We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.
The Department of Health and Social Care has implemented a COVID-19 national vaccination programme. Northampton General Hospital NHS Trust (NGH) has been asked to act as a central hub, administering the vaccination to eligible individuals in Northamptonshire including health organisations and employees of Care Homes.
This privacy notice is applicable if we (Northampton General Hospital NHS Trust) have contacted you and you have agreed to a COVID-19 vaccination.
The vaccination is voluntary and you do not have to take it. The COVID-19 vaccine that NGH is administering is the Pfizer vaccine and is delivered in two stages. There must be a gap of at least seven days between receiving the flu vaccine and the COVID-19 vaccine – that is, seven days before or seven days after the second stage of the COVID-19 vaccine.
If you are to be vaccinated at the Northampton General Site:
A representative of the vaccination programme will contact your employer to invite you to register for a vaccination.
If you would like to have the vaccination, you should contact the vaccination booking team using the number provided to your employer and provide the requested details to allow them to make the booking. You should ensure that you have your NHS number as this is very important for administering the vaccination. You should also have an email address that your booking confirmation can be sent to.
Note: If you made a booking for a vaccination prior to 30/12/2020, you may have received a link to the system and made the booking yourself, without speaking to the vaccination booking team. There was a process change made on 30/12/2020 to remove the self-service function.
The information that you provided will be entered into a system called SimplyBook which is used to manage your vaccination appointment.
SimplyBook is a third party system which is used by a number of NHS organisations to support the booking and management of vaccination appointments. This system will be used until a national booking system is available. The data held in this system is held on servers in the UK. Access to the information is restricted to authorised staff at Northampton General Hospital and Kettering General Hospital.
Reports from this system which include information that identifies you will be used to assist with the booking process and will only be shared with authorised staff.
Summary data which will not include information that identifies you will be used for external reporting purposes, for example to tell NHS England how many people are booked to come for a vaccination in the next 5 days.
SimplyBook will generate reminder texts/ emails about your forthcoming vaccination appointment and will send these to the contact details that you have provided.
When you arrive for the vaccination, you will be asked to complete a consent form and another form which will ask for some information about you. We refer to this as a demographic form and contains specific information needed to carry out the vaccination. You will also need to bring along evidence of where you work, so that the vaccination team can confirm that you are eligible to receive the vaccination.
Once you have received your first vaccination, the vaccination nurse will update the booking system to show that you have attended your appointment and will organise your second vaccination appointment using SimplyBook. You will receive confirmation of the appointment via email and text message to the contact details you provided. You may also receive reminders regarding your appointment.
After you have received your vaccination, the demographic details that you have provided, along with some details about your vaccination will be entered into the National Immunisation Vaccination Service (NIVS). This information is then fed through into a system called National Immunisation Management Service (NIMS). This is used nationally to manage who needs to be invited for a vaccination. This system also pushes information back to your registered GP so that they know that you have been vaccinated.
After the data has been input, the demographic form will be disposed of securely as confidential waste. The consent form will be scanned to a secure location before being destroyed as confidential waste.
When you come for your second appointment, you will be asked to complete a second consent form prior to the second dose of the vaccination being given. The process outlined above will then repeat, with data being entered into the NIVS system and then feeding through to NIMS and to your registered GP.
Controller contact details:
Northampton General Hospital
Billing Road
Northampton
NN1 5BD
Data Protection Officer contact details:
NGH
Email: ngh-tr.dpo@nhs.net
Telephone: 01604 523224
What personal data we collect:
You will enter data directly into the SimplyBook system to book your 1st vaccination appointment.
- NHS Number
- First Name
- Middle Name (Optional)
- Surname
- Date of Birth
- Gender
- Ethnicity
- Home Post Code
- Home Address
Before you have your vaccine you will be asked to complete a consent form which will ask for the following information:
- Name
- Date of Birth
- Home address
- Post Code
The consent forms will be scanned to a secure system by Occupational Health staff. The paper copies will then be destroyed as confidential waste.
At your vaccination appointment you will be asked to confirm responses to a final set of questions. These will allow the administering member of staff to confirm that you are eligible to receive the vaccination. You will be provided with a vaccination information sheet.
