VAERS Reporting: Who Must Report, When, and What the Data Can Support

The Vaccine Adverse Event Reporting System (VAERS) is a national passive surveillance system, established in 1990 and co-managed by the U.S. Centers for Disease Control and Prevention (CDC) and the Food and Drug Administration (FDA). It exists to detect signals — unusual or unexpected patterns of reporting that warrant a closer look — in U.S.-licensed vaccines. It does not exist to determine whether a vaccine caused anything.

That distinction is not a disclaimer bolted onto the system. It is the system’s design specification, and it governs both what you are legally obliged to send to VAERS and what anyone may legitimately conclude from what comes out. This page covers the reporting duty as it actually falls on providers and manufacturers, the two federal tables that are routinely confused with one another, what happens to a report after it is filed, how VAERS differs mechanically from FAERS, and the documented limits of the resulting dataset.

Who must report, and on what legal footing

Three groups can file a VAERS report, and they sit on three completely different legal footings. Conflating them is the single most common error in discussions of VAERS data, because it is what makes the database look like a register of verified injuries rather than a mailbox.

Reporter	Obligation	Legal basis
Healthcare providers	Required to report events on the VAERS Table of Reportable Events Following Vaccination occurring within the specified interval, and any reaction the manufacturer lists in the package insert as a contraindication to further doses. Strongly encouraged to report any clinically significant event after a U.S.-licensed vaccine, and any vaccine administration error, whether or not a vaccine is thought to have caused it.	42 U.S.C. § 300aa-25(b), enacted as § 2125 of the National Childhood Vaccine Injury Act of 1986 (Pub. L. 99-660), amended 1987
Vaccine manufacturers	Required to report every adverse experience that comes to their attention, from any source, foreign or domestic. Serious and unexpected experiences go in as 15-day “Alert reports”; the remainder go in periodic reports.	21 CFR 600.80(b)–(c)
Anyone else	Voluntary. Patients, parents and caregivers are encouraged to report. VAERS accepts all reports, from any source, without screening them for plausibility first.	None — open submission

The statute is narrower than most people assume. 42 U.S.C. § 300aa-25 has two operative parts: subsection (a) is a recording duty — every provider administering a vaccine on the Vaccine Injury Table must record the administration date, the manufacturer and lot number, and the administering provider’s name, address and title in the patient’s permanent record or a permanent office log. Subsection (b) is the reporting duty, and it reaches exactly three categories: events set forth in the Vaccine Injury Table within the specified interval, contraindicating reactions specified in the manufacturer’s package insert, and “such other matters as the Secretary may by regulation require.”

Everything beyond those three categories — the great majority of what is actually in VAERS — is encouraged, not mandated. That is a feature: the encouragement is what lets the system catch a signal nobody thought to put on a table. But it means the report volume for any given event reflects reporting behaviour at least as much as it reflects event occurrence.

The two tables: reporting trigger vs. compensation presumption

There are two federal vaccine tables. They overlap, they are both descended from the same 1986 statute, and they do entirely different jobs. Treating them as one document is a persistent source of error in both directions.

	Table of Reportable Events Following Vaccination (RET)	Vaccine Injury Table (VIT)
Purpose	Defines when a healthcare provider’s VAERS report is legally mandatory	Defines when a petitioner in the National Vaccine Injury Compensation Program gets a presumption of causation rather than having to prove it
Where it lives	Published by HHS and maintained on vaers.hhs.gov; it is not itself a codified CFR section	Codified at 42 CFR 100.3
Administered by	CDC and FDA, through VAERS	HRSA, adjudicated in the U.S. Court of Federal Claims
Consequence of a match	You must file a report	Causation is presumed absent an alternative explanation

Check the citation you were given. 42 CFR 100.3 is frequently cited as though it were the reportable-events table. It is not — 100.3(a) is the Vaccine Injury Table, and 100.3(b)–(d) are the qualifications and aids to interpretation the Court applies when adjudicating a claim. If your SOP cites 42 CFR 100.3 as the source of your reporting triggers, it is pointing at the compensation table. The operative reporting triggers must be read from the RET as HHS currently publishes it, because the two are maintained separately and are not guaranteed to stay aligned.

VAERS itself is explicit on the separation: filing a VAERS report is not connected to filing a claim with the National Vaccine Injury Compensation Program (VICP) or the Countermeasures Injury Compensation Program (CICP), both of which are administered by HRSA and are entirely separate from VAERS.

Representative onset intervals from the Vaccine Injury Table

These are drawn from the current text of 42 CFR 100.3(a). They are the compensation intervals; they illustrate how tightly the statutory scheme is keyed to onset timing, and several are mirrored in the reporting table. Verify against the RET before using any of them as a reporting trigger.

Vaccine class	Condition	Onset interval
Tetanus-toxoid-containing (DTaP, DTP, DT, Td, TT)	Anaphylaxis	≤ 4 hours
Tetanus-toxoid-containing	Brachial neuritis	2–28 days
Pertussis-containing	Encephalopathy or encephalitis	≤ 72 hours
Measles/mumps/rubella-containing	Encephalopathy or encephalitis	5–15 days
Rubella-containing	Chronic arthritis	7–42 days
Measles-containing	Thrombocytopenic purpura	7–30 days
Live oral polio (OPV)	Paralytic polio, non-immunodeficient recipient	≤ 30 days
Live oral polio (OPV)	Paralytic polio, immunodeficient recipient	≤ 6 months
Rotavirus	Intussusception	1–21 days
Seasonal influenza	Guillain-Barré syndrome	3–42 days
Most listed classes	Shoulder injury related to vaccine administration (SIRVA)	≤ 48 hours
Most listed classes	Vasovagal syncope	≤ 1 hour

Two structural features of the table are worth knowing operationally. First, any acute complication or sequela — including death — of a listed condition qualifies as a Table injury, unless the condition’s own definition in 100.3(c) excludes it. Second, item XVII is a forward-looking catch-all: any new vaccine CDC recommends for routine administration to children and/or pregnant women is brought into the table once the Secretary publishes a notice of coverage, initially with SIRVA (≤ 48 hours) and vasovagal syncope (≤ 1 hour).

Product-specific mandates layered on top

The baseline duty is not the whole duty. Emergency Use Authorizations and individual product conditions impose their own reporting obligations on the administering provider, and they are broader than the RET. Current examples from VAERS’ own reporting guidance:

• Vaccines given under an EUA. Vaccination providers are required to report all vaccine administration errors, whether or not associated with an adverse event, and all serious adverse events regardless of causality — using FDA’s seriousness definition (death; life-threatening event; inpatient hospitalisation or its prolongation; persistent or significant incapacity or substantial disruption of the ability to conduct normal life functions; congenital anomaly or birth defect; or an important medical event that in appropriate medical judgment may require intervention to prevent one of those outcomes).
• COVID-19 vaccines. Beyond the serious-event and administration-error mandates, VAERS names specific events for mandatory reporting: myocarditis, pericarditis, cases of Multisystem Inflammatory Syndrome in children and adults, and cases of COVID-19 resulting in hospitalisation or death.
• JYNNEOS and ACAM2000 (mpox). The vaccination provider must report all serious adverse events irrespective of attribution, all administration errors, cardiac events including myocarditis and pericarditis, and thromboembolic and neurovascular events. Route matters on the form — intradermal and subcutaneous are both authorised administration routes for JYNNEOS and must be recorded in Section 17.
• Beyfortus (nirsevimab) — a routing trap. Nirsevimab is a monoclonal antibody, not a vaccine. If it was co-administered at a visit with one or more vaccinations, report to VAERS. If it was given alone with no vaccination at the same visit, report to MedWatch instead. Sending it to the wrong system is a common and avoidable error.

The general principle for a pharmacovigilance operation: your reporting matrix has to be product-specific and authorisation-specific, not a single generic rule. An EUA product and its licensed successor can carry different mandatory reporting sets on the same day in the same clinic.

What actually happens to a report

Understanding the intake process is what makes the dataset’s limitations concrete rather than abstract.

1. Acceptance without adjudication. VAERS accepts all reports, including reports of vaccination errors, without judging whether the vaccine caused the event or how serious it was. There is no gate at submission.
2. A VAERS ID is issued. Every report gets an identification number, returned to the reporter in a confirmation letter electronically or by post. That number is how follow-up information is attached later.
3. Follow-up is minimal and one-directional. Other than the confirmation letter, VAERS contacts the reporter only if “essential fields” were left blank — and it does not do that by telephone. Requests go out electronically or by post.
4. Serious reports trigger record retrieval. For reports classified as serious, the VAERS programme attempts to obtain medical records — requested directly from the health institution or public health authority holding them, not from the reporter — and adds them to the permanent record under the VAERS ID. This is the only routine verification step in the system, and it applies to a minority of reports.
5. False reports are a federal offence. Knowingly filing a false VAERS report violates 18 U.S.C. § 1001 and is punishable by fine and imprisonment. Note what this does and does not imply: it deters deliberate fabrication; it does not verify anything, and it does not convert an unverified report into a confirmed event.

Identifying information about the vaccine recipient and the reporter is withheld from public release. Under 42 U.S.C. § 300aa-25(c), the protected set is narrowly drawn: names, street addresses and telephone numbers of the recipient and their legal representative, and the recipient’s medical records relating to the vaccination. Everything else — the locality and state of administration, the administering provider’s name, the vaccination date, and the reported condition, symptoms or death — is expressly outside the protected set, and all information reported under the section is otherwise available to the public.

VAERS vs. FAERS: the same idea, different statutes

Both are passive spontaneous-reporting systems run by FDA-adjacent programmes, and both feed signal detection rather than causal inference. The differences that matter operationally are in who is compelled to report, under which regulation, and what ends up in the record.

Dimension	VAERS	FAERS
Products covered	U.S.-licensed vaccines (plus specified EUA products and co-administered items)	Approved drugs and therapeutic biologic products
Operated by	CDC and FDA jointly	FDA
Clinician duty to report	Statutory mandate for listed events — 42 U.S.C. § 300aa-25(b)	Voluntary for health professionals and consumers, via MedWatch
Industry duty to report	21 CFR 600.80 — all adverse experiences; 15-day Alert reports for serious and unexpected	21 CFR 314.80 — 15-day Alert reports for serious and unexpected, plus periodic reports
Patient identifiers in industry reports	Vaccine ICSRs include patient name, address and telephone number — 21 CFR 600.80(g)(1)	Non-vaccine biologic and drug ICSRs use a patient identification code instead — 21 CFR 600.80(f)(1), (j)
Downstream custody	Vaccine adverse-experience reports become part of CDC Privacy Act System 09-20-0136	Held within FDA
Enforcement lever	Failure to keep records and report can support revocation of the biologics licence — 21 CFR 600.80(l)	Application-level enforcement under 21 CFR 314.80

The identifier asymmetry in the middle of that table is the one most often missed and the one most likely to bite a pharmacovigilance team writing a single global intake SOP. Under 21 CFR 600.80(j), applicants are told not to include patient names and addresses for non-vaccine biological products — but 600.80(g)(1) requires exactly that information on vaccine ICSRs, because those reports flow into a CDC system that has to be able to retrieve medical records for serious cases. A one-size-fits-all redaction rule will either break the vaccine pathway or over-collect on the drug pathway. Manufacturers must also retain records of all known adverse experiences, including raw data and correspondence, for ten years under 600.80(k).

For the trial-stage counterpart of these obligations — adverse event, serious adverse event and SUSAR handling under ICH E2A — see pharmacovigilance in clinical research. The site-level obligation to escalate certain events to an ethics committee is a separate track again; see adverse event reporting to the IRB. The underlying side effect vs. adverse event distinction matters here too: VAERS collects the latter, and makes no claim about the former.

What VAERS data can and cannot support

CDC and FDA publish the system’s limitations themselves, and they are unusually blunt about them. Any analysis built on VAERS has to be built inside these constraints.

The limitations, as the programme states them

• Causation generally cannot be determined from VAERS data. The programme’s own language: some reports represent true vaccine reactions and others are coincidental health events unrelated to vaccination, and “a causal relationship cannot be established using information from VAERS report alone.”
• Reports are unverified and often incomplete. Reports “often lack details and sometimes contain errors.” Only serious-classified reports routinely trigger medical-record retrieval.
• Reporting is differential by seriousness. Serious adverse events are more likely to be reported than non-serious ones, so the severity distribution inside VAERS does not mirror the severity distribution of post-vaccination events in the population.
• Stimulated reporting is real and measurable. Report counts “may increase in response to media attention and increased public awareness.” A rise in reports is therefore ambiguous between a change in event rate and a change in reporting behaviour, and cannot on its own distinguish them.
• Rates cannot be computed. VAERS data “cannot be used to determine rates of adverse events.” There is no denominator: the system has no reliable count of doses administered to the reporting population, and no comparison group.
• Under-reporting is the structural counterpart. A passive system captures only what someone chooses to send. The mandated-reporter duty raises the floor for listed events; it does not make capture complete, and the completeness of capture varies by event, by product and over time.

The counting artefact almost nobody accounts for

On 8 May 2025, CDC and FDA expanded public access to VAERS data in CDC WONDER and in the downloadable VAERS files. Before that date, the public data sets contained only the primary report — the first report submitted for a given patient, vaccine and dose combination. From May 2025, the public data sets also include secondary reports: the first report from an additional source who had not previously reported the same patient, vaccine and dose.

