What immunization records daycare operators are required to collect and keep

Last updated 2026-07-09

What federal law actually requires from daycare programs on immunizations

The federal government does not hand you a single list of vaccines and say "collect these." Instead, the Child Care and Development Fund (CCDF) regulations at 45 CFR Part 98 require every state that accepts CCDF money to set health and safety standards for licensed child care, and immunization verification is named as one of those standards. ^[1]

The 2016 CCDF final rule tightened this a lot. States must now have standards covering "health and safety training, background checks, and health and safety practices including... immunizations." That language appears in 45 CFR §98.41. The rule does not specify which vaccines, which schedule, or what paperwork format. That granular work falls to each state licensing agency.

If your program takes CCDF subsidy payments, your state had to certify to the federal Office of Child Care that these standards exist. In practice, every state now has at least some immunization-record requirement written into its child care licensing code, even if the specifics vary widely.

So federal rules create the mandate. State rules tell you what to actually put in a child's file.

Which vaccines are daycare providers typically required to document?

The answer in every state starts with the CDC/ACIP recommended childhood immunization schedule. ^[2] That schedule is the scientific foundation, even if states translate it into policy differently.

For children ages 0 through 6 (the typical daycare population), the vaccines most commonly required on state licensing checklists include:

Vaccine	Doses typically required by age 2	Notes
DTaP (diphtheria, tetanus, pertussis)	3-4	4th dose at 15-18 months
Polio (IPV)	3	4th dose before kindergarten
MMR (measles, mumps, rubella)	1	2nd dose at school age
Varicella (chickenpox)	1	2nd dose at school age
Hib (Haemophilus influenzae type b)	3-4	Series varies by brand
Hepatitis B	3	Birth dose plus 2 more
PCV (pneumococcal)	3-4
Rotavirus	2-3	Oral, series varies
Hepatitis A	2	Some states, not all
Influenza	1-2 per season	Required in some states

States do not always require proof of every vaccine on that list. Some require only the vaccines mandated for school entry. Others require the full ACIP series for the child's age. A handful require flu vaccination documentation. Most do not.

For staff, the required vaccines are different. Most states require or strongly recommend that childcare workers stay current on MMR, varicella, Tdap (the adult booster for pertussis), hepatitis B, and annual influenza. Some states make these mandatory for licensing. Others frame them as recommendations. Check your state's licensing rule for staff health requirements specifically. ^[3]

What does an acceptable immunization record look like?

Most states accept one of three document types: an official immunization record printed from your state's immunization information system (IIS), a completed Certificate of Immunization Status (or equivalent state form), or a physician/clinic-signed vaccination record showing the vaccine name, dose number, and date administered.

A parent's handwritten summary is almost universally not acceptable on its own. The record has to come from a provider or the state registry.

The CDC notes that all 50 states and Washington D.C. operate an IIS (sometimes called an immunization registry). ^[4] Parents can request a printed copy from their child's doctor or, in many states, directly from the registry portal. Worth knowing, because parents lose paper vaccination cards constantly, and the registry print-out is usually the fastest fix.

For your files, the record should show:

• The child's full legal name and date of birth
• Each vaccine's name (more than an abbreviation)
• The date each dose was given
• The administering provider or clinic name (in most states)

Some states also require the lot number for each vaccine. That requirement shows up mostly in states that have run disease outbreak investigations, because lot numbers help public health trace exposure chains. If your state requires it, that detail has to be on the record in your file, more than on the parent's personal copy.

When does the immunization record have to be on file, before enrollment or after?

This is the question that trips up new operators most. States handle timing in three different ways.

Before the first day: Some states require a complete, up-to-date immunization record before a child sets foot in your program. No exceptions, no grace period. If the record is not in hand, the child cannot start.

At enrollment with a grace period: More commonly, states allow enrollment with a signed enrollment form or a record showing at least some vaccinations, then give families a window (typically 30 to 90 days) to provide complete documentation. California, for example, has historically required documentation before the first day for licensed facilities. Texas allows a 30-day grace period for a child transferring from another licensed facility. ^[5]

For children transferring from out of state: Many states have provisions for a slightly longer window because out-of-state IIS records take time to transfer.

The honest answer is that you need to look up your specific state's rule and write the enrollment deadline into your parent handbook. Do not assume a grace period exists. If your state is a "before day one" state and a child shows up without records, you legally cannot admit them.

Running a home daycare does not exempt you. Home-based programs licensed by the state follow the same immunization documentation rules as centers, in nearly every state. ^[6]

How long do daycare operators have to keep immunization records?

Retention requirements vary, but the most common rule is that immunization records must be kept for the length of enrollment plus a period after the child leaves. That post-enrollment period runs from one year (a few states) to five years or more.

