Even after California banned non-medical exemptions for vaccines, an unvaccinated teenage boy in the state still spread measles to a half dozen people in an outbreak last year, a new study reports. The findings show that while tightening legislative loopholes is key to stopping the spread of measles, it’s not enough.

The outbreak investigation, published today in the Centers for Disease Control and Prevention’s Morbidity and Mortality Weekly Report, follows a 15-year-old boy who came back from England at the end of February 2018 with measles. Soon after, he infected a second boy at a Boy Scout event, a third at school, and a fourth at a tutoring center. All were unvaccinated. And the outbreak doesn’t stop there — it continued in a complicated web of contacts.

The third boy, infected at school, was put under quarantine, so he didn’t spread it to anyone. But public health officials weren’t told that the fourth boy, infected at the tutoring center, was unvaccinated. So he stayed un-quarantined and infected his 33-year-old unvaccinated uncle and his four-year-old unvaccinated brother.

The second boy, the one infected at the Boy Scout event, went on to infect a vaccinated 21-year-old man at a different Boy Scout event. In this particular chain, the measles stopped with the vaccinated 21-year-old. He suffered a less severe infection known as modified measles — when measles infects someone who is incompletely protected by a vaccine. It’s possible he didn’t spread it to anyone else because people with modified measles tend to shed less virus, according to George Han, deputy health officer with the County of Santa Clara public health department and lead author on the study.

The measles vaccine protects around 97 percent of people who receive both doses, so it doesn’t protect everyone. People who aren’t fully immune and people who are too young or too sick to get the vaccine rely on everyone else to be vaccinated to keep the virus at bay. That’s why these webs of contagion between unvaccinated people are so worrying. “We should not be lulled into a false sense of security that the new vaccine law will totally prevent all outbreaks in California,” Han says. “It’s a reminder that we should continue to vaccinate — because there are folks who can’t be vaccinated.”

Fighting the return of measles is going to take a multi-pronged strategy, according to Peter Hotez, who is dean of the National School of Tropical Medicine at Baylor College of Medicine and was not involved in the study. “It has a policy solution, which is continuing to shut down the non-medical exemptions,” Hotez says. “But that by itself will not be adequate.” He thinks anti-vaccination propaganda should also be curbed, and federal agencies will need to amp up advocacy for vaccines.

It’s not surprising that the measles spread so readily from this one boy in 2018 — the virus is incredibly infectious. It’s also dangerous. In addition to causing a rash and a fever, it can cause pneumonia, brain damage, and death. Before the measles vaccine, measles hospitalized around 48,000 people and killed roughly 400 to 500 people in the US every year, according to the CDC. In 2000, thanks to widespread use of the safe and effective measles, mumps, and rubella (or MMR) vaccine, public health officials announced the virus had been eliminated in the US.

But the virus can still come in with people traveling from regions where measles is still endemic, and it can spread through unvaccinated pockets of people across the US, like in New York, New Jersey, Washington state, and Texas. Texas and Washington are among the 17 states with legislative loopholes that allow parents to skip their kids’ vaccinations because of their personal beliefs, according to the National Conference of State Legislatures. But California isn’t one of those states: after an outbreak linked to Disneyland sickened 147 people in late 2014 and early 2015, California eliminated personal belief exemptions for vaccines. That means only kids with medical exemptions from a doctor could enter kindergarten (or, if they were already in school, seventh grade) without their vaccines after 2016.

After the bill, overall exemptions went down, but the number of medical exemptions — particularly in counties that had previously had high rates of personal belief exemptions — went up, according to a study published in the Journal of the American Medical Association in 2017. The study authors speculated that parents reluctant to vaccinate their kids might have sought out doctors willing to write up medical exemptions, even if there was no medical reason to do so.

That could be what was going on in this particular California outbreak in 2018, although the authors of today’s study don’t directly come out and say it. Remember the fourth boy — the one infected at the tutoring center who went on to infect his relatives? Turns out that boy and his four-year-old brother had both received medical exemptions to all vaccines from a doctor who worked hundreds of miles away from their house. Neither boy had major medical reasons for receiving an exemption, which include treatment for cancer or organ transplantation. “We know that the medical exemptions that these two brothers received were identical, which in and of itself is a little odd, and did not contain these known medical reasons,” Han says.

Right now, there’s no standardized set of criteria a patient has to meet to receive a medical exemption in California, Han says. So one potential solution is to tighten up those standards. “There’s regulation that could be done potentially to try to better define what constitutes a medical exemption in California,” Han says.

Hotez, for one, is optimistic that there isn’t a cottage industry of physicians doling out medical exemptions for non-medical reasons. But if there is, “the state licensing authority and medical boards are going to have to clamp down on that,” Hotez says. “Closing non-medical exemptions like they did in California in 2016 was an important first step, but it’s not the only step,” he says. “There are still things that have to be done.”