The operational consequence is specific and easy to get wrong. Downloadable files now appear to contain additional reports. VAERS states plainly that these are not additional adverse events — they are subsequent reports of already-reported events that were previously excluded from the public extract. Any time series that spans May 2025 without accounting for this will show a step change that is an artefact of the extract definition, not of anything that happened to anyone. If you maintain trend dashboards on VAERS downloads, this is the first thing to check.

What a report is, and is not

Stated as plainly as the programme states it: a VAERS report is a claim by a reporter that a health event occurred after a vaccination. It is not a determination that the vaccine caused the event, it is not a verified medical finding, and it is not a compensation decision. The presence of a report establishes that someone reported it. That is the whole of what it establishes on its own — which is exactly why the system is valuable for generating hypotheses and useless for settling them.

What VAERS hands off to: VSD, CISA and active surveillance

Because VAERS is designed to generate hypotheses, the architecture around it exists to test them. VAERS’ own documentation describes it as “a tool for identifying potential vaccine safety concerns that need further study using more robust data systems.” Those systems are the second half of the answer to “what does this signal mean.”

• Vaccine Safety Datalink (VSD). A CDC collaboration with integrated healthcare organisations that draws on their electronic health records rather than on spontaneous reports. Because it has an enrolled population, it has a denominator and a comparison group — so it can estimate rates and test associations, which VAERS cannot. It is active surveillance: the data arrive whether or not anyone decides to file something.
• Clinical Immunization Safety Assessment (CISA) Project. A CDC programme whose clinical-consultation function is referenced directly in VAERS’ own FAQ: healthcare professionals can request a clinical consultation from CISA for particularly complex individual patient cases. Where VSD answers population questions, CISA addresses the individual clinical question a VAERS report cannot — what happened to this patient, and what should be done about their next dose.
• FDA active surveillance. On the medicines side, the FDA Sentinel Initiative performs the analogous active, claims-and-EHR-based post-market surveillance function, and the same passive/active logic applies.

The correct mental model is a pipeline, not a scoreboard: passive reporting detects the anomaly, active systems with denominators quantify it, and clinical assessment resolves the individual case. Reading a conclusion straight off the passive stage skips both of the stages that were built to supply one. The same passive-to-active pattern appears in adjacent surveillance domains — see hemovigilance for the blood-safety analogue, and Medical Device Reporting for the device one.

Operational checklist for a reporting site or PV function

1. Maintain a product-specific reporting matrix, not a generic rule. Rows: each product administered. Columns: RET-listed events and intervals, package-insert contraindicating reactions, EUA-condition mandates, and any product-specific named events (myocarditis, MIS, thromboembolic events).
2. Re-derive the matrix from the RET on vaers.hhs.gov, not from 42 CFR 100.3. Date the derivation and re-check it whenever a product’s authorisation status changes.
3. Satisfy the recording duty separately from the reporting duty. 42 U.S.C. § 300aa-25(a) requires administration date, manufacturer, lot number, and administering provider name/address/title in the permanent record — for every Table vaccine, regardless of whether anything is ever reported.
4. Route non-vaccine biologics correctly. Nirsevimab alone goes to MedWatch; nirsevimab co-administered with a vaccine goes to VAERS.
5. Complete every essential field. Blank essential fields are the only thing that routinely triggers a follow-up request, and follow-up is by post or electronically, never by phone — an incomplete report can sit incomplete for a long time.
6. Record the VAERS ID in the patient record so later medical-record requests and follow-up submissions can be matched.
7. Report administration errors even without a health event where the error itself carries safety risk — the canonical example in VAERS’ guidance is administering a live vaccine to an immunocompromised patient.
8. Never describe an internal count of VAERS reports as a rate or as evidence of causation in any document that could be read outside the PV function. Label the denominator problem explicitly wherever a count appears.

What this page could not verify

Consistent with CASRAI’s sourcing policy, the following are stated as gaps rather than filled with secondary estimates:

• CDC programme pages for VSD and CISA returned HTTP 403 to automated retrieval at the time of writing. The descriptions of VSD and CISA above are therefore drawn from HHS’s own VAERS documentation and from each programme’s well-established role, and deliberately omit specific figures — participating-site counts, enrolled population size, and member-institution lists. Read those from CDC directly before citing any number.
• FDA’s VAERS landing page returned HTTP 404 at the time of writing. Reports have circulated since early 2026 of an FDA effort to consolidate its adverse-event reporting systems onto a unified platform; that could not be confirmed against a primary FDA source here and is not asserted as fact. What is verifiable is that vaers.hhs.gov was operating normally under the VAERS name, and that the statutory and regulatory obligations described on this page — 42 U.S.C. § 300aa-25, 21 CFR 600.80, 42 CFR 100.3 — were current. Confirm current system naming and submission URLs directly before updating an SOP.
• The Table of Reportable Events Following Vaccination is not reproduced here. It is maintained by HHS on vaers.hhs.gov and is revised independently of 42 CFR 100.3; reproducing a snapshot of it would create exactly the stale-citation problem this page warns about.

