Public Health and Schools Toolkit


Schools Law Toolkit banner

Vaccination Clinics in Schools

Issue Brief


Schools are important and popular choices as sites for seasonal influenza vaccination clinics and similar activities in public health emergency events. School-located vaccination (SLV) activities are among the most efficient ways to reach a large number of school-age students—a population frequently at increased risk for contracting and spreading infectious diseases like influenza—in a short time.1,2 School facilities are the largest gathering space in some communities and therefore frequently used for vaccination clinics and other emergency response activities.1 The shared goal of public health and education authorities is to protect children and their communities from health threats. Yet, because of the unique nature of each state’s and locality’s laws governing health and education authorities, the legal requirements governing the issues discussed here will be different in each jurisdiction. Many, if not all, of these issues have been addressed in state and local emergency response or pandemic response plans and subsequent amendments. (Download a printable PDF.)

This issue brief identifies the legal and policy considerations that commonly arise with SLV activities, including authority to use a school site, staffing the site, the scope of persons served, required consents, and data and privacy. These considerations could also apply to the administration of other medical countermeasures (e.g., antivirals, etc.) in a school setting. And, while this brief focuses on schools, the issues identified also generally apply to colleges, universities, or other educational institutions.

(For additional information on the issues and concepts discussed in this document, see also the ASTHO Emergency Authority & Immunity Toolkit, Emergency Use Authorization Toolkit, and the Scope of Practice Toolkit.)

Using a School Site

The decision to use a school as a site for a vaccination clinic involves a number of considerations, including the legal authority and permissions required to use the site and liability and immunity concerns. Logistical considerations such as the suitability of the site to host the intended event are also important planning factors but beyond the scope of this document.1,3,4,5

Legal Authority

The planning decision to conduct SLV activities at a school is generally a joint one between school and health officials; the legal and operational details to accomplish the plan must also be factored into the decision-making process. The nature of the school as publicly or privately owned affects the authority to use the site. In public schools, questions about the authority to use the school are fairly straightforward. However, depending on state and local laws, authority to locate a vaccination clinic at a school may rest with state or local education authorities or boards of education rather than health officials Staffing and the scope of persons served at the SLV clinic (discussed below) are additional factors that influence the legal analysis.

Where a school is privately owned, the decision to conduct SLV activities rests with the school administration or the school’s board; a public health agency may or may not be involved with the vaccination campaign. As with public schools, factors influencing the legal analysis of authority and liability issues for SLV activities at private schools include who staffs the clinic and the scope of persons served by the clinic.

A state or local declaration of emergency can also affect the legal authorities related to the siting (and other aspects) of a school-based vaccination clinic. An emergency declaration by a governor/mayor can provide public health officials with additional authorities as well as activate emergency response or pandemic plans. Thus, emergency plans could designate school facilities as vaccination and medication sites or mass care facilities and activate predetermined staffing and operations plans. Again, depending on a jurisdiction’s laws, emergency declarations may or may not authorize health officials to make decisions regarding education facilities; this authority may continue to reside with education officials or revert to the chief executive (e.g., governor, mayor). (See also ASTHO Fact Sheet on Public Health Emergency Authorities in Schools.)

Site Liability and Immunity Issues

The school hosting a vaccination clinic on site is subject to potential liabilities and may be eligible for certain immunities, depending on the nature of the facility (public vs. private), the scope of persons served (students only vs. general public), the persons staffing the clinic (public employees, school employees, volunteers, etc.), and whether or not an emergency declaration is in place.

