If your practice is enrolled in the Vaccines for Children program, you can tell families something valuable: an eligible child can get recommended vaccines without paying for the vaccine. That message is also easy to get wrong. The program has a legal definition of who is eligible, the vaccine is free but the shot may carry an administration fee, a child cannot be turned away because a parent cannot pay that fee, and the vaccine on your shelf belongs to two different inventories. This guide covers what the federal statute and the CDC say about each of those points and how to turn them into website copy, front desk scripts and reminders that stay accurate.
Two related topics have their own guides and are not repeated here. Website, privacy, review and reminder basics for children’s practices are in our guide to pediatric practice marketing. Seasonal flu campaigns, incentives and booking pages are in our guide to flu shot clinic marketing.
This is general information, not legal or medical advice. Each state, local or territorial immunization program runs its own enrollment, provider agreement and site visits, and state Medicaid payment rules differ, so check details with your immunization program and counsel. Sources cited were checked on October 30, 2026: 42 U.S.C. 1396s, CDC Vaccines for Children program pages (About, Information for Providers, Program Eligibility, Fraud and Abuse), the CDC VFC Operations Guide for July 1, 2026 to June 30, 2027, 42 CFR 447.15, 42 U.S.C. 300aa-26, 45 CFR 164.501, 16 CFR 251.1, and 15 U.S.C. 45 and 52.
What the program is, in the statute’s own terms
The Vaccines for Children program is section 1928 of the Social Security Act, codified at 42 U.S.C. 1396s. Under subsection (a)(1), each vaccine-eligible child who receives a qualified pediatric vaccine from a program-registered provider is entitled to receive the immunization without charge for the cost of the vaccine, and the provider receives the vaccine without charge for the vaccine or its delivery. Subsection (h)(1) defines a child as an individual 18 years of age or younger.
A program-registered provider, under subsection (c)(1), is a provider licensed or otherwise authorized under state law to administer pediatric vaccines, who submits an executed provider agreement to the state and who has not been found to have violated that agreement. The statute says this applies without regard to whether the provider participates in Medicaid. The CDC page for providers says the same in plainer words: you do not have to be a Medicaid provider to participate, and any provider authorized by state law to administer vaccines, including pharmacists, can enroll. Enrollment runs through your state, local or territorial immunization program, followed by a site visit on administrative requirements and vaccine storage and handling. The CDC also says all VFC providers are required to take part in annual training.
For marketing, the practical point is simple: only say you are a VFC provider once the agreement is executed and you have received program vaccine. A page that announces participation while enrollment is still pending tells families something that is not yet true, which is the kind of claim 15 U.S.C. 45 and 52 reach.
Who is eligible, and how to say it on your website
Subsection (b)(2) of the statute lists the federally vaccine-eligible children: a Medicaid-eligible child, a child who is not insured, a child who is an American Indian or Alaska Native, and a child who is not insured for the vaccine and receives it at a federally qualified health center or rural health clinic. The CDC eligibility page adds detail that belongs in your copy.
Three points from that page change what you can promise:
- Children enrolled in a separate CHIP program are considered insured and do not qualify.
- Underinsured children, meaning children whose insurance does not cover vaccines, covers only selected vaccines, does not give first-dollar coverage, or has a fixed dollar cap, can receive VFC vaccine only at a federally qualified health center, a rural health clinic, or under an approved deputization agreement.
- A child whose insurance covers the vaccine is not eligible, even if a claim would be denied because the family has not met the deductible.
That last point is the one families misread. If your page says that families with high deductibles can get free vaccines, and you are a private practice without a deputization agreement, the page is wrong for an insured child. Write the categories as the CDC writes them, and say which ones your location serves. A private office can list three: enrolled in or eligible for Medicaid, no health insurance, and American Indian or Alaska Native. A health center or rural health clinic can add the underinsured category.
The statute also shapes how you collect the answer. Under subsection (c)(2)(A), the provider asks the parent the questions needed to decide eligibility but need not independently verify the answers, keeps records of the responses for the period the Secretary sets, and makes them available to the state and the Secretary on request. The CDC says providers must screen and record eligibility at each visit. On a booking page, that becomes one line: we will ask a few questions about your child’s coverage when you check in. Do not ask families to upload income documents to prove VFC eligibility; the CDC says verification of parent or guardian responses is not required, and collecting more than you need adds privacy risk.
The word free: the vaccine, the administration fee and the visit
Subsection (c)(2)(C) sets three rules. The provider will not impose a charge for the cost of the vaccine. The provider may charge a fee for administering it, so long as the fee for a federally vaccine-eligible child does not exceed the cost of administration as determined by the Secretary based on actual regional costs. And the provider will not deny administration to an eligible child because the parent cannot pay the administration fee.
The CDC page for providers lists the fees a provider can charge: a set fee to administer each vaccine, an office visit fee if other services were provided in addition to vaccinations, and fees for non-vaccine services such as an eye exam or a blood test. It also says that if a parent or guardian cannot afford the per-vaccine fee, the fee must be removed. The 2026 to 2027 Operations Guide adds that the fee cap varies from state to state on a regional scale determined by CMS, that the cap has no lower limit, and that a provider may decline to charge a fee at all. We do not quote the cap here; your immunization program can tell you the figure that applies to you.
