Does the HIPAA Privacy Rule require schools to maintain student immunization records?

No; however, State or other applicable laws may impose retention requirements for such records. Further, in most cases, the Privacy Rule will not provide protections to the immunization records maintained by a school because: (1) the school is not a HIPAA covered entity; or (2) the records are maintained by an educational institution or agency to which the Family Educational Rights and Privacy Act (FERPA) applies and, thus, are protected by FERPA and not HIPAA.