Staffing the Site 

Determining the staffing requirements for SLV activities will depend on the number and types of persons to be served in the clinic. Depending on the size of the clinic, staffing will likely involve a mix of medical and nonmedical personnel from the individual school, school district, and public health agencies, as well as contractors and volunteers. These personnel will perform a variety of functions including greeting, registering, educating, and screening vaccinees, administering vaccines, and providing security and emergency medical services as needed.1 Clinics may also have staff who can act as translators for persons who are not fluent in English. Some schools or districts require by law or by policy that school personnel, contractors, volunteers, and other persons working on site undergo background checks.1 Finally, an SLV event may require reference to the collective bargaining agreements of staff represented by unions. Changes in workers’ duties or the timing of the clinic either during school hours or before or after school hours may affect work rules, compensation, or benefits.1  

Scope of Practice and Licensing

Those staffing the clinics who are licensed healthcare professionals are subject to scope of practice requirements that govern the types of tasks they are permitted to perform during the clinic. If healthcare personnel engage in activities beyond those permitted to their profession (e.g., EMT, nurse, etc.), then they expose themselves to possible malpractice claims. Scope of practice issues are especially of concern during public health and other emergency events when the numbers of skilled health personnel may be in short supply relative to the demands of the event. Many states and localities have expanded the scope of practice during emergencies for some licensed health professions to bolster the number of health personnel available to respond. Where volunteers or contractors are licensed in another state, there may be differences in the allowed scope of practice; mutual aid agreements and contracts (discussed below) can be used to recognize and specify the scope of practice permitted to volunteers.

Staffing Liability and Immunity Issues

Persons staffing vaccination clinics or otherwise involved in emergency response activities frequently voice concerns about potential liabilities for them and their organizations arising from their participation in an event or response. Potential liabilities include, among others, malpractice, negligence, premise liability, and other forms of tort liability. However, many liability concerns have been addressed in a range of state and federal laws passed over the last decade. These laws provided new liability protections or refined existing protections to better reflect the nature of emergency response activities, including, but not limited to, the use of volunteers and persons responding across state lines. An emergency declaration by a governor may activate additional legal protections for persons involved in responding to an emergency event. The following list highlights some of the liability protections available, but is not an exhaustive list.

Governmental Immunity

Governmental or sovereign immunity is a traditional legal theory of immunity that holds that a government or its employees cannot be sued for injuries to others that occurred in the course of official duties. Governments can waive governmental immunity through tort claims acts to allow injured parties to seek compensation in certain circumstances, such as when the government is acting like a private citizen or when an employee engages in willful, wanton, or criminal behavior. Governmental immunity laws can vary by state and locality as to the types of protections available and the persons and activities covered. Public school, health agency staff, and other public employees, as well as contractors and volunteers made temporary government employees, may be covered under a theory of governmental immunity absent any disqualifying activity like gross or willful negligence.

Volunteer Protection Laws

Federal and state laws can provide immunity protections for volunteers, yet these laws can differ as to the scope of persons and activities covered. The Federal Volunteer Protection Act (VPA) provides immunity from ordinary negligence to volunteers of nonprofit organizations or governmental entities.6 It does not cover gross negligence, willful misconduct, recklessness, or acts committed by the volunteer while intoxicated or operating a motor vehicle. It does not cover organizational entities of any type or persons volunteering at private businesses. The VPA does not require a declared emergency for its protections to apply.

Mutual Aid Agreements

Mutual aid agreements provide an efficient mechanism by which localities, states, tribes, and the federal government provide personnel and aid before, during, and after an emergency event. Mutual aid agreements expedite response by establishing protocols for requesting and providing assistance and determining policies and procedures for reimbursement and compensation in advance, thereby eliminating or lessening the extent to which these issues must be negotiated with each new event. The Emergency Management Assistance Compact (EMAC) is a type of interstate mutual aid agreement that provides an organized structure through which a state can request aid.7 It establishes that the requesting state is responsible for reimbursing the assisting state for any expenses incurred and addresses liability, compensation, and licensing issues for personnel deployed pursuant to an EMAC request. EMAC is the most widely adopted mutual aid arrangement in the United States; it has been adopted by all states, the District of Columbia, and some territories.7

Public Readiness and Emergency Preparedness Act (PREP Act)