Medicaid changes the picture. The Operations Guide says that for VFC-eligible children enrolled in Medicaid, the provider must accept the reimbursement for vaccination set by the state Medicaid agency or the contracted Medicaid health plans, and the CDC eligibility page says you must be a Medicaid provider to receive Medicaid payment for administration. Under 42 CFR 447.15, a state plan limits Medicaid participation to providers who accept the agency’s payment, plus any cost sharing the plan requires, as payment in full.
Put together, the honest message is narrower than free shots. The FTC’s guide on the word free, 16 CFR 251.1, says the conditions of a free offer should be set out clearly and conspicuously at the outset, and 15 U.S.C. 45 and 52 reach advertising that leaves a misleading net impression.
Wording that holds up looks like this:
- Eligible children receive Vaccines for Children program vaccines at no cost for the vaccine itself.
- An administration fee may apply for children who are not enrolled in Medicaid. If you cannot pay it, tell us and we will not charge it. Your child will not be turned away.
- If your child’s visit includes other services, such as a checkup, those services are billed separately.
Avoid headlines such as free vaccines for all kids, no-cost shots for everyone, or free flu shots for children when you are describing VFC vaccine. Each of those reaches families whose children are insured and not eligible, and none of them mentions the administration fee or the visit.
Never deny a shot over the fee, and say so where families can see it
The rule against denial for inability to pay is in the statute itself, and the Operations Guide adds billing limits that front desk and billing staff need to know. If a provider bills the administration fee for a non-Medicaid VFC-eligible child after the date of service, it may issue only a single bill, within 90 days of administration. Providers may not send unpaid administration fees to collections, and may not refuse to vaccinate an eligible child whose parents have unpaid administration fees.
These rules belong in three places outside the clinical team. First, the website: one sentence on the vaccines page saying that no eligible child is turned away because a family cannot pay the administration fee. Second, the phone and chat scripts, including any AI front desk tool: when a parent asks what a shot costs, the answer starts with eligibility questions and includes the waiver, rather than quoting a price and ending the call. Third, the billing system: make sure statements for VFC administration fees go out once, within the window, and that these accounts are excluded from any collections workflow. A marketing team can promise accessible care in good faith while a collections vendor quietly breaks the rule, so check the hand-off.
Two inventories on one shelf: what you can promote
A VFC provider holds program vaccine for eligible children. Children who are not eligible need privately purchased vaccine. The Operations Guide says providers are not allowed to routinely borrow VFC vaccine for privately insured patients who are not eligible, that the immunization program approves borrowing only for unforeseen supply delays or circumstances, and that if a VFC provider does not carry private stock, it is not permitted to use VFC stock on non-VFC-eligible patients.
That limits what you can advertise. If you carry only program vaccine, a campaign inviting all children in town to get caught up on shots will bring in insured children you cannot vaccinate. Target the message to families who fit the categories, or carry private stock before you promote to everyone. The statute also says a program-registered provider is not required to administer a vaccine to each child who seeks it, so a page can say plainly which vaccines and which age groups you offer, as long as it is accurate.
Program vaccine is ordered and delivered through your immunization program, so avoid promising that a specific vaccine will be in stock on a specific date. A page that says to call ahead to confirm availability is more accurate than a page that lists a schedule you do not control.
Reminders, recall and the information families get before each shot
Immunization reminders and recall messages to your own patients are outreach that serves both the family and the practice. Under the definition of marketing in 45 CFR 164.501, a communication for treatment of an individual by a health care provider, or one describing a health-related service the covered entity provides, is not marketing unless the covered entity receives financial remuneration in exchange for making it. A reminder that a child is due for a vaccine fits that exception when no third party pays you to send it. If a manufacturer or other third party pays for the campaign, the analysis changes and written authorization may be needed. Consent and opt-out rules for automated texts and calls are in our guide to text message appointment reminders.
Before each dose, federal law requires a specific handout. Under 42 U.S.C. 300aa-26(d), a provider who administers a vaccine set forth in the Vaccine Injury Table must give the child’s legal representative a copy of the federal vaccine information materials before administration. You can link those materials from your vaccines page so parents can read them in advance, but the handout at the visit is still required.
Language access is written into the program. Subsection (c)(3)(B) of the statute directs each program to identify, for populations of vaccine-eligible children whose parents have limited English, providers who are able to communicate with them in the appropriate language and cultural context. If your staff speaks a language other than English, tell your immunization program, and say so on your vaccines page. List only languages your staff actually speaks during clinic hours.
Records that back up what you say
The CDC says federal fraud and abuse laws apply to VFC programs, and its fraud and abuse page uses the Medicaid definitions: fraud is an intentional deception or misrepresentation made with knowledge that it could result in an unauthorized benefit, and abuse includes provider practices that result in unnecessary cost to the immunization program, an insurer or a patient. The CDC eligibility page says a VFC provider cannot charge for vaccine supplied by public sources, so no invoice, statement or price list should show a charge for program vaccine.
