Immunization Recall: Automate the Due List, Not the Advice

A toddler misses a well visit in March, the reminder card goes to an old address, and nobody at the practice notices until a parent calls in August needing a day care form. There was no refusal and no decision. A due date passed and nothing was tracking it.

Tracking due dates is the part that works. The Community Preventive Services Task Force reviewed 29 studies of reminder and recall programs and found vaccination rates rose by a median of 11 percentage points. A 2018 Cochrane review of 75 studies concluded that reminders and recall probably raise the share of patients who get vaccinated.

This post covers the operations only: where the due list comes from, why the state registry outranks your chart, what a message may say, how to handle school requests, and where an AI receptionist fits. It contains no vaccine advice. Which vaccines a patient needs is a decision for your clinicians and the patient.

Reminder or recall: what the terms mean and what your practice owns

A reminder tells a patient that a vaccination visit is coming due; a recall tells them it is overdue. Both run on a schedule your clinicians adopt, usually the CDC schedule built from ACIP recommendations. Automation keeps the clock and sends the notice. It never decides who should receive which vaccine.

The definitions come from the Community Guide: reminders say vaccinations are due, recall says they are late, and either can go by telephone, letter, postcard or text. A reminder goes out before the due date and a recall chases a patient who has passed it, so each needs its own timing.

This is narrower than general recall. Inviting back every patient who has not visited in 18 months is reactivation, covered in our guide to patient recall and reactivation. Immunization recall runs on dose dates and intervals, reads from a public health registry, and often reaches a parent rather than the patient.

The clock itself moved in 2026, which is why ownership matters. According to a June 2026 Congressional Research Service report, CDC's acting director approved a revised childhood schedule in January 2026 without the usual ACIP process. On March 16, 2026, a federal district court in Massachusetts stayed it, reverting the schedule to the version as of May 2025, and the government appealed on April 29. The same report notes that professional medical societies have published their own childhood schedules and that some states have adopted them in their vaccine policy. News reports in mid-September 2026 said the stay remained in place while the appeal was pending.

For a reminder system, the lesson is procedural. The rules your due list runs on are a clinical decision. A named physician signs them, the file records which schedule and which version, and someone checks them again whenever a published schedule changes. The software follows that decision. It does not choose a schedule, and neither does the front desk.

What the evidence says reminder and recall can do

Reminder and recall is one of the best-studied tools in immunization. The Community Preventive Services Task Force found a median gain of 11 percentage points across 29 studies, and a 2018 Cochrane review pooled 55 studies to a risk ratio of 1.28. Gains are larger when reminders are paired with other changes.

The Task Force recommended reminder and recall on strong evidence in May 2015, and its finding splits that 11-point median two ways. Used alone, reminder and recall raised vaccination rates by a median of 6 percentage points across 14 studies. Combined with other components, the median was 12 points across 15 studies. The economic review, in 2013 dollars, put the median cost at $2.13 per person per year and $15 per additional person vaccinated.

The Cochrane review, by Jacobson Vann and colleagues, rates its pooled result as moderate certainty: a risk ratio of 1.28 and a risk difference of 8%, from 55 studies with 138,625 participants. Put plainly, reminders added roughly 8 vaccinated people for every 100 patients sent one.

Published findings, each with its source. Effects vary by channel, sender and population.

The review also tested single delivery methods, the choice a practice faces when it sets up automation:

Text is not automatically the winner. In a 2017 to 2018 trial of registry-run flu reminders for children, autodialer calls raised rates by 1.4 percentage points in New York and 3.0 in Colorado over no reminder, while texts in New York did no better than the control group. Test the channel on your own patients instead of assuming it.

Who sends the notice matters, and so does whether anyone sends it. In a Colorado trial, practices were offered webinar training and money for mailings, and 10 of 195 practices ran recall. Recall run centrally from the state registry cost $17 per child brought up to date, against $62 when practices ran it. In a follow-up trial of 18,235 children, the registry's effect on up-to-date status was greater when the child's own practice endorsed the notice: 19.2% against 9.8%.