The PREP Act authorizes the U.S. Secretary of Health and Human Services to issue a declaration that provides immunity from tort liability for claims of loss caused by countermeasures against diseases or other threats of public health emergencies.8,12 The act covers persons and entities involved in the manufacture, testing, distribution, administration, and use of covered countermeasures.12 PREP Act coverage is only available where there has been a declaration by the HHS Secretary; if such a declaration has not been issued, then activities at an SLV site would not be covered by the PREP Act, although other state or federal liability protections may still apply. The PREP Act was used to provide liability protections during the 2009-2010 H1N1 influenza pandemic for vaccines and antivirals. Staff involved in the planning and implementation of SLV activities for covered countermeasures would likely be covered under the PREP Act.1

Most states have likewise revised or adopted new protections for persons volunteering or otherwise involved in emergency preparation or response activities. Taken together, state and federal liability protections can help to assure staff involved in vaccination clinics that their participation should not give rise to liability as long as they meet the conditions for protection outlined in the laws. Liability protections can depend on the nature of the services provided by the person (volunteer vs. paid employee), whether a federal or state emergency declaration has been issued, and the extent of protections provided by any applicable laws or programs.

Persons Served at the Site

The scope of persons to be served at the SLV site poses a range of differing legal and logistical issues. The school site may be used to vaccinate only the students in attendance at that school. Additionally, the site could also serve students at neighboring schools, home-schooled children, school staff, students’ younger siblings and other family members, and other members of the community, regardless of age.1  

Liability and Immunity Issues

Expanding the scope of persons served at a SLV site broadens the number and types of persons to whom the school, health agency, and others staffing the event are potentially liable, although the grounds for liability—such as malpractice, negligence, or premises liability—will generally be the same regardless of the scope of persons served. As discussed in the Staffing section above, the site and persons involved in the SLV clinic may be covered under governmental immunity, volunteer protection, or other state and federal laws.


Obtaining consents to perform vaccinations and then sharing data about the vaccinees are critical elements in SLV activities.

Consent to Vaccinate

Generally, parents or guardians provide written consent to vaccinate a minor student, although some jurisdictions allow certain circumstances in which minor children can consent to vaccination themselves.1 Students who are 18 years or older and all adults must also provide written consent to be vaccinated.

Opt-In vs. Opt-Out Consent

Most vaccine consent is based on an “opt-in” framework in which a parent, guardian, or person to be vaccinated affirmatively elects to receive the vaccine for themselves or their child. Under the opt-in framework, the vaccination will not be administered unless consent has been given. This is contrasted to an “opt-out” framework in which a parent, guardian, or person must provide written notice stating they do not want the vaccination. Under the opt-out framework, the vaccination will be administered to all persons unless they (or their parent/guardian) elect in writing not to receive it. The decision to use an opt-out or opt-in approach can be a controversial one and involves weighing a variety of factors including, but not limited to, individual rights, community health, individual health, and the nature of the health threat being addressed.

Mandated Vaccines and Exemptions

Vaccination for seasonal influenza is not mandated by any state for school-age children, nor was it required for the H1N1 pandemic influenza vaccine in 2009.9 All states have school-entry immunization requirements for other vaccine-preventable diseases; however, all states have some type of temporary or permanent medical exemption to these school-entry requirements, and many states also recognize religious or philosophical exemptions.9 Should a vaccine or other medical countermeasure be mandated for school children and others in response to a public health emergency, it would likely contain similar medical and other exemptions. However, depending on the nature of the disease, those electing the exemption over the vaccine would likely be subject to exclusion from school, other social distancing measures, quarantine, or isolation until the incubation or infectious period had passed.

Consent Format and Requirements

Federal law and regulations generally do not govern parental consent requirements or the format or content of the consent forms; specific consent requirements are set in state law or regulation.1 A consent to vaccinate form generally:

  • Requires demographic information about the student (name, address, date of birth, etc.).
  • Contains questions to screen for any medical reasons why the student should not be vaccinated.
  • Includes a place for the parent, guardian, or non-minor student to sign the consent form.
  • Includes a place to indicate permission to release identifiable information about the student vaccinated to parties such as the health agency or medical provider.
  • Provides space for the person administering the vaccine to note the date of vaccination and the lot number.

