A child turns two. The birthday party happens. And somewhere in your EHR, a Childhood Immunization Status (CIS-10) measure quietly closes — compliant or not. There is no grace period. No “close enough.” CIS-10 childhood immunization compliance requires all 10 vaccines administered by the second birthday, and the timing rules that govern each one are more specific than most practice teams realize.
CIS-10 is one of the highest-priority HEDIS measures in pediatric primary care, and it is one of the most commonly missed — not because practices skip vaccines, but because they administer them outside the windows that count. A dose given six days too early. A flu vaccine series that started too late to fit both doses before the birthday. An MMR administered three days before the child turned one. Each of these is a clinical non-event but a compliance failure.
This guide breaks down the timing rules vaccine by vaccine, flags the mistakes we see most often, and shows how your practice can build these windows into daily workflow.
What CIS-10 Childhood Immunization Compliance Actually Requires
The CIS-10 measure calculates the percentage of children who received all recommended vaccines by their second birthday. “All” means all 10 antigens — not nine, not “most.” A child who is missing a single qualifying dose is non-compliant for the entire measure.
The full CIS-10 vaccine list includes:
Four doses of DTaP (diphtheria, tetanus, acellular pertussis)
Three doses of IPV (polio)
One dose of MMR (measles, mumps, rubella)
Three doses of HiB (haemophilus influenza type B)
Three doses of HepB (hepatitis B)
One dose of VZV (varicella/chicken pox)
Four doses of PCV (pneumococcal conjugate)
One dose of HepA (hepatitis A)
Two or three doses of RV (rotavirus, depending on manufacturer)
Two doses of influenza (flu)
That is up to 24 individual doses across 10 antigens, all before the child’s second birthday. Every dose has its own eligibility window — and administering outside that window means the dose does not count toward compliance, even if it was clinically appropriate.
The 42-Day Rule and the Birthday Window
Two timing rules trip up more practices than any others. Understanding both is essential to avoiding preventable non-compliance.
The 42-Day Rule
DTaP, IPV, HiB, PCV, and RV cannot be counted if administered within the first 42 days after birth. A dose given on day 41 does not count. This matters because birth-dose HepB is standard practice — but practices sometimes bundle early well-child visits with additional vaccines before the 42-day mark. Those doses will need to be repeated to count toward CIS-10.
The Birthday Window for MMR, VZV, and HepA
These three vaccines must be given on or between the child’s first and second birthdays. A dose administered even one day before the first birthday is non-compliant. A dose administered on the second birthday is too late — the measure closes before that visit counts. The compliant window is the first birthday through the day before the second birthday. This is a 365-day window that feels wide until a child misses their 12-month visit and does not come back until 23 months — leaving almost no runway for catch-up if additional doses are needed.
Flu and Rotavirus — The Series That Runs Out of Time
Influenza Requires Two Doses
CIS-10 requires two flu vaccines before the second birthday. For children receiving influenza vaccine for the first time, the two doses must be given at least 28 days apart. Both doses must land before the child turns two. One of the two doses can be a live attenuated influenza vaccine (LAIV), but only if administered on the child’s second birthday — the single exception to the “before the second birthday” rule. Practices that wait until late fall to start the flu series in a child turning two in December or January are often working against a window that has already closed. Key CPT codes for influenza: 90655, 90657, 90661, 90673, 90685–90689. For LAIV administered on the second birthday: 90660, 90672.
Rotavirus Has a Manufacturer-Dependent Dose Count
The rotavirus series requires either two doses (Rotarix, CPT 90681) or three doses (RotaTeq, CPT 90680). Both are oral vaccines with strict age limits set by the manufacturer — and like all CIS-10 antigens, doses given in the first 42 days after birth do not count. Because the series must also complete before the second birthday, a late start can make it impossible to finish the full sequence in time.
Coding That Counts — and Documentation That Does Not
Compliance is only as good as what shows up in claims data. A vaccine administered but not coded correctly is a vaccine that does not exist for HEDIS purposes. Every antigen in the CIS-10 measure has specific CPT and CVX codes that must be submitted. For example, DTaP maps to CPT codes 90697, 90698, 90700, and 90723. HepB maps to CPT codes 90697, 90723, 90740, 90744, 90747, and 90748 — plus HCPCS code G0010 for the administration. PCV uses CPT 90670 and HCPCS G0009.
Combo vaccines count toward multiple antigens simultaneously. A single Pediarix injection (CPT 90723) covers DTaP, IPV, and HepB in one dose — and one claim. When your team documents combo vaccines correctly, it reduces the number of discrete claims needed and lowers the chance that a qualifying dose gets lost in the data.
One critical documentation note: a chart entry stating “child is up to date with all immunizations” does not meet compliance criteria. HEDIS requires specific vaccine codes with dates of service. General attestations, no matter how accurate clinically, do not close the gap. Use your state’s Immunization Registry Portal to document and track all administered vaccinations, and request previous immunization records for new or recently transferred patients. If records cannot be found, the CDC recommends considering the patient susceptible and starting them on the age-appropriate schedule rather than accepting self-reported doses without written documentation.
Building Timing Rules Into Your Practice Workflow
Knowing the rules is step one. Embedding them into daily operations is where compliance actually improves. We work with practices to build CIS-10 timing awareness into three layers of the care workflow.
Chart Prep and Visit Planning
CareEmpower®’s Chart Prep Tool surfaces each child’s immunization status before every visit — not as a generic “immunizations due” flag, but as a specific list of which antigens are needed, which are approaching their eligibility windows, and which visits should be converted from sick to well-child to capture the opportunity. When a 14-month-old comes in for an ear infection and is missing their MMR and VZV, the Chart Prep Tool prompts the team to address both during the same visit.
Panel-Level Prioritization
CareEmpower prioritizes your patient panel by recommended next visit date and compliance risk. Children approaching their second birthday with outstanding immunization gaps rise to the top of the worklist — giving your team time to outreach, schedule, and complete the series before the window closes. This is where our partnership with TrackMy adds precision: refined member targeting identifies the specific remaining gaps (such as an outstanding influenza dose) so outreach is focused, not generic.
Practice Coaching on Immunization Workflows
Your Practice Performance Advisor (PPA) can work with your team on scheduling cadence, documentation accuracy, and parent communication strategies. That includes aligning well-child visit scheduling with EPSDT periodicity standards so immunization windows are built into the appointment cadence from the start — not chased after the fact.
The Window Is Fixed — Your Workflow Does Not Have to Be
CIS-10 childhood immunization compliance is a pass-fail measure with a hard deadline. Every timing rule described here — the 42-day minimum, the birthday window for MMR, VZV, and HepA, the two-dose flu series, the manufacturer-dependent rotavirus schedule — is built into how the measure is scored. You cannot negotiate with a HEDIS specification.
But you can build a practice workflow that accounts for every one of these rules before the child walks through the door. The practices in our network that perform best on CIS-10 are not doing anything heroic. They are using their worklists, prepping their charts, converting sick visits to well-child visits when the opportunity is there, and coding every dose correctly the first time. The timing rules are strict. The workflow to meet them does not have to be complicated.
