The Flu immunisation programme for healthcare workers is directed by the Department of Health through Public Health England, and vaccine uptake data is mandatorily required. There is a lawful basis for processing under the General Data Protection Regulations 2018
1. Article 6(1) (e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Trust staff and associates).
How is the data stored?After the electronic form is submitted, the data on it is stored in a secure data repository, held by Clinical Information at CHFT. The data from mandated sections of the form (marked by an asterix) are used to populate a database with cross reference to ESR cost centres and job roles.
The Occupational health service will have full access to the dataset, and will be able to search and retrieve data when required, such as subject data access request, or to recall in event of vaccine batch recall for example.
How is the data used?The information held provides the basis of data audit required in creating vaccine uptake reports and campaign progress analysis. Reports to CHFT are limited to cost code area uptake reports. Only the clinical flu leads have personal identifying data information. Reports to PHE are made in terms of vaccine uptake amongst broad staff grouping data sets and do not provide any personal or sensitive information.
How long your data will be held for?Occupational Health papers and electronic records are kept for the duration of your employment and for 6 years after you cease employment with the Trust/employer, or reach the age of 75 (whichever is sooner). The complete data base will be stored after the flu campaign in the Occupational Health clinical repository accessible to only OH staff.
- You have the right to see any information held about you in your Occupational Health records. The request should be made in writing and will be responded to within 4 weeks, without charge.
- You can also request an amendment is attached to your notes if you believe any information held in your records is inaccurate or misleading.
- You have the right to withdraw consent at any time, for any reason. You will need to ensure Occupational Health service staff are made aware of this.
- In the case of your request for erasure, retention may be lawfully required (e.g. if required for legal compliance).
Complaints relating to data handlingIf you have any concerns or complaints about how your data is processed/held please contact the Occupational Health service manager in the first instance on 01422 222037, or by email to the manager, occupational.healthCHT@cht.nhs.uk
You can also contact The Information Commissioners office regarding complaints.