The consent form is accompanied by a vaccine information statement (VIS) prepared by the CDC. Vaccine providers are required by federal law to provide a VIS to the parent, guardian, or person to be vaccinated prior to each administration of a vaccination.17 The VIS describes the risks and benefits of the vaccine, and the indications and eligibility for the vaccine to be administered. VIS forms are also available in multiple foreign languages.17

Consent to Share Records

As detailed below, federal and state legal requirements dictate the ability of schools, health agencies, or others administering SLV clinics to disclose individually identifiable information about the persons vaccinated.1 If a school is the entity maintaining the vaccination records, it will have to receive separate written consent from parents, guardians, or non-minor children to share data with local or state health agencies. Consent to share records can be made through a separate document or by adding a separate signature line agreeing to share records within a consent to vaccinate form.

EUA Consents

Consents for a product subject to an U.S. Food and Drug Administration (FDA) Emergency Use Authorization (EUA) authorization require different consents for vaccines (and other medical countermeasures) than do measures approved though FDA’s regular drug approval processes. An EUA permits the use of unapproved medical products (vaccines, drugs, devices, or diagnostics) or the use of approved medical products in unapproved ways to diagnose, treat, or prevent serious diseases caused by chemical, biological, radiological, or nuclear agents.10,11 Vaccines and other measures administered under an EUA are eligible for the liability protections contained in the PREP Act. Vaccines subject to an EUA must be accompanied by a fact sheet to healthcare providers (or other persons administering the vaccine) and to consumers. The fact sheets must describe the product’s significant and known benefits and risks, the extent to which these risks are unknown, and information about available alternatives and their benefits and risks.10,11 The fact sheet for consumers must also inform them of their right to accept or refuse the product, identify the consequences of refusing the product (e.g., quarantine), and any alternatives to the product.10,11

Records and Privacy Considerations

Public health agencies view schools and education agencies as important partners in protecting children and adolescents from health threats. Sharing data between schools and public health agencies may, in some instances, be the only realistic and reliable method for getting the information necessary to conduct public health activities, such as tracking immunization rates.13 While SLV activities may be efficient mechanisms to vaccinate children, federal privacy protections for student education records have resulted in difficulties in public health efforts to conduct mandated and discretionary federal and state public health activities.

Disclosures Under FERPA and HIPAA 

The Family Educational Rights and Privacy Act (FERPA) prevents the disclosure of a student’s education record without the consent of a parent or eligible student (18 years or older) unless an exception to the law’s general consent requirement applies.14 FERPA applies to any educational institution or agency that receives funds from the U.S. Department of Education (ED), including “non-school” entities that do not have students. Schools that do not receive ED funds, such as private elementary and high schools, are not subject to FERPA. FERPA contains a number of exceptions that allow schools to disclose information from a student’s education record without consent of a parent or an eligible student. Historically, however, FERPA exceptions have generally been narrowly construed by ED to err on the side of protecting the student’s privacy and may be of limited use in SLV activities.16 (See ASTHO FERPA Fact Sheet and Public Health Access to Student Health Data Issue Brief for additional information.)

An “education record” is defined in FERPA as records which are directly related to a student and maintained by an educational agency or institution, or by a party acting on behalf of the agency or institution. A student’s health records, including immunization information and other health records, are considered part of the student’s education record and thus are protected from disclosure under FERPA.

If a person or entity acts on behalf of the school, such as a school nurse providing health services (whether at the school or off site) under contract or otherwise under the “direct control” of a school, and maintains student health records, then these records are considered education records under FERPA as if the school was maintaining the records directly.16 However, if a person or entity provides health services directly to students and is not employed by, under contract to, or otherwise acting on behalf of a school, then the resulting health records are not deemed to be part of the education record covered by FERPA.16 Even if the services are provided at the school, the resulting health records are not covered by FERPA because the person or entity creating and maintaining the health records is not acting on behalf of the school.16 Thus, if a health agency conducts an SLV clinic and maintains the records afterwards, then the data is not subject to FERPA. But if the health agency provides a copy of the vaccination records to the school for inclusion in the students’ files, then the data given to the school becomes part of students’ education records and the school’s data is subject to FERPA requirements, while the health agency’s records of the same information would not be subject to FERPA.1  