Some states tie retention to the child reaching age 18. Others require records to be kept as long as the program is licensed.

Here is what I'd do: keep immunization records for at least three years after a child disenrolls, or until they reach age 10, whichever is longer. That covers most state requirements and gives you a buffer for an audit. Immunization records are almost always subject to review during a licensing inspection, so keeping them organized and reachable matters.

Store them separately from general enrollment paperwork so you can pull them quickly during an inspection. Many operators use a simple alphabetical binder or a dedicated folder in their child management software. If you use software, confirm the platform actually stores the document image, more than a checkbox that says you got it.

For programs that accept CCDF subsidies, federal monitoring guidance says records tied to health and safety standards may be reviewed during oversight visits, so retention practices that satisfy your state licensing rule will generally satisfy federal monitors too. ^[1]

What are the rules for religious and medical exemptions to required vaccinations?

Every state allows medical exemptions to required vaccinations. A licensed physician must sign a statement explaining why a specific vaccine is contraindicated for a specific child. The documentation has to be in the child's file, and most states require it renewed annually or when the medical condition changes.

Religious exemptions are more complicated. As of 2024, 44 states and Washington D.C. allow religious exemptions to school and child care immunization requirements. ^[7] Mississippi, West Virginia, California, New York, and Maine have eliminated non-medical exemptions following disease outbreaks. If you operate in a state that does not allow religious exemptions, a parent's religious objection does not legally let you accept the child without documentation.

Philosophical or personal belief exemptions exist in fewer states and have been eliminated in several after measles outbreaks in 2019 and later.

When an exemption is in place, keep that signed exemption form in the file in place of the vaccination record. It does not remove the requirement for a document. It swaps the vaccination record for a different document.

During a disease outbreak, children with exemptions can be excluded from your program by order of the local health department, even if your state permits the exemption. That is a public health authority separate from licensing, and it is not optional. Build this possibility into your enrollment agreement so families are not surprised.

How does the inspection process check immunization records?

Licensing inspectors almost always review immunization records during a standard compliance visit. In most states, inspectors go through every enrolled child's file and check that a current, complete immunization record or a valid exemption form is present. ^[8]

Inspectors look for a few specific things: the record exists, it looks like an official document (not a parent's handwritten note), the vaccines documented match the state's required list for the child's age, and the dates show the child was appropriately up to date at the time of enrollment.

A missing or expired immunization record is one of the most common deficiencies cited during daycare inspections. Child Care Aware of America's annual reporting notes that staffing and health/safety documentation deficiencies consistently rank among the top citation categories across states. ^[9]

If an inspector cites you for an immunization record deficiency, the correction period is usually short (24 to 72 hours in many states) because the fix is simple: contact the family and get the document. Repeated or unresolved deficiencies can lead to provisional licensing status or, in extreme cases, license suspension.

One thing that catches operators off guard: inspectors sometimes check whether records have been updated as children age through the vaccine schedule. A record that was complete at enrollment can be out of date six months later, when a child turns 15 months and is due for more doses. Some states require annual reverification. Others require you to update the file when a new dose comes due.

Do daycare providers need to track their own staff immunization records?

Yes, in most states. Staff immunization requirements sit in a separate section of licensing rules from child immunization requirements, but they are real and enforceable.

The most common staff requirements include:

• Tdap (one-time adult pertussis booster, if not received as an adult)
• MMR (two doses, or proof of immunity)
• Varicella (two doses, or proof of prior disease)
• Annual influenza (required in some states, recommended in others)
• Hepatitis B (required in some states, especially for infant rooms)
• TB screening (not a vaccine, but often required alongside immunization documentation)

For home daycare operators who work with assistants or substitutes, this covers every person who has regular contact with children in the home, more than the primary licensee.

Keep staff immunization records in a separate personnel file, not mixed with child records. Most states hold staff to the same document standard as children: an official record or a clinic-signed form, not a self-attestation.

Make sure your insurance and liability coverage matches your health and safety compliance practices. It's a smart habit. If you run a home-based program, understanding home daycare insurance requirements specific to your situation is worth doing early in the licensing process.

What happens if a child's immunizations are not up to date when they enroll?

There are three distinct scenarios here, and they get handled differently.

Child is behind but the parent is working on catch-up: Many states allow enrollment if the child has a documented catch-up schedule signed by a physician. The file must contain that plan, and you are responsible for following up to confirm compliance. If the family does not follow through, you may be required to disenroll the child.

Child has a valid medical exemption: As covered above, the exemption document replaces the vaccination record. The child can attend.

Child simply has no records: This is the case that creates compliance risk for you. If a family cannot produce records and does not qualify for a medical exemption, most states do not let you enroll or continue caring for the child until records are obtained. Pointing the family to the state's IIS portal or the child's previous healthcare provider is usually the fastest path.

