Key documentation

The following details are recorded: 

• your name, date of birth, ethnicity, and health number (National Health Index or NHI) 
• details about the vaccination you receive.

By law, all health services are required to keep complete and accurate records. To receive a vaccination, we need to collect your information and record it on the AIR, as it is the clinical record of your immunisation treatment. This means there is no ability to opt out of your vaccine information being recorded. 

You can request confirmation of your personal information, and your vaccination records, as held in the AIR by making a request to hnzprivacy@health.govt.nz.

If you wish to correct your contact information, please email hnzprivacy@health.govt.nz.

Only those people with a role in managing a vaccination programme and related administration can see, add or change the information held in the AIR. Access to the AIR is limited to those with logon access rights, and all access is recorded and can be audited. 

These people may include those involved in administering vaccines (such as vaccinators and administration staff and health professionals who work with you). Everyone who accesses the AIR is trained to keep the information safe.

The information collected as part of the AIR may be used for: 

• managing your health 
• keeping you and others safe 
• planning and funding health services 
• carrying out authorised research 
• training health care professionals 

• preparing and publishing statistics 
• improving government services 
• enabling broader health and social support services. 

Some information, such as information about reactions to a particular vaccine, will be shared with other organisations who provide health services, and we will share this information with your GP (if you are enrolled) in order to ensure they have a complete health record for you. 

Information may also be shared with iwi and other Māori providers in line with the Ministry’s obligations to honour Te Tiriti o Waitangi through the provision of data sharing. The purpose of this data sharing is to enable iwi, hapu and whanau to self-determine their own governance of data, including its use to actively protect communities by ensuring equal opportunity, access, and support for immunisations. This data sharing may be at an aggregated or individual level but will at all times be in accordance with the privacy requirements set out in the Privacy Act 2020 and Health Information Privacy Code 2020. 

Information may also be used for statistical analysis and research purposes, in line with usual Te Whatu Ora processes and when permitted by the Privacy Act 2020 and Health Information Privacy Code 2020. 

If we need to use the AIR information for other purposes, we will have this reviewed by the Chief Privacy Officer at Te Whatu Ora and discuss it with the Office of the Privacy Commissioner to make sure your privacy interests are fully considered. 

The AIR operates on a Salesforce platform, which is hosted on Amazon Web Services servers in Sydney, Australia. Access to the data remains limited to those with logon access rights, and all access is recorded and can be audited.

Any ‘health record’ details will be stored in accordance with the Health (Retention of Information Retention) Regulations 1996. It is noted that records may need to be retained for some time into the future as a resource to confirm who has or has not been vaccinated, and with which vaccine.

It is recognised that organisations and employers offer workplace-based vaccination services, often provided by occupational health providers, to support their staff to receive vaccines in a time and manner most suitable to them.  

This guide aims to support employers and occupational health services when considering sharing information captured via the Covid Immunisation Register (CIR), Aotearoa Immunisation Register (AIR) or National Immunisation Register (NIR).

Please note this relates to privately funded vaccination data collected by the workplace-based vaccination service only. Data from publicly funded vaccinations cannot be shared unless required under a public health mandate. 

In accordance with Principle 3 of the Privacy Act 2020 and Rule 3 of the Health Information Privacy Code 2020, occupational health providers must ensure that individuals being vaccinated are made aware of the fact that personal information is being collected.

The purpose of this is to ensure any intended recipients (e.g. their employer), who holds the information, are made aware of the consequences (if any) of not providing that information, and their rights of access to and correction of, that information.  

Te Whatu Ora – Health New Zealand encourages all occupational health providers to review their privacy statements and ensure they accurately describe the collection and handling of personal information. This should include, where applicable, informing the individual that their personal information regarding the vaccination will be shared with their employer. For an example privacy statement, please see FAQ. 

It is recommended that staff are informed of the collection and handling of personal information when invited to attend a workplace-based clinic (i.e. before they agree to attend and receive a vaccination). 

Employers should be aware of the potential sensitivity surrounding the collection of this data and for the possibility of this being perceived as a mandated vaccine or having an impact on the staff’s employment, particularly in workforces who may have lost staff due to COVID-19 mandates. Care must also be taken to ensure that only relevant information is shared with the employer.  

The contracted occupational health service should ensure that the employer is provided with only the information essential to meet reporting requirements (i.e. vaccine recommended for their workplace e.g. Hep A, Hep B, flu or tetanus). Employers should not be provided the full data reports as they include the staff member’s full name, date of birth, NHI, nor should any publicly funded vaccination data be provided.  

Essential data to be shared must be identified at the point of contracting with an employer and reports provided to employers should be created with only the agreed content. Please be mindful of only using the minimum personal information necessary when creating any report. Occupational health providers should ensure that their vaccinators are aware that an employer has requested the details of employer funded vaccinations from CIR, AIR or NIR and what details this will include so that they can ensure staff receiving the vaccine are giving a fully informed consent.

Clear and transparent communication should be provided to staff about what information will be shared, where it will be held and for what purposes. The occupational health provider’s privacy statement must be updated to include details regarding data collection.  

Employers should be clear about the reasons for gathering information. For Te Whatu Ora occupational health services, this reason would most likely be to report on the percentage of staff who have received influenza vaccines. This is required to report on the target to reach 80% of staff vaccinated against flu. Some workplaces will require staff to have received particular vaccines for health and safety reasons as part of their employment, e.g. HepA and HepB vaccines. Staff should be informed that the reports generated will only include vaccines that have been administered at the site and will not include vaccines received elsewhere, e.g. GP or sexual health clinic.  

As part of this transparency, it is recommended that staff are informed of this data sharing when invited to attend a workplace-based clinic (i.e. before they agree to attend) and what this may include. The organisation or occupational health provider should ensure their consent form includes personal information which will be shared with an employer if they have an agreement with the vaccination provider to generate reports from CIR, AIR or NIR.

It may be appropriate for the employer to have a representative at the vaccination clinics to answer any questions the staff may have regarding this data sharing as well as have copies of the occupational health provider’s privacy statements available.

The representative should not be present when the vaccination is given, as the employee must be given privacy to discuss any confidential matters with the vaccinator (e.g. if they are pregnant).