Summary Care Record application coronavirus (COVID-19) vaccination event data sharing transparency notice

During the coronavirus pandemic, information about whether a person has received a coronavirus vaccine will be available for doctors and other clinicians to see in a clinical setting if it is necessary for them to check this information for a clinical reason when treating the patient.

This information will be available to the clinician through an NHS system called the Summary Care Record application (SCRa).

Access to this information in SCRa will support health and care professionals to deliver better safer care for their patients, where this information is not available through other sources. 

The vaccination event information being collected at vaccination sites is important to clinicians who are making decisions in many different NHS settings.

If someone is registered with a GP, then information about their vaccination will flow back to the GP record. The vaccination event information will then also be sent to the SCRa.

This ensures that the information is available if that person has medical treatment elsewhere and the clinician treating them needs to check this information as part of their treatment.

However, there are approximately 1.5 to 3 million people in the UK who are not registered with a GP. Therefore, for people who are not registered with a GP, the SCR would not be updated in the usual way to show that that person has received a vaccination. This is because the SCR usually relies on updates that come from a person’s GP record. This would mean that clinicians would not be able to tell from the SCR whether a non-registered person they were treating had received the vaccine.   

The SCRa provides the broadest possible way to present vaccination event information. It's available across a wide range of care settings, providing scheduled and unplanned care, so it's very important when providing care to patients.  

For this reason, where patients are not registered with a GP and receive a vaccination, we will update the SCRa directly with the information relating to that person’s vaccination.  

The SCRa will provide clinicians with an additional way of determining a patient’s coronavirus vaccination history. This may be particularly important when planning ongoing care or responding to symptoms or changes to a patient’s health, which may be linked to coronavirus, such as an allergic reaction to a vaccine. 

Using SCRa, clinicians will also be able to see that a patient has had a previous adverse reaction at the point of vaccination and take appropriate action with the direct and/or ