How to Offer Vaccines in a DPC Practice (VFC, Private Stock, Storage and Billing)

Can a DPC Practice Offer Vaccines?

Yes. A direct primary care practice can offer vaccines through four routes, which can be combined: free federal vaccine for eligible children through the Vaccines for Children (VFC) program, private stock the practice buys and resells or includes in the membership, a third-party vendor, and referral to a pharmacy or health department. The right mix depends on how many VFC-eligible children you serve, how much cash you can tie up in inventory, and whether you have opted out of Medicare. This guide is written for physicians and owners running a practice, it isn't medical advice for patients, and every rule below was checked on November 5, 2026.

The only DPC-specific data we found on how practices get their vaccines covers pediatrics. A survey sent to pediatric DPC physicians on July 11, 2023 and published in Cureus in 2025 had 73 physicians in its final analysis, and they could pick more than one answer about vaccine delivery. It's small and it's now a few years old, but it shows the range:

A 2025 follow-up by the same group, not peer reviewed, had 99 respondents: 22% used a local pharmacy, 20% VFC and 16% the health department. The slides also list a third-party vendor, but its share isn't legible in the copy we read.

For adult vaccines, we found only survey data on how practices charge. In a survey of DPC physicians in a 2020 Society of Actuaries report, 12% included adult immunizations in the membership, 53% charged extra and 36% did not offer them.

How Do You Enroll in the Vaccines for Children Program?

The CDC's VFC provider page says you don't have to be a Medicaid provider, and that any provider authorized by state law to give vaccines can participate. You contact your state, local or territorial immunization program manager, complete its enrollment forms, and prepare for a site visit on administrative requirements and storage. Annual training is required as well.

The commitment continues after enrollment. The July 2026 VFC Operations Guide tells programs to run a compliance site visit at each provider location every 24 months, to recertify each location every 24 months, and to send unannounced storage visits to at least 5% of locations during the budget period. Your staff must screen for eligibility and document it at every immunization encounter, not once a year.

Who qualifies for VFC vaccine?

Eligible children are 18 or younger and are uninsured, Medicaid-eligible or enrolled, American Indian or Alaska Native, or underinsured. Underinsured children can get VFC vaccine only at a federally qualified health center, a rural health clinic or a deputized location, and the guide treats children in a separate CHIP program as insured.

A membership can blur the word "uninsured" in everyday talk, because a family may think of the membership as their coverage. CDC's guide doesn't discuss memberships at all, so screen on the family's actual insurance status and ask your program about any case that feels unclear.

What can you charge for VFC vaccines?

The rules here are specific, and they sit awkwardly beside a flat monthly fee. Per the CDC and the Operations Guide:

• You cannot charge for the vaccine given to an eligible child.
• You may charge an administration fee per vaccine, up to a cap that varies by state on a regional scale CMS set, and you may charge nothing.
• If a parent can't afford the fee, it must be removed, and you can't refuse to vaccinate for that reason.
• For a child outside Medicaid, you may send one bill, within 90 days of the shot, and unpaid fees can't go to collections.
• For a child enrolled in Medicaid, you must accept the reimbursement set by the state program or its contracted plans.

We searched the Operations Guide and found no mention of membership fees or concierge arrangements. Two questions deserve a written answer from your program before you sign the provider agreement. First, can a membership that happens to include "immunization administration" stand alongside the fee cap? Second, what happens to the administration fee for a Medicaid-enrolled child if you aren't a Medicaid provider? CDC says you must become one to receive that payment, and the guide says to bill only Medicaid for that fee. Your family and child pricing is worth settling at the same time.

Can you keep VFC and private stock together?

Generally no. Unless you are in a universal purchase jurisdiction or approved for a replacement model, the guide says you must clearly separate VFC vaccine from privately purchased vaccine, and you can't use VFC stock on a child who isn't eligible. It also says routine borrowing of VFC vaccine for privately insured patients isn't allowed. CDC doesn't require you to stock every recommended vaccine for non-VFC patients if you don't plan to offer them. If you enroll in VFC, the rule runs the other way for VFC-eligible patients: you must stock all ACIP-recommended vaccines, apart from exempt ones such as COVID-19, monkeypox and PPSV23, which you still need a way to make available, unless your program designates you a specialty provider, which can limit you to the vaccines recommended for the population you serve. For a broader view of the pediatric model, see our pediatric DPC guide.

How Much Does Private Vaccine Stock Cost?