The member if staff will also record the following information:
- Date of vaccination
- Batch Number
- Their Name
- Their signature
- The arm of injection
- If the vaccine was not given, the reason why and any other comments
The Occupational Health team will then enter this data in the NIVS system so that there is a record of your vaccination.
Purpose of the sharing:
To enable the COVID-19 national vaccination programme, and ensure that relevant sharing of the programme is shared with key stakeholders (GP/NHSE).
The Lawful conditions for processing:
In order that we can carry out processing of your personal data, we need a lawful basis to do so. The lawful basis for processing, storing and sharing this data are:-
The General Data Protection Regulation, Article 6(1)(e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
We have been given an instruction by The Department of Health and Social Care to identify essential workers within their locality, and where appropriate make contact with them directly, or provide a means by which they can provide their details to us. This is to ensure the maximum number of essential workers are able to carry out their role, and to minimise the risk of the onward transfer of coronavirus. This establishes the activity as a public task.
In addition, an Article 9 Condition for processing should be adhered to:-
The General Data Protection Regulation, Article 9(2)(h) the processing is necessary for medical diagnosis, the provision of health treatment and management of a health and social care system.
We will be referring you to the Department of Health and Social Care so that the vaccination can be undertaken. It is necessary to share the information so that a vaccination can be conducted and accurately recorded in your medical record.
Recipient or categories of recipients of the shared data:
The data will be shared with The Department of Health and Social Care and their appointed Processors. You can read the full details on the following:
Right to object:
You have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact us if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance. You will need to provide information on your specific circumstances which relate to the reasons you are objecting.
Right to access and correct:
You have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
Subject access requests should be directed to the hospital site at which you received your vaccination.
Retention period:
Your information will be stored in line with the Records Management Code of Practice for Health and Social Care 2016. This means we will keep your information for up to 8 years before we dispose of it. In some circumstances, for example where we are legally required to, we may keep your information for a longer period of time.
Information that identifies you will be stored securely and processed in the UK. We will ensure that there are appropriate security safeguards including strong cyber security.
Information that does not, and cannot, identify you may be stored and processed outside of the UK. For example, information purely about the number of tests conducted, or the number of outcomes from tests.
Right to Complain:
You have the right to complain to the Information Commissioner’s Office.
You can use this link https://ico.org.uk/global/contact-us/
Or you can call their helpline:
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
Processors':
To assist us in collecting this information and processing the vaccinations we have appointed the following processors:
Data Sharing:
In order to enable the vaccination we will share the information you provide us with the Department of Health and Social Care via the NIVS platform.
NIVS is the National Immunisation Vaccination Service and has been developed by NHS Arden and GEM Commissioning Support Unit (CSU) at the request of NHS England.
The National Immunisation Vaccination System (NIVS) will be populated with:
1. Demographic information from the Electronic Staff Record of current NHS staff to be offered a vaccination.
2. A record of the vaccination decisions undertaken.
3. Bulk uploads of recorded vaccination decisions and relevant clinical data
Data will be disseminated to NHS Digital as Data Processors on behalf of NHSE. NHS Digital under instruction from NHS England will be collating the data to disseminate for a number of purposes. NHS Digital will trace the identifiable data against the spine to identify the patients NHS Number and GP Details. This data will be used to provide the primary care systems with a record of a completed vaccination
Data will also be used to update the National Immunisation Management Service (NIMS) with details of completed vaccinations, so that those who have been vaccinated are not sent invitations for vaccination.
NHS Digital will also provide aggregated data to NHS England and Public Health England to enable their duty to monitor the uptake of vaccinations and commissioning of the vaccination services.
Data will be pushed from NIMS to GP Practices through a secure transfer method. This ensures that your registered GP has a record of your vaccination.
NIMS is the National Immunisation Management Service and has been developed by NHS South West and Central Commissioning Support Unit (CSU). This system is used for the management of seasonal flu immunisation and will also be used to manage NHS England’s response to the COVID-19 pandemic.
Further information about NIVS can be found here:
NHS England » National Immunisation Vaccination System (NIVS) for healthcare workers: frequently asked questions
Further information about NIMS can be found here:
NHS England » National COVID-19 and Flu Vaccination Programmes