Some student health records that are not covered under FERPA may be covered under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule or any applicable state privacy laws. If a private elementary or secondary school holds a vaccination clinic and they are a covered entity under HIPAA, the resulting records are not covered by FERPA because ED generally does not fund private schools, but they would be covered as PHI under HIPAA.16 Health agencies would need to invoke one of the Privacy Rule’s exceptions, such as the public health exception, to access health records from the private school in this scenario or from the healthcare provider who administered the vaccinations.15,16 (See ASTHO HIPAA Privacy Rule Fact Sheet and Public Health Access to Student Health Data Issue Brief for additional information.)

If a health agency cannot satisfy the requirements for an exception under FERPA, health agencies may access vaccination and other student health data through other strategies such as seeking parental consent, using de-identified data or limited data sets, or using data that is not maintained by the school or another entity covered by FERPA.


1 U.S. Centers for Disease Control and Prevention. 2009 H1N1 Influenza School-located Vaccination: Information for Planners. Undated. Available at  Accessed May 30, 2013.
2 U.S. Dept. of Education. “Tips for Setting Up a Vaccination Clinic” Fact Sheet. October 8, 2009. Available at  Accessed May 30, 2013.
3 See generally, U.S. Centers for Disease Control and Prevention. CDC Guidelines for Large-Scale Influenza Vaccination Clinic Planning. Webpage updated September 14, 2011. Available at  Accessed May 30, 2013. 
4 See generally, U.S. Dept. of Health and Human Services. “School Planning” webpage. Available at  Accessed May 30, 2013.
5 U.S. Dept. of Education. “H1N1 Flu Information” webpage. Available at  Accessed May 30, 2013.
6 Volunteer Protection Act of 1997. Pub. L. 105-19. Codified at 42 U.S.C. 14501-05.
7 Emergency Management Assistance Compact website. Available at  Accessed May 30, 2013.
8 Project BioShield Act of 2004. Pub. L. No. 108-276.
9 Centers for Disease Control and Prevention. “School Vaccination Requirements, Exemptions and Web Links” webpage. Updated July 21, 2011. Available at  Accessed May 30, 2013.
10 U.S. Food and Drug Administration. “Emergency Use Authorizations Questions and Answers” webpage. Available at  Accessed May 30, 2013. 
11 U.S. Food and Drug Administration. Emergency Use Authorization of Medical Products Guidance. July 2007. Available at  Accessed May 30, 2013. 
12 Public Readiness and Emergency Preparedness Response Act of 2005. Pub. L. No. 109-148. Codified in the Public Health Service Act at 42 U.S.C. §§ 247d-6d, 247d-6e.
13 Association of State and Territorial Health Officials. “Accessing School Health Information for Public Health Purposes” Position Statement. 2006. Available at under “FERPA and Public Health.”  Accessed May 30, 2013.
14 Family Educational Rights and Privacy Act (FERPA) codified at 20 U.S.C. §1232g.
15 Health Insurance Portability and Accountability Act (HIPAA) of 1996. P.L.104-191.
16 U.S. Dept. of Education and U.S. Dept. of Health and Human Services. “Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records.” November 2008. Available at  Accessed May 30, 2013.
17 Centers for Disease Control and Prevention. “Fact Sheet for Vaccine Information Statements” webpage. Updated December 7, 2010. Available at  Accessed May 30, 2013.


Note: This document was compiled from June–December 2011 and reviewed May 2013; it reflects the laws and programs current then. It reflects only portions of the laws relevant to public health emergencies and is not intended to be exhaustive of all relevant legal authority. This resource is for informational purposes only and is not intended as a substitute for professional legal or other advice. The document was funded by CDC Award No. 1U38HM000454 to the Association of State and Territorial Health Officials; Subcontractor PI Elliott, Logan Circle Policy Group LLC.