Never document a child as having received vaccinations you have not seen proof of. That is falsification of a required record, which in most states is grounds for license revocation and, in some, carries criminal penalties.

For children in foster care or coming from other states, licensing agencies usually have specific provisions. Foster children often have fragmented records, and many states allow shorter-term enrollment while records are gathered, with the placing agency responsible for obtaining documentation.

Do state requirements differ significantly, and where can you find your state's exact rule?

Yes, the variation is real and it matters. A program that moves from operating in, say, Colorado to Florida would find different forms, different deadlines, and different required vaccine lists.

The fastest way to find the exact requirement for your state is to go straight to your state's child care licensing office website. Every state publishes its licensing rules, and immunization requirements are almost always in a "health" or "health and safety" section. The Child Care Aware of America directory can point you to your state licensing office. ^[6]

A second resource is your state's immunization information system or health department, which publishes the school and child care immunization requirements (these usually match, though not always exactly).

The CDC's State Vaccination Requirements page gives partial coverage of state-level variation, though its primary focus is broader than child care alone. ^[7]

ChildCareComp's compliance toolkit can help you map your state's specific licensing requirements and track which children and staff have current documentation, which is where most compliance failures actually happen.

If you are looking at daycare liability insurance or setting up your enrollment paperwork, immunization record collection should be one of the first health and safety systems you formalize, not something you patch together after your first inspection.

For home-based operators newer to the licensing requirements, the health and safety category at ChildCareComp covers these topics in more depth alongside cleaning protocols and other compliance basics. Good daycare cleaning practices and sound immunization recordkeeping go together as the foundation of a defensible health and safety program.

How should daycare providers organize and store immunization records securely?

Physical storage and digital storage both work. Each has tradeoffs.

Physical files: A dedicated binder or accordion folder, organized alphabetically by child last name, is simple and inspection-friendly. Keep it locked when not in use, both for privacy reasons and because immunization records contain sensitive health information. Many states classify these as confidential health records.

Digital storage: Child management software platforms (Procare, Brightwheel, HiMama, and others) let you photograph and upload enrollment documents including immunization records. This makes it easy to pull records during inspections and to flag when records need updating. The catch is that the system is only as good as your file upload discipline. A checkbox in software that says "immunizations on file" with no actual image attached is worthless in an inspection.

Hybrid approach: scan and upload to software, but also keep a paper copy in the child's file for the length of enrollment. It's redundant, and it's very cheap insurance against software access problems during an inspection.

Whatever storage method you pick, build a process to review immunization files at enrollment, at 12 months, and whenever a child's birthday moves them into a new age bracket for required vaccines. A simple spreadsheet with each child's name, date of birth, and a column for the date immunizations were last verified does the job without expensive software.

Frequently asked questions

Can a parent refuse to provide immunization records and still enroll their child in daycare?

Only if your state allows a recognized exemption (medical, religious, or philosophical depending on the state) and the parent submits the correct exemption form. A parent cannot simply decline to provide documentation with no basis. If no exemption applies and no records are provided, you cannot legally enroll the child in a licensed program. Accepting a child without records puts your license at risk.

Are home daycares required to collect immunization records the same as centers?

In most states, yes. Licensed family child care homes operate under the same health and safety standards as centers for immunization documentation. Unlicensed, license-exempt providers (such as care for only the provider's own children, or programs below a state's licensing threshold) may not be subject to the same rules, but parents of children in those settings are taking on more risk. If you are licensed, the rules apply regardless of program type.

How often do I need to update a child's immunization record on file?

It depends on your state, but the most common approach is to require an updated record whenever the child receives new doses. Practically, that means updating the file at 15-18 months (when DTaP, Hib, PCV, and MMR second doses are due), again at age 4-6 before kindergarten entry, and annually if your state requires flu vaccine documentation. Some states require annual reverification of all records.

What is an immunization information system and how do I help parents use it?

An immunization information system (IIS) is a confidential, population-based, computerized database that records all vaccine doses given to people in a geographic area. All 50 states operate one. Parents can request a printed immunization history from their child's physician, who can access the IIS, or in many states directly through an online portal. If a parent lost their child's vaccination card, the IIS print-out is the fastest legitimate replacement.

Can I accept a photo of a vaccination card as an official record?

Some states accept a clear photo or scanned copy of an official vaccination record as equivalent to the original. Others require an original or certified print-out from a provider or state registry. Check your state's licensing rule specifically on this. A photo of a handwritten personal vaccination card without a provider signature is almost universally insufficient on its own.

What is the difference between a child care immunization requirement and a school immunization requirement?

They are related but not always identical. School requirements typically apply at kindergarten entry and focus on age 4-6 doses. Child care requirements apply from infancy and track the full 0-to-6 schedule, which includes more doses. In some states the child care rule is stricter. In others the two match. Your state health department publishes both separately, and you should reference the child care-specific list, not the school-entry list.

