Care homes need to update data collection policies to process information about worker’s vaccination status

Care homes need to update data collection policies to process information about worker’s vaccination status

Since 11 November 2021, anyone working or volunteering in a care home needs to be fully vaccinated against coronavirus (COVID-19), unless they are exempt under the regulations.

The regulations say that a care home may process information about vaccination or medical exemption status, but this must be done in a way that is consistent with data protection legislation.

New draft guidance and templates published by Digital Social Care, clarifies that care homes need to update their information asset register, record of processing activity, and privacy notice.

Care homes will also be required to complete a data protection impact assessment (DPIA) because the Information Commissioner’s Office Guidance on Vaccination and Covid Pass Checks states

“If the use of this data is likely to result in a high risk to individuals (e.g. denial of employment opportunities) or you will be processing health data on a large scale, then you need to complete a data protection impact assessment (DPIA) before you start processing the data.”

Care homes will not be able to employ individuals who have not received two vaccinations or who don’t have an exemption, therefore this can result in the denial of employment opportunities and so a DPIA is required. A DPIA is a way of systematically and comprehensively analysing an organisation’s processing and helps to identify and minimise data protection risks.

Digital Social Care has published draft DPIA and Privacy Notice templates for care homes to use. These are drafts and individual care homes should adapt them to their own circumstances and consider legal advice. Digital Social Care will continue to update their guidance when they get more information. Further advice and check lists on DPIAs are available on the Information Commissioner’s Office webiste

Digital Social Care also reminds care homes that they are not required to retain copies of someone’s NHS Covid Pass, or exemption form. In fact, there is no legal imperative for them to do this. They are only required to record what they have seen, the vaccination or exemption status, and when they have seen it.

For general advice on vaccination as a condition of deployment, please see the compiled guidance from the Care Provider Alliance.

Back to News