The Operations Guide says VFC documentation is kept for at least 3 years, or longer if state law requires, even if a provider retires or a location closes. Keep marketing records alongside: the date each version of the vaccines page went live, the scripts your phone staff and AI front desk use, and any campaign aimed at families. If your immunization program asks why a family was told something, you want to show exactly what the page said that week.
Lead testing falls at the same 1 year and 2 year visits as several shots, and has its own rules: Medicaid requires blood lead tests at 12 and 24 months for enrolled children, and the USPSTF lead topic is now inactive. Our guide to childhood lead screening outreach covers those pages and reminders.
Illustration: two ways to announce VFC enrollment
Illustration: [Practice name] enrolls in the program and posts a banner that reads free childhood vaccines, no insurance needed. Insured families with high deductibles book visits, learn at check-in that their children are not eligible, and leave without the shots or with a bill for privately purchased vaccine. A parent who cannot pay the administration fee is told the fee is due at the visit. The banner overstated eligibility, left out the fee and the waiver, and the script conflicted with the statute.
Illustration: [Clinic name] waits until its provider agreement is executed and vaccine has arrived, then publishes a vaccines page that lists the eligibility categories its location serves, states that the vaccine itself is at no cost for eligible children, explains the administration fee and that it is waived for families who cannot pay, notes that other services at the visit are billed separately, and asks families to call ahead to confirm availability. The phone script and the AI front desk are updated the same day, and billing confirms VFC accounts are excluded from collections.
Checklist
- Announce VFC participation only after the provider agreement is executed and program vaccine has arrived.
- List eligibility categories in the CDC’s words, and only the ones your location serves.
- Do not tell insured families with unmet deductibles that their children qualify.
- Say the vaccine is at no cost for eligible children, and state the administration fee and the waiver at the outset.
- Say that other services at the visit are billed separately.
- Put the no-denial rule on the website, in phone and chat scripts and in the AI front desk instructions.
- Send a single bill for a non-Medicaid administration fee within 90 days, and keep these accounts out of collections.
- Promote vaccines to all children only if you carry private stock.
- Keep immunization reminders free of third-party payment, or get counsel’s view on authorization first.
- Give the federal vaccine information materials before each dose, and link them on your site.
- List only languages staff actually speak, and tell your immunization program.
- Keep dated copies of pages, scripts and campaigns with your VFC records.
How we help
We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For a VFC provider, that means a vaccines page with accurate eligibility and fee wording, phone and chat scripts that ask the eligibility questions and state the fee waiver, and booking flows that do not collect more than the visit needs. We do not decide whether a child is eligible or what fee you may charge; your immunization program and counsel do. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.
Can we advertise free vaccines as a Vaccines for Children provider?
Under 42 U.S.C. 1396s(c)(2)(C), an eligible child receives the vaccine without charge for its cost, but the provider may charge an administration fee up to a regional cap and may bill other services separately. Say the vaccine itself is at no cost for eligible children and state the fee and the waiver at the outset.
Which children qualify for the Vaccines for Children program?
Children 18 or younger who are Medicaid-eligible, uninsured, or American Indian or Alaska Native. Underinsured children qualify only at a federally qualified health center, a rural health clinic or under a deputization agreement. Children in a separate CHIP program are considered insured.
Can we turn a child away if the parent cannot pay the administration fee?
No. The statute says a provider will not deny administration to an eligible child because the parent cannot pay the administration fee, and the CDC says the fee must be removed for a family that cannot afford it.
Can we send unpaid VFC administration fees to collections?
No. The CDC Operations Guide says providers may issue only a single bill within 90 days for a non-Medicaid eligible child, may not send unpaid administration fees to collections, and may not refuse to vaccinate a child whose parents owe these fees.
Do we need to verify a family’s answers to the eligibility questions?
The statute says the provider asks the questions needed to decide eligibility but need not independently verify the answers. The CDC says the screening must be recorded at each visit, and records are kept for at least 3 years or longer under state law.
Is an immunization reminder text considered HIPAA marketing?
Under 45 CFR 164.501, a communication for treatment or about your own health-related services is not marketing unless you receive financial remuneration for sending it. Texting rules for consent and opt-out still apply.
Sources
- 42 U.S.C. 1396s: Program for distribution of pediatric vaccines
- CDC: About the Vaccines for Children (VFC) Program
- CDC: Vaccines for Children (VFC): Information for Providers
- CDC: Vaccines for Children (VFC) Program Eligibility
- CDC: VFC Program Operations Guide, July 1, 2026 to June 30, 2027 (PDF)
- CDC: VFC Fraud and Abuse
- 42 CFR 447.15: Acceptance of State payment as payment in full
- 42 U.S.C. 300aa-26: Vaccine information
- 45 CFR 164.501: Definitions (marketing)
- 16 CFR 251.1: Guide concerning use of the word free and similar representations
- 15 U.S.C. 45: Unfair methods of competition and unfair or deceptive acts or practices
- 15 U.S.C. 52: Dissemination of false advertisements
More in Physician specialty marketing