Does a child with a religious exemption have to be excluded during a disease outbreak?

Yes, in most states. During a declared outbreak of a vaccine-preventable disease (measles, pertussis, etc.), local or state health departments have authority to exclude unvaccinated children from licensed child care settings regardless of the exemption type. This authority comes from public health law, not licensing law. State this possibility clearly in your enrollment agreement so families with exemptions understand it before they enroll.

Are there federal penalties for daycare programs that don't comply with immunization record requirements?

Direct federal penalties for individual programs are rare. The enforcement mechanism runs through state licensing. A program cited for immunization record violations faces state licensing sanctions, which can range from a written notice to provisional status to license revocation for repeated failures. Programs that receive CCDF funding face potential loss of subsidy eligibility if their state finds they are not meeting required health and safety standards.

Do I need to keep immunization records for part-time or drop-in children?

Yes. Most states require immunization documentation for any child enrolled in a licensed program, regardless of hours or days attended. A child who attends two mornings a week is still enrolled and still covered by licensing requirements. Drop-in care is treated similarly in most states, though some carve out truly occasional care (one or two visits per month). Check your state's definition of "enrollment" in its licensing rule.

What should I do if a child's vaccination record shows vaccines given outside the U.S.?

Foreign vaccination records are valid in most states if they document the vaccine name, dates, and provider. Some vaccines carry different names or formulations internationally, though. The CDC publishes guidance on evaluating immunization records from foreign countries, and your state health department may have a process for submitting foreign records for review. When in doubt, the family's U.S. pediatrician can review the foreign record and issue a domestic verification.

How do I handle immunization records for infants who are too young to have completed their vaccine series?

Infants cannot be fully vaccinated because they are age-ineligible for many doses. The standard is age-appropriate immunization, meaning the child should have all vaccines due for their current age per the CDC schedule. A two-month-old should have their first round of doses. A six-month-old should have the 6-month series. Keep the current record and note when the next dose is due so you can follow up with the family.

Can a daycare be sued if a non-vaccinated child spreads a disease to another child in care?

This is an area of real legal exposure. If you accepted a child without proper documentation or a valid exemption and another child caught a vaccine-preventable disease, you could face civil liability. There is no clean nationwide precedent, but the legal theory would be negligence in failing to comply with your licensing requirements. This is one reason compliance with immunization record rules ties directly to your liability risk, more than your licensing status.

Where can I find a checklist of required immunizations for my specific state?

Your state's child care licensing office website is the primary source. Most state health department websites also publish a child care immunization requirements chart by age. Immunize.org maintains a state-by-state reference for school and child care requirements. For the federal floor requirement, 45 CFR Part 98 governs CCDF standards, and the Office of Child Care (childcare.gov) has implementation guidance.

Sources

1. Office of Child Care, HHS — CCDF Final Rule 45 CFR Part 98: CCDF regulations at 45 CFR Part 98 require states accepting CCDF funds to establish health and safety standards including immunization verification for licensed child care programs
2. CDC — Recommended Child and Adolescent Immunization Schedule: The CDC/ACIP recommended childhood immunization schedule is the scientific foundation for state child care immunization requirements
3. CDC — Vaccines for Healthcare Workers: Recommended vaccines for workers in child-facing settings include MMR, varicella, Tdap, hepatitis B, and annual influenza
4. CDC — Immunization Information Systems: All 50 states and Washington D.C. operate an immunization information system (IIS) where parents can obtain official vaccination records
5. Texas Health and Human Services — Child Care Licensing Health Requirements: Texas allows a 30-day grace period for immunization documentation for children transferring from another licensed facility
6. Child Care Aware of America — Child Care Licensing Overview: Home-based programs licensed by the state are subject to the same immunization documentation rules as centers in nearly every state
7. CDC — State Vaccination Requirements: As of 2024, 44 states and Washington D.C. allow religious exemptions to child care immunization requirements; Mississippi, West Virginia, California, New York, and Maine have eliminated non-medical exemptions
8. Administration for Children and Families — Child Care Licensing and Monitoring: Licensing inspectors review immunization records as part of standard compliance monitoring of licensed child care programs
9. Child Care Aware of America — The US and the High Cost of Child Care (annual report series): Health and safety documentation deficiencies consistently rank among the top citation categories across states during licensing inspections
10. Immunize.org — State School and Child Care Immunization Requirements: Immunize.org maintains state-by-state reference charts for school and child care immunization requirements
11. HHS Office of Child Care — CCDF Health and Safety Requirements: The 2016 CCDF final rule explicitly names immunizations as one of the health and safety standards states must establish under 45 CFR §98.41