A school wants proof of your child’s shots. A new job asks for your measles status. A travel clinic wants to know what you have already had. And you discover that nobody has the whole list.
That is not a mistake on your part. The CDC’s own guidance on adult vaccine records says it plainly: “there is no national organization that maintains vaccination records.” This guide covers where your records actually are, how to ask for them, and what to do when they are missing.
Disclosure
I am a doctor, and I founded exora, a personal health record app. It appears once, near the end, and I am explicit there about what it is not. Everything before that works whatever you use, including a paper folder.
The short version
- The CDC does not have your records. Its records contacts page says so, with an exclamation mark.
- Start with your state’s Immunization Information System (IIS), the statewide registry, in the state where you live or where you or your child got the last shots.
- Then ask the providers who vaccinated you. Doctors, clinics and pharmacies keep records, though often only for a limited number of years.
- Check old sources too: parents, baby books, school or college health services, the military and past employers.
- If you cannot find a record, the CDC says you may need to repeat some vaccines, and that doing so is safe. Your doctor decides that with you.
- From a provider covered by HIPAA, you have a legal right to a copy of your records, within 30 days.
Why there is no single record
In the US, each vaccine is recorded by whoever gives it: a pediatrician, a pharmacy, a school clinic, an employer’s health service, a county health department. Those records live in different places. The nearest thing to a central record is your state’s registry, and even that depends on providers reporting to it.
So for most adults, the honest answer to “where are my vaccine records?” is “in several places, some of them incomplete.” The job is to collect them, once, and then keep your own copy.
Step one: your state’s Immunization Information System
Your state’s Immunization Information System is, in the CDC’s words, “a statewide registry for records.” The CDC describes these systems as bringing immunization data together into one trusted source for providers, families and public health officials. To find your or your child’s record, the CDC’s IIS contacts page says to contact the IIS “in your state or in the state where you or your child received their last shots.”
How to do it:
- Open the CDC’s IIS contacts page and find your state. It lists each state’s contact details, such as a website, phone number or email.
- Follow that state’s instructions. How you ask, and what proof of identity you need, varies from state to state, so use the route your state’s own site describes.
- If you have moved, ask each state where you were vaccinated, not only the one you live in now.
- If you get stuck, the CDC suggests contacting your immunization provider, or your local or state immunization program through your state health department. For general questions, the CDC Information Contact Center is 1-800-232-4636.
Two caveats. For children, the CDC’s guide to children’s records notes that some registry records may be incomplete. For adults, the CDC says only that some states have registries that “include adult vaccines,” so an adult record can have gaps, especially for shots given long ago or in another state.
Step two: the providers who vaccinated you
Your doctor or clinic keeps records of the vaccines it gave you, but the CDC cautions that providers keep them “for a limited number of years.” If you were vaccinated in several places, you may need to ask each one.
Many providers show immunizations in their patient portal, so check there first. If it is not there, or the portal shows only recent shots, ask the provider directly.
Your right to the record under HIPAA
HIPAA covers health care providers that handle insurance claims or other standard transactions electronically, which is most of them. If yours is covered, your immunization records are part of the medical record you have a legal right to see and copy. Under 45 CFR 164.524:
- The provider must act within 30 days, with one 30-day extension only if it tells you in writing why.
- If the record is electronic and you ask for an electronic copy, it must give you one in the form you ask for if it can readily produce it.
- It can charge only a reasonable, cost-based fee for the copy. It cannot charge you for searching for or retrieving the record. HHS guidance also allows a flat fee of no more than $6.50 for an electronic copy of records that are already electronic.
Parents can usually ask on behalf of a young child. Our guide to your HIPAA right of access covers the full process, including what to do if a provider refuses or ignores you.
Step three: the places people forget
The CDC’s adult records guide suggests looking in:
- Your parents or caregivers, and baby books or other saved childhood papers.
- High school and college health services. Move quickly here: the CDC says these records are generally kept only “1-2 years after students leave the system.”
- Previous employers, including the military, if they required vaccinations.
- Your state health department, which runs the registry above.
The paper COVID-19 vaccination card
Many people still have the white CDC COVID-19 vaccination card, and many have lost it. According to the CDC’s archived COVID-19 vaccine FAQ, the CDC “no longer distributes the white CDC COVID-19 vaccination cards and does not maintain vaccination records.”