Private practices can't buy from CDC contracts. The CDC price list does publish private sector prices, which manufacturers report to CDC once a year, and CDC describes them as general information. The figures below come from its adult list dated September 30, 2026 (the file name says 10-01-26), rounded to the dollar. They cover only the presentations on CDC contracts, flu and COVID-19 prices sit on separate CDC lists, and your distributor's price may differ.

The packaging is what makes this a cash flow question. Recombinant zoster is listed as a pack of 10 single-dose syringes, so one box ties up about $2,427 before a single member gets a dose.

CDC's storage toolkit suggests reordering when you reach about a 4-week supply, which is a sensible anchor when you decide how deep to stock. Our vaccine supply and inventory guide covers the weekly routine for lots and expiration dates, and state dispensing rules are a separate question.

A third-party vendor that stocks your refrigerator and bills insurance is the other model, and a vendor was the most common answer in the 2023 survey above, though the survey doesn't describe how the model works. If only members can get it, Q-11 below also covers separate billing through insurance, and the notice doesn't say how it treats a vendor's own claims, so ask your tax adviser. Read those contracts closely for who owns expired doses and what the vendor needs from your records.

What Does CDC Require for Vaccine Storage and Handling?

CDC updated its full Vaccine Storage and Handling Toolkit on July 14, 2026. It's guidance for any provider, and for VFC providers it complements the VFC Operations Guide, which CDC calls their primary source, and product-specific rules come from the package insert or the FDA fact sheet. Your state program may add more, so read this as a summary of the full PDF, current as of today's check.

What happens after a temperature excursion?

Whoever notices the problem tells the coordinator, staff label the exposed vaccine as do not use and keep it apart at the correct temperature, and nobody throws it away yet. Then someone documents the date, time, temperatures, how long it lasted and the affected lots. CDC says not to use vaccine stored out of range unless public health authorities or the manufacturer confirm its safety and effectiveness.

What Records Does Federal Law Require?

Three duties apply whether the vaccine was free, included in a membership or sold separately, as long as it's on the Vaccine Injury Table. Under 42 USC 300aa-26, you give the patient or the child's legal representative the current Vaccine Information Statement before giving the vaccine. Under 42 USC 300aa-25, you record, in the patient's permanent medical record or a permanent office log or file a legal representative can see on request, the date, the manufacturer and lot number, and the name and address and, if appropriate, the title of the person administering it, and you report certain adverse events.

These fields are easy to lose when the lot number lives on a box and the visit lives in a separate system. State immunization registry reporting is a separate duty that varies by state, and your state's licensing and credentialing checklist is a good place to add it.

Should Vaccines Be Included in the Membership or Billed Separately?

The federal rules we read leave the choice to you for private stock, with one HSA condition on separate sales. Including them makes the fee simple but moves inventory and waste risk onto you. Selling them separately keeps your fee steady, and a clear price sheet keeps it honest.

The HSA rules allow either route. IRS Notice 2026-5 says prescription drugs other than vaccines fall outside primary care services, "therefore, vaccines are permitted primary care services." Its Q-12 also confirms that an arrangement still qualifies when providers offer items and services outside it to members and non-members alike and bill them separately. Its Q-11 says an arrangement does not qualify if it offers items on the condition of membership and bills for them separately, so a vaccine charge only members can get is the setup to avoid, and one to raise with your tax adviser. The fee limit for 2027 comes from IRS Rev. Proc. 2026-24, and our DPC and HSA guide has the full picture.

That limit is $150 a month for one person and $300 for a membership covering more than one person.

If you sell vaccines separately, a few decisions belong in writing before the first member asks: whether the price is your cost plus a set handling fee, whether a dose that expires unused is built into that fee, and whether you match a member's price to what a pharmacy could give them at no cost.

Will Insurance Reimburse Vaccines Given in a DPC?

Federal rules give insured patients strong coverage, but with a network condition that matters here. Under 45 CFR 147.130, most private plans must cover routine immunizations that have an ACIP recommendation adopted by the CDC director, with no cost sharing. The same rule says a plan with a network doesn't have to pay for those services from an out-of-network provider. The exception is when the plan has no in-network provider who can deliver the service, in which case it must cover it out-of-network with no cost sharing.

For a practice with no insurance contracts, that means a member's claim can be denied or paid in part, and you should say so plainly up front. If you want to help, give the member an itemized receipt with the vaccine code, the administration code and the diagnosis code Z23 so they can file it themselves. Our guide on insurance to pair with DPC covers the wider conversation.

Separately, the trade group AHIP said its member plans will keep covering all ACIP-recommended immunizations with no cost sharing through the end of 2027. CIDRAP's reporting described that as covering the recommendations in place while the litigation continues. It's a statement rather than a law, and it says nothing about how an out-of-network DPC is paid.

