NHS England - Transformation Directorate

This guidance has been reviewed by the Health and Care Information Governance Panel, including the Information Commissioner’s Office (ICO) and National Data Guardian (NDG).

The panel exists to simplify information governance guidance. Have we done a good job? Let us know at datapolicyhub@nhsx.nhs.uk.

Flu vaccines and the COVID-19 response

Nurse with syringe

On average, flu kills over 11,000 people each year – some years this number is much higher – and it hospitalises many more. This is anything but a typical year due to the potential impact of flu and COVID-19 circulating at the same time. 

This year, as well as GP practices inviting key eligible groups to receive their vaccination, reminders have gone out nationally to supplement this. COVID-19 vaccines will also be managed centrally once they are available. Given the potential time gap required between the flu and COVID-19 vaccines, it is important that the invites, reminders and uptake of the vaccines are carefully managed together and regarded as part of the response to the COVID-19 pandemic.

This guidance describes how data is being used to help ensure that those who are entitled to a flu vaccine receive one. This includes data relating to both health and care staff and patients.

Guidance for patients and service users

A flu vaccine is offered to patients who are particularly susceptible to the flu because of their health condition, age or because they are pregnant. In addition to those already eligible for vaccination, the programme has this year been extended to include people aged 50 to 64 years that aren’t already in an at-risk group; children in school year 7 and household contacts of people who are shielding.

For this year, as well as invites from GP practices, a central system has been put in place to remind key eligible people to book an appointment for a vaccine at the most appropriate organisation (for instance, GPs, community pharmacies or school-aged vaccination services). This year the data and technology processes have been improved so that NHS England and Improvement can:

  • send you a communication to remind you to get your flu vaccine, and advise you of how to do so, if you are eligible because of a health condition or your age
  • record whether or not you have been vaccinated and use this information to send reminder communications if you have been invited for a vaccine, but not yet taken this up
  • send information to your GP practice so that your practice can update their records with your vaccines

The information which will be collected by NHS England will be:

  • your name and address
  • your registered GP practice
  • information about any health condition that makes you potentially susceptible to flu, for example, asthma.

You can read more about the collection of this information in the privacy notice on NHS England’s website. 

To help the response to COVID-19, your information may be used to respond to the pandemic even if you have chosen not to share it. The national data-opt out will not therefore apply to the use of your information to invite you for a flu vaccine. You can read more about the national data opt-out. Whilst you can’t opt-out of receiving an invite to be vaccinated, it is up to you whether you take up the invite or not.

If you were expecting an invite for a flu vaccine and haven’t received one or have any questions about your flu vaccination you should speak to your GP practice or community pharmacy. The nhs.uk website includes further information about the flu vaccine.

Guidance for healthcare workers

NHS England and Improvement have asked for there to be further concerted effort to maximise flu vaccination uptake for frontline healthcare workers before the start of December 2020. The Joint Committee on Vaccination and Immunisation (JCVI) has provided guidance on priority groups for coronavirus (COVID-19) vaccination, including health and social care workers.

You may already have a flu vaccination record if you have received a flu vaccine from your GP practice or community pharmacist. However, the record of this vaccine did not previously indicate that you are employed in the health and care system. There was also no central record if you received your flu vaccine from another health or care organisation, for example, at your hospital trust. 

This is changing. Going forwards, information about flu vaccines received by NHS staff in any health setting will be collected by NHS England and Improvement. In addition, information from your Electronic Staff Record (ESR) will be collected so that it can be matched with any flu vaccination record, for example, if you received a vaccine from your GP or community pharmacist. 

The following data will be collected by NHS England and Improvement from the Electronic Staff Record system to ensure a flu vaccination record can be identified as relating to a staff member:

  • Name
  • Postcode
  • Date of Birth
  • Gender
  • Staff number
  • Organisation code
  • Department in organisation. 

This data will only be used to match the ESR record with your vaccine record and to support the purposes of the vaccination programme. It will not be used for any other purpose. Data about your vaccinations will only be made available to the health and care organisation that you work for and your GP practice. It will not be accessible to any other health and care organisation.

Guidance for IG professionals

A central system, known as the National Immunisation Management System (NIMS), has been put in place to support the management of the 2020/21 flu vaccination programme for all patients registered in England. The system will:

  • identify people (for example, all those above of a certain age or certain health conditions) who will be eligible for flu vaccines
  • call and recall of people for vaccines making sure that the clinical need matches the vaccine supply
  • ensure the maximum participation of members of the public in the vaccination programme 
  • maintain a record of recipients of flu vaccines
  • make sure that vaccines are delivered in a safe way, for example, the gap between receiving a flu and COVID-19 vaccine (once available) is safe.

The vaccination records included on NIMS are collected from GP practices, community pharmacies and NHS school age immunisation providers. A separate system known as the National Immunisation Vaccination System (NIVS) has been established to collect flu vaccine data at the point of vaccination. NIVS will also capture data from the Electronic Staff Record system and match it with data in a vaccination record on NIMS. Employees details will then be added to NIMS so that it is clear that the vaccination record relates to a member of staff. This means that the uptake of flu vaccines by staff can be monitored which is so important when the health and care system is under pressure because of the COVID-19 pandemic and staff absences due to flu could impact further on the health and care system.

Data from NIVS and NIMS will be combined to provide a dashboard that will be made available to the managers of local NHS organisations so that they can check the vaccination status of their own staff.

Common law duty of confidentiality 

Under the provisions of the COPI notice, issued by the Secretary of State for Health and Social Care, employers are legally required (not just ‘requested’) to provide confidential patient information about staff to support the flu and COVID-19 vaccination programme. 

The COPI notice specifically states that confidential patient information can be shared in order to support:

“understanding …. about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care”

and can be relied upon for a number of reasons including:

  • It is critical that any potential flu epidemic is managed when the NHS is already dealing with the coronavirus pandemic.
  • It is important to monitor take-up of the flu vaccine by staff and the potential impact on staff absences.
  • Ensuring there is an appropriate interval between administering the flu and COVID-19 vaccinations.

This legal justification for sharing confidential patient information is based on the clinical information available to us at the time of publication and may be subject to change as our understanding of COVID-19 and the safe administration of new vaccines becomes available.


The lawful bases under UK GDPR for establishing this system and processes are:

  • Article 6(1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject (with regard to the COPI notice)
  • Article 6(1)(e) (with regard to the Secretary of State for Health and Social Care's public health functions under the NHS Act 2006)
  • Article 9(2)(h) (the processing is necessary for health or social care purposes); and
  • Article 9(2)(i) (with regard to public health functions under Regulation 3(1) of the Health Service Control of Patient Information) Regulations 2002.

Nurse with syringe