Why the state registry, not your chart, decides who is due

Your chart only knows the doses your practice gave or recorded. An immunization information system, the state or local registry, consolidates doses reported by participating providers, from pharmacies to health departments, into one record. Query it before every recall cycle, or your messages will chase patients who were already vaccinated somewhere else.

CDC defines an IIS as a confidential, population-based, computerized database that records all immunization doses given by participating providers to people living in a given area. CDC lists the functions that matter here: registries combine immunization information from different sources into a single record, provide official records for school, day care and camp entry, and remind families when an immunization is due or has been missed.

Reporting to the registry is the other half of the loop. HIPAA permits disclosure to a public health authority that is authorized by law to collect information for preventing or controlling disease, under 45 CFR 164.512(b)(1)(i). State law decides the rest, and CDC's summary of registry policy shows how much varies by jurisdiction:

• Consent: some registries include patients unless they opt out, some require them to opt in, and some include everyone with no opt-out.
• Reporting: some jurisdictions mandate reporting of every dose for everyone, some only for a subset such as children 18 or younger, some only for certain providers or vaccines, and some leave it voluntary.
• Data sharing: each jurisdiction sets its own rules for who may receive registry data.

Check your state's reporting, consent and access rules before you design anything, and confirm them with counsel or your state immunization program.

The connection itself is where many practices stall. In a 2015 national survey of primary care physicians in states with a registry, 48% of general internists did not know a state or local registry existed, against 5% of pediatricians. The most commonly reported major barrier to using one was the registry not updating the electronic medical record. If your EHR does not pull registry data back in, the due list it builds is partial.

How to build a due list that stays accurate

A due list is a forecast: the patient's recorded doses, run through schedule rules, produce the next due date. CDC publishes forecasting logic that registries and EHR vendors can build on. Your work is keeping the inputs clean: registry data merged in, patient status current, and clinician-documented exceptions respected rather than guessed.

CDC calls this evaluation and forecasting and publishes the logic as Clinical Decision Support for Immunization (CDSi), written for anyone building a forecasting engine, registries included. The current logic specification is version 4.6, from December 2024, with supporting data updated to version 4.65 in August 2026. Ask your EHR or registry vendor which version their engine runs and how quickly it picks up a schedule change.

Patient status is the input most practices ignore. Guidance from the American Immunization Registry Association says active status with a provider makes that provider responsible for the patient's vaccinations, and active patients are the ones on the provider's reminder and recall lists. Mark patients who have moved or transferred care as inactive. Record deaths promptly; the same guidance notes that excluding deceased patients from mailed recall avoids distress to their families.

Every cycle starts and ends at the registry, so the next list reflects doses given anywhere.

Exceptions belong to clinicians. A documented medical reason, a parent's documented decision, or a request to defer is recorded by clinical staff, and the due list honors the flag. Front-desk staff and software never infer one from a missed visit or an unanswered text, and never drop a patient from the list on their own.

Capacity is part of the list. CDC's quality-improvement guidance for vaccination providers says to schedule the next appointment before the patient leaves and to build clinic schedules out into the future so caregivers do not have to remember to call back once the schedule opens. A recall wave that lands when well-visit slots are full 3 weeks out produces phone calls, not visits.

What a recall message says, and what it never says

The message says who it is from, that a visit is due for a named patient, and how to book. It leaves out vaccine names, doses and health details, because texts land on shared phones and lock screens. Anything that sounds like a recommendation belongs to a clinician, not an automated message.

A text that follows that rule is short:

• "Hi, this is [Practice]. [First name] is due for a visit with us."
• "Book at [link] or call [number]."
• "Reply STOP to opt out."

HHS says the Privacy Rule lets providers communicate with patients at home, by mail or phone, and that a provider should limit what it discloses, for example leaving only its name and number and the information needed to confirm an appointment. A due-visit text applies the same logic to a screen anyone in the household might see. If a patient asks to be reached another way or at another number, HHS says to accommodate reasonable requests, so the chart's contact preference drives the channel.

Two details trip up immunization recall. A child's notice goes to the parent or guardian on file, so that contact record has to be current. For an adolescent, check whose number is on file and what state law and your policy say about confidential care. Texting also carries its own consent and opt-out rules outside HIPAA, so confirm your consent language with counsel before the first automated send.

