[Skip to content]

Mid Cheshire Hospitals - NHS Foundation Trust
Departments and services How To Find Us
Search our Site

Covid and Flu Vaccine Privacy Notice


The Joint Committee on Vaccination and Immunisation (JCVI) advises that the first priorities for any COVID-19 vaccination programme should be the prevention of COVID-19 mortality and the protection of health and social care staff and systems.

This guidance describes how data is being used to help ensure that those who are entitled to a vaccine receive one. This is very important during the pandemic. This guidance covers data relating to both health and care staff and patients, providing information about the vaccination programme, personal data that will be shared and the lawful basis for the sharing. 

Flu & COVID-19 Vaccination Process/Response - Privacy

Please read the notice below that informs you about why your data is being shared with relevant healthcare services as part of the vaccination programme for both the Flu and COVID-19 vaccinations.

The sharing of your personal data is important and will ensure that staff are safely vaccinated against Flu and COVID-19, taking into account the time period required between each of the two vaccinations.


  • The Flu kills over 11000 people each year and hospitalises many more
  • 2020-21 has been anything but a typical year from the impact of the COVID-19 virus
  • The impact of both the Flu and COVID-19 over the winter period will need to be managed effectively.
  • What is happening?


Key eligible groups are being invited to receive their flu and COVID-19 vaccinations

Reminders have gone out nationally to support this programme and COVID-19 vaccines will be managed centrally once available

It is important that the gap required between both the flu vaccine and COVID-19 is managed effectively so it is important that invites, reminders and uptake are carefully programmed between the two vaccines.

The following guidance describes how and why your personal data is collected as part of the vaccination process and how it is being used.


Guidance for the Trust's Health & Social Care Workers

NHS England and Improvement have asked for there to be further concerted effort to maximise flu vaccination uptake for frontline healthcare workers before the start of December 2020.

The Joint Committee on Vaccination and Immunisation (JCVI) has provided guidance on priority groups for coronavirus (COVID-19) vaccination, including health and social care workers.

The priority groups are as follows:

1. Residents in a care home for older adults and their carers

2. All those 80 years of age and over and frontline health and social care workers

3. All those 75 years of age and over

4. All those 70 years of age and over and clinically extremely vulnerable individuals

5. All those 65 years of age and over

6. All individuals aged 16 years to 64 years with underlying health conditions which put them at higher risk of serious disease and mortality

7. All those 60 years of age and over

8. All those 55 years of age and over

9. All those 50 years of age and over


What data is being collected

Information about flu and COVID-19 vaccines received by NHS staff in any health setting will be collected by NHS England and Improvement.

Information from your Electronic Staff Record (ESR) will be collected so that it can be matched with any flu vaccination record.


To ensure a flu and Covid-19 Vaccination Record can be identified as relating to a staff member the following data will be collected from both these sources:

  • Name
  • Postcode
  • Date of Birth
  • Gender
  • Staff number
  • Organisation code
  • Department in organisation


This data will only be used to match your ESR record with your vaccine record and to support the delivery of the vaccination programme. It will not be used for any other purpose.

Data about your vaccinations will only be made available to the health and care organisation that you work for, your Occupational Health provider and your GP practice.

A central system, known as the National Immunisation Management System (NIMS), has been put in place to support the management of the 2020/21 flu and Covid-19 vaccination programme for all patients registered in England. The system will:

  • identify people who will be eligible for flu and covid-19 vaccines
  • Manage the call and recall of people for vaccination making sure that the clinical need matches the vaccine supply
  • ensure the maximum participation of members of the public in the vaccination programme
  • maintain a record of recipients of flu vaccines
  • make sure that vaccines are delivered in a safe way, for example, managing the gap between receiving a flu and COVID-19 vaccine.


Guidance for patients

A flu vaccine is offered to people who are particularly susceptible to the flu because of their health condition, age or because they are pregnant.

This year, the programme has been extended to include people aged 50 to 64 years that aren’t already in an at-risk group; children in school year 7 and household contacts of people who are shielding.

The data and technology processes to support vaccination have been improved so that NHS can:

  • Send you a communication to remind you to get your vaccine, and advise you of how to do so, where you are eligible because of a health condition or your age record
  • Identify whether or not you have been vaccinated and use this information to send reminder communications where you have been invited for a vaccine, but not yet taken this up
  • Send information to your GP practice so that your practice can update their records with your vaccinations


The information that will be collected by NHS England is:

  • your name and address
  • your registered GP practice
  • information about any health condition that makes you potentially susceptible to flu, for example, asthma.


You can read more about the collection of this information in the privacy notice on NHS England’s website.

To help the response to COVID-19, your information may be used to respond to the pandemic even if you have chosen not to share it. The national data-opt out will not therefore apply to the use of your information to invite you for a flu vaccine.

Common law duty of confidentiality – COPI (Control of Patient Information)

Under the provisions of the COPI notice, issued by the Secretary of State for Health and Social Care, employers are legally required (not just ‘requested’) to provide confidential patient information about staff to support the flu and COVID-19 vaccination programme.

The COPI notice specifically states that confidential patient information can be shared in order to support:

  • A better understanding about patient access to health services and adult social care services.
  • The need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that car


This information is relied upon to:

  • Manage effectively any potential flu epidemic and the NHS is already dealing with the coronavirus pandemic
  • Monitor closely the take-up of the flu vaccine by staff and potential impact of staff absences
  • Ensuring that there is an appropriate interval between administering the flu and COVID-19 vaccinations


Guidance for staff

In order to ensure both the safety of staff and patients, frontline health and social care workers are considered a high priority group for the provision of the COVID-19 vaccine.

If you are a member of staff and have not already had your COVID-19 vaccine you can make an appointment using the online booking form available on the internal intranet.

Information regarding individual vaccination status will be wile by the Vaccination Centre and Occupational Health.

Any questions regarding this process should be directed to:


Lawful bases for the processing of Personal Information

The lawful bases under DPA18 & the GDPR for establishing this system and processes are:

  • Article 6(1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject (with regard to the COPI notice)
  • Article 6(1)(e) (with regard to the Secretary of State for Health and Social Care's public health functions under the NHS Act 2006)
  • Article 9(2)(h) (the processing is necessary for health or social care purposes); and
  • Article 9(2)(i) (with regard to public health functions under Regulation 3(1) of the Health Service Control of Patient Information) Regulations 2002.
  • Article (6)(1)(e) public task and Article 9(2)(h) necessary for purposes of heath care, treatment and occupational medicine.
  • Article 6(1)(c) compliance with a legal obligation and Article 9(2)(i) substantial public interest (Schedule 1(6) Statutory and government purposes) – specifically the Health and Safety at Work Act 1974.


General information regarding how your data is used including information about your information rights and data retention periods, can be found within our general privacy notice

Latest news