How Does Opting Out of Medicare Change Vaccines?

The AAFP's coding guide lists four preventive vaccines under Part B (COVID, flu, pneumococcal, and hepatitis B for people at intermediate or high risk), with no deductible or coinsurance. CMS says Part D plans cover the adult vaccines ACIP recommends with no out-of-pocket cost.

Now apply the opt-out rules. Under 42 CFR 405.425, no payment comes from Medicare or a Medicare Advantage plan, you can't submit a claim to Medicare, and you can furnish Medicare-covered items and services only through a private contract, apart from emergency or urgent care. Under 42 CFR 405.415, that contract has the patient agree not to file a claim with Medicare and acknowledge that Medicare won't pay. So a flu shot you sell an opted-out member is out of their pocket, while the same shot at a pharmacy that bills Medicare costs them nothing.

CMS's 2015 Part D prescriber FAQ says no Medicare payment may be made to a beneficiary for items or services an opted-out physician provides directly, apart from an emergency or urgent care situation, and CMS's manual limits that exception to a patient with no private contract. We found nothing that applies this to a Part D vaccine claim by name, so we wouldn't rely on one. The cleanest path we can see for an opted-out practice is a prescription or a plain referral. Hepatitis B needs an ordering physician's name and NPI on the claim. CMS's manual says Medicare pays for covered services an opted-out physician orders if that physician has an NPI, reports a Social Security number, has a valid opt-out affidavit on file and is of a specialty eligible to order, and the furnisher hasn't also opted out. Your Medicare contractor can confirm how this applies to you. Our guides to opting out of Medicare and DPC for seniors on Medicare go further.

What Is the Current ACIP and CDC Schedule Status?

This changes quickly, so here is exactly what we could confirm on November 5, 2026. On March 16, 2026, a federal district court stayed the January 2026 revision of the childhood schedule, the appointments of 13 ACIP members and their votes, according to the Congressional Research Service. The government appealed only the appointments, and the First Circuit heard argument on October 6.

We found no ruling on that appeal. The one First Circuit judgment we found from November 2 only affirmed the denial of an outside person's request to intervene. CDC's meeting page, updated October 9, lists all three of its 2026 ACIP meetings as cancelled because of the litigation and shows dates for February 2027, and a Federal Register notice asks for new ACIP nominations by December 31, 2026.

Sources don't fully agree on which version is in effect. CRS says the childhood schedule reverted to the version as of May 2025, CDC's schedules page shows addenda updated July 2, 2025, and Georgetown's Center for Children and Families wrote in March that the June 2024 schedule was back in effect. For flu, CDC states that recommendations from the July 2025 schedule remain in effect for the 2026-2027 season, "because of legal uncertainties and inquiries." AAP publishes its own 2026 schedule.

CRS also reported in June 2026 that the revised schedule came with no change to the VFC resolutions, and it judged private insurance coverage of vaccines unlikely to be affected in 2026. It wasn't speaking to 2027. It also noted that a May 2026 executive order directs CDC and ACIP to review the schedule and update it as the law allows, so the schedule could change by that route too.

Our advice is procedural, since the clinical call is yours. Name and date the schedule your practice follows in a written policy, list who rechecks it and how often, and look again at both CDC and AAP before you print anything for families.

How to Decide What Your Practice Offers

A short decision sequence keeps this manageable:

1. Count your panel by payer and age, including VFC-eligible children and Medicare members, since those two groups change the rules most.
2. Ask your immunization program the membership questions above, in writing, before you sign anything.
3. Pick a storage unit and data logger before any vaccine arrives.
4. Choose the handful of private-stock vaccines your panel will use, using the 4-week reorder guide, and refer the rest with a named pharmacy or health department. If you enroll in VFC, you must stock all ACIP-recommended vaccines for VFC-eligible patients, unless your program designates you a specialty provider limited to the vaccines recommended for the population you serve, and CDC's VFC guide says pediatricians aren't. Exempt vaccines such as COVID-19, monkeypox and PPSV23 don't have to be stocked, though you need a way to make them available.
5. Write the price sheet, the opt-out language for Medicare members and the schedule policy, and put a date on each.

Once it's running, the hard part is the follow-up between systems, like a second dose coming due, the lot recorded next to the right patient and the eligibility status on the visit. Tabflows is a dedicated tech team that connects the tools a clinic already uses, so those tasks land in one place with the patient's context attached. If you're still building the practice, our 2027 guide to starting a DPC puts vaccines in context.