In the studies the Task Force reviewed, many of the notices also carried educational messages about vaccination. If your practice wants that, your physicians write and approve it. The automated notice itself stays at "a visit is due" and "here is how to book."

School forms and the HIPAA rule for proof of immunization

Schools ask parents for immunization proof, and those calls land at your front desk. Under 45 CFR 164.512(b)(1)(vi), a practice may send that proof directly to a school that state or other law requires to have it, once a parent agrees and the practice documents the agreement.

The regulation sets three conditions. The information disclosed is limited to proof of immunization. The school must be required by state or other law to have that proof before admitting the student. And the practice must obtain and document agreement from a parent, guardian or other person acting in loco parentis for an unemancipated minor, or from the student if the student is an adult or an emancipated minor.

HHS's FAQs keep the paperwork light. The agreement does not need a signature or the elements of a HIPAA authorization. A copy of a parent's written or email request is enough documentation, and so is a note in the chart recording a parent's phone request. That documentation must be kept for 6 years. HHS expects agreement will usually be obtained when a particular disclosure is needed, though a parent may agree to several disclosures over time, such as updates as a series is completed.

That suits a structured phone workflow. A receptionist, human or AI, can take the call, confirm who is calling and which school, record the parent's agreement in the chart with the date, and hand the send to staff. Your state registry may also be able to produce the official record.

State law adds its own rules on school forms and minors' records. This is a summary of federal text, not legal advice, so confirm your release workflow with counsel.

Set up recall on one cohort before the whole panel

Start with one group your clinicians choose, such as patients approaching one well-visit age, and run the full loop for 6 months. Measure the up-to-date rate the registry reports for that group, not messages sent. Expand only when the list is clean, the schedule has room and replies reach the right person.

Each step has one owner. The schedule rules belong to a physician, never to the software.

The steps are short; ownership is the hard part. The registry connection is usually a project with your EHR vendor and your state immunization program, and list hygiene is a weekly task with a named person.

Measure what the trials measured. The Colorado studies counted children who received any new dose or became up to date within 6 months. Counting texts delivered tells you the software ran. Counting doses recorded tells you the recall worked.

Adults follow the same discipline with a weaker registry connection, since that survey found internists the least likely to know their registry existed. If your adult patients are already on a wellness or chronic care outreach cadence, fold the due date into it rather than starting a second campaign; the outreach cadence for wellness and chronic care visits shows how one schedule can carry several reasons to come in.

Field note

Before the first recall notice goes out

• A physician has signed the schedule rules, with the version and date on file.
• This cycle's due list was reconciled against the state registry.
• The text names the practice, says a visit is due and gives a booking path, nothing clinical.
• Vaccine questions in replies route to a nurse or clinician, and that path has been tested.

Where an AI receptionist fits in immunization recall

An AI receptionist handles the logistics around recall: answering the reply, booking the visit, rescheduling, taking a school-form request and logging the parent's agreement. It never recommends a vaccine, answers whether a child needs one or discusses exemptions. Those questions go to clinical staff, with the caller's name and callback number.

Recall creates phone traffic. Every wave of notices brings calls and replies: parents booking, rescheduling, asking about the shot, asking for the school form. That traffic is where recall stalls at a busy front desk, and it is the part an AI receptionist can absorb, provided the boundary is written down. What an AI receptionist does and where it stops covers that boundary in general; for immunization recall it is narrow and strict.

Three checks before a notice goes out. Every path ends with a logged outcome.

Walk the flow for each patient on the list. A dose the registry already shows gets reconciled into the chart, not chased. A clinician's documented hold stays with the clinician. A patient with no consent on file for texting gets a mailed notice or a staff call. Everyone else gets the short notice: a visit is due, and here is how to book. Each path ends with an outcome in the log, so next cycle's list starts clean.

An AI system that answers recall replies handles patient information, so the vendor signs a business associate agreement before the first message goes out. To see what ours handles and how it passes clinical questions to your staff, read how the Cart Gaze AI receptionist answers and routes patient calls.