Skip to main content
Normal text size icon Increase text size by 30% icon
Northampton General Hospital NHS Trust

Staff Vaccination Privacy Notice

Non-urgent advice:Staff Vaccination Privacy Notice

Part of the national response to the coronavirus (COVID-19) pandemic is the need to record the details of staff who have been vaccinated against COVID-19. Vaccinations are normally undertaken in GP practice or community settings, as well as on Trust Premises. With COVID-19 vaccinations, this will be undertaken in a variety of care settings and for the majority of health and care staff, vaccinations will be managed by 'lead providers' on behalf of local health and care organisations.

The 'Notice' issued by the Secretary of State for Health sets aside the requirements of Common Law Duty of Confidentially for COVID-19 purposes, Regulation 4 Health Service Control of Patient Information Regulations 2002 provides that ‘information may be processed in accordance with these Regulations, notwithstanding any common law obligation of confidence’, meaning that identifiable patient data can be shared with other organisations where it is 'necessary' for a COVID-19 purpose.

Non-urgent advice:Controller contact details

Northampton General NHS Trust
Cliftonville
Northampton,
NN1 5BD

Data Protection Officer contact details
Sally Shocklidge
ngh-tr.dpo@nhs.net

Non-urgent advice:Purpose of the processing

The purpose of the processing along the data flows is to effectively deliver and document the administration of COVID-19 vaccinations to staff members within health and care organisations.

Non-urgent advice:Lawful basis for processing

Under the General Data Protection Regulation (GDPR), the lawful basis for processing this data is found at articles:

 6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,

 6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

 and

 9(2)h processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

In addition, with the COVID-19 vaccination, we have an obligation to let your employer know that you have been vaccinated to support their obligation to safety in the workplace. The lawful basis for this processing is found at articles:

6(1)(c) Processing is necessary for compliance with a legal obligation to which the controller is subject,

6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

 and

 9(2)(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment

9(2)(h)Preventative or Occupational Medicine – assessing the working capacity of our employees

9(2)(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health

View the Coronavirus (COVID-19): notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 ON THE GOV.UK website.

 

Non-urgent advice:Recipient or categories of recipients of the processed data

Health and social care organisations, GPs, arm's length bodies (such as NHS Digital and Public Health England), local authorities.

Non-urgent advice:Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. You can exercise this right by contacting the organisation’s data protection officer, whose details are listed above. There is no right to have accurate medical records deleted except when ordered by a court of law.

Non-urgent advice:Retention period

The data will be retained in line with the law and national guidance.

Records Management Code of Practice - NHSX

Non-urgent advice:Right to complain

You have the right to complain to the Information Commissioner's Office (ICO). Register a complaint on the Information Commissioner's Office website

You can also call the helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate).

Back to Top