Expiry of COVID-19 vaccination information regulations
The Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations, were automatically revoked on 12 July 2023. Employers who recorded or held COVID-19 vaccination information specifically under these regulations have 30 days to destroy that information.
Regulations revoked - What employers need to do
The OHS COVID-19 Regulations were automatically revoked on 12 July 2023. Employers are required to destroy COVID-19 vaccination information recorded or held under the regulations within 30 days of the revocation date (ie. by 11 August 2023).
Employers should ensure that they destroy COVID-19 vaccination information by 11 August 2023, where employers have collected the information for the purposes of the regulations:
- determine reasonably practicable measures to control risks to health and safety associated with COVID-19 at the workplace, or
- to implement any reasonably practicable control measure to control risks to health and safety associated with COVID-19 at the workplace (for example, for the purpose of implementing mandatory COVID-19 vaccination policies).
WorkSafe is reminding employers that pandemic regulations put in place to assist with the collection, recording, holding and use of COVID-19 vaccination information from specified persons expired on 12 July 2023.
The regulations were introduced in mid-2022 following the removal of certain vaccination requirements under the Pandemic Orders and supported employers to collect, record, hold and use COVID-19 vaccination information from specified persons attending a workplace under their management or control in order to determine and to implement reasonably practicable measures to control COVID-19 risks.
A specified person includes employees, independent contractors and their employees, volunteers and students on placement permitted to attend the workplace.
What information must be destroyed?
COVID-19 vaccination information is information about whether a specified person has:
- received any dose of a vaccination against COVID-19, and if so, the date on which the person received the dose or if the person has received more than one dose, every date on which the person received those doses; or
- not been able to receive a dose, or further dose, of a vaccination against COVID-19 due to a medical contraindication or an acute medical illness.
This could include:
- information from a record kept in the AI register under the Australian Immunisation Register Act 2015 of the Commonwealth;
- a letter from a registered medical practitioner; or
- a certificate issued by Services Australia that states that the person is unable to receive a dose, or further dose, of a vaccination against COVID-19 due to a medical contraindication or an acute medical illness.
What to consider when destroying the information
When destroying the COVID-19 vaccination information, employers should consider:
- Informing affected specified persons about what information will be destroyed;
- Implementing a process that will irrevocably destroy the information in a secure and confidential manner – this may involve discussions with IT specialists;
- Ways in which the COVID-19 vaccination information may have been recorded, for example vaccination registers;
- Conducting a review to confirm whether all vaccination information has been destroyed in accordance with the Regulations; and
- Any amendments to policies, procedures and contracts.
The destruction of information requirement does not apply to employers that are permitted or required under other laws to collect, use, record, or hold vaccination information.
If an employer has a need to continue to collect, hold and use COVID-19 vaccination information, this will need to be considered and undertaken in accordance with the Privacy Act 1988 (Cth) and Health Records Act 2001 (Vic).
For information in regard to the recent changes to employee vaccination files please click here.
For further information contact WorkSafe's advisory service on 1800 136 089.