized users of the IIS 

(e.g. providers). A “yes” answer to question 117 means that regardless of the mechanism for granting access, individuals 

or parents/guardians are able to access their own records without assistance from immunization program or provider 

staff. 

117. Does your IIS provide the means for individuals or parents/guardians with custodial rights to access their 

immunization records without staff involvement? Yes / No 
 

34

Notes for Functional Standard 5 Please provide any relevant notes or comments for data provided for 

Functional Standard 5.
 

35

Functional Standard 6: Promote vaccine safety in public and private provider settings

6.1 Provide the necessary reports and/or functionality to facilitate vaccine recalls when necessary, 

including the identification of recipients by vaccine lot, manufacturer, provider, and/or time frame

6.2 Facilitate reporting and/or investigation of adverse events following immunization.

118. Do you have a link to the Vaccine Adverse Event Reporting System (VAERS) form in your IIS? Yes / No

119. Does your program use the IIS to investigate a vaccine adverse event? Yes / No

Notes for Functional Standard 6 Please provide any relevant notes or comments for data provided 

for Functional Standard 6.