Frequently asked questions

Who is legally required to report to VAERS?

Healthcare providers, for events on the Table of Reportable Events Following Vaccination occurring within the listed interval and for any reaction the manufacturer’s package insert lists as a contraindication to further doses (42 U.S.C. § 300aa-25(b)); and vaccine manufacturers, for every adverse experience that comes to their attention (21 CFR 600.80). Product-specific conditions — notably EUAs — add further mandatory categories. Everyone else may report voluntarily.

Can anyone file a VAERS report?

Yes. VAERS accepts reports from anyone — patients, parents, caregivers and healthcare professionals — and accepts all reports without first judging whether the vaccine caused the event. Knowingly filing a false report violates 18 U.S.C. § 1001.

Does a VAERS report mean the vaccine caused the event?

No. VAERS is not designed to determine causation. Some reported events are true vaccine reactions and others are coincidental events unrelated to vaccination; the programme states that a causal relationship cannot be established from a VAERS report alone.

Are VAERS reports verified?

Not as a matter of routine. Reports are accepted as submitted and often lack detail or contain errors. Medical records are sought only for reports classified as serious, and those records are requested from the institution holding them rather than from the reporter.

Can I calculate an adverse-event rate from VAERS data?

No. VAERS data cannot be used to determine rates of adverse events. There is no reliable denominator of doses administered to the reporting population and no comparison group. Rate estimation requires an active system with an enrolled population, such as the Vaccine Safety Datalink.

How does VAERS differ from FAERS?

Both are passive spontaneous-reporting systems. VAERS covers vaccines, is co-managed by CDC and FDA, and carries a statutory mandate on individual clinicians for listed events. FAERS covers drugs and therapeutic biologics, is run by FDA, and imposes no equivalent federal mandate on individual clinicians — their reporting is voluntary through MedWatch. Manufacturer duties differ by regulation: 21 CFR 600.80 for biologics including vaccines, 21 CFR 314.80 for drugs.

Is filing a VAERS report the same as filing a vaccine injury claim?

No. The National Vaccine Injury Compensation Program and the Countermeasures Injury Compensation Program are administered by HRSA and are separate from VAERS. Submitting a VAERS report neither starts nor supports a compensation claim.

Why did VAERS report counts appear to jump in 2025?

On 8 May 2025 the public data sets began including secondary reports — additional reports about a patient, vaccine and dose combination already reported by someone else. These are not additional adverse events. A time series crossing that date will show a step change caused by the extract definition rather than by any change in reported events.

What is the difference between the Reportable Events Table and the Vaccine Injury Table?

The Table of Reportable Events Following Vaccination determines when a provider must file a VAERS report and is maintained by HHS on vaers.hhs.gov. The Vaccine Injury Table is codified at 42 CFR 100.3 and determines when a VICP petitioner receives a presumption of causation. They are different documents with different purposes and different administrators, and 42 CFR 100.3 should not be cited as the source of reporting triggers.

Does VAERS give medical advice?

No. For complex individual patient cases, healthcare professionals can request a clinical consultation through CDC’s Clinical Immunization Safety Assessment (CISA) Project.

Primary sources

• 42 U.S.C. § 300aa-25 — Recording and reporting of information (National Childhood Vaccine Injury Act § 2125; Pub. L. 99-660, 14 Nov 1986, amended by Pub. L. 100-203, 22 Dec 1987)
• 42 CFR 100.3 — Vaccine Injury Table, including the qualifications and aids to interpretation at 100.3(b)–(d)
• 21 CFR 600.80 — Postmarketing reporting of adverse experiences, biological products
• 21 CFR 314.80 — Postmarketing reporting of adverse drug experiences
• 18 U.S.C. § 1001 — False statements
• VAERS programme documentation at vaers.hhs.gov: About VAERS, Report an Adverse Event, and Frequently Asked Questions

This page sits in CASRAI’s laboratory compliance cluster alongside related quality-system and surveillance material, including Good Pharmacovigilance Practices (GVP), adverse events of special interest, CTCAE severity grading, and pharmacovigilance certification pathways.