The same FAQ explains what to do instead. Your state’s IIS cannot issue you a new card, but it “can provide a digital or paper copy of your full vaccination record,” including COVID-19 doses. That copy is usually more useful than the card was, since it shows every vaccine the registry holds, not only one kind.
School, child care and college
School vaccination requirements are set locally, not nationally. The CDC’s SchoolVaxView page says “States and local areas set the vaccination requirements” and that “the types of permitted exemptions vary by state.” For what your child’s school needs, ask the school or your state health department.
You may not have to carry the paperwork yourself. HHS explains in its guidance on student immunizations that a provider covered by HIPAA can send proof of immunization straight to a school that is required by law to have it before admitting a student, with a parent’s or guardian’s agreement. That agreement can be spoken or written, and does not need a formal signed authorization. An adult student can agree for themselves. Ask your child’s doctor whether they can send it.
Colleges and employers set their own requirements for what counts as proof. Ask in writing what they accept, whether a registry printout, a signed form from a doctor or something else, before you spend time collecting the wrong thing.
If you cannot find a record
Sometimes a record is simply gone. The CDC is practical about this. For adults, it says you may need to repeat some vaccines, that it is safe to do so, and that a doctor can sometimes use blood tests to check whether you are immune to certain diseases. For children, the CDC’s guide says it is safe to repeat a vaccine, and that antibody blood tests are an option, though they “aren’t always completely accurate.”
Which of those is right for you is a decision to make with your doctor. Bring whatever partial records you do have: a gap in the middle is much easier to deal with than no history at all.
Vaccines you had in another country
Shots given abroad are not in any US registry unless a US provider adds them. Keep the original documents, and bring them to your doctor. If they are not in English, this guide to translating medical records explains when you need a certified translation, such as for an immigration medical exam, and when a translation to read is enough.
Keep your own copy, from now on
The CDC’s advice for the future is simple. Keep your own record, bring it to each visit, and have the provider sign and date each vaccine you receive. The CDC’s adult records page links a printable immunization record form for exactly this, and suggests asking a provider who takes part in a registry to record your vaccines there too. For children, the CDC says to keep the record in a safe place “beginning with their first vaccine.” Our guide to well-child visits and records covers the rest of a child’s record.
Whatever form your copy takes, make one and keep it somewhere you will find it. The next request always comes at an inconvenient time.
Where exora fits, and where it does not
exora is a personal health record app, and it can be the place your copy lives. Upload a registry printout, old paper records, a photo of a COVID card or vaccines from overseas, and exora reads them for you, with a reading system built for medical records. Each vaccine goes into one record with its dates, linked back to the page it came from. Vaccines a document lists as due are kept as due, not given. exora is free to start, with an optional membership.
Turn on the schedule and exora compares your record against the national schedule, shows what is overdue, due soon and coming up, and the phone app can remind you before a vaccination is due. Each child can have their own profile, with their own record and schedule. There is more on the immunization records feature page.
Where it does not help, honestly:
- It is not your official record. exora does not connect to any state registry. A school or employer may still want the registry printout or a signed form, and a missing vaccine still needs a provider to record it at the source.
- It does not tell you what you need. The schedule is general information, not medical advice. Which vaccines are right for you or your child is for your doctor.
- It can misread. The reading is automated, so check anything that matters against the original, which is always one tap away.
- No connection to any patient portal. You download or photograph your records and upload them.
- Your data is stored in Sydney, Australia. exora is an Australian company, it is not a HIPAA-covered entity, and it holds no certifications. The security page explains how your data is protected.
Planning a trip? Traveling abroad with a medical condition covers what to bring to a travel clinic. Managing records for children or aging parents? Our family health records guide covers who can see what.
The short version
There is no national vaccination record, and the CDC does not hold yours. Ask your state’s Immunization Information System first, in each state where you were vaccinated, then the providers who gave the shots, then old schools, employers and family papers. From a HIPAA-covered provider, you are entitled to a copy within 30 days for a cost-based fee. A lost COVID card is replaced by a copy of your full registry record. If a record is truly gone, talk to your doctor about what to do. And once you have collected it all, keep your own copy.
Claims about vaccination records are sourced to the CDC, and claims about your rights to the US Code of Federal Regulations (eCFR) and HHS, all linked inline and checked on November 9, 2026. Rules change; this page will be updated as they do. This article is general information, not medical or legal advice. How exora handles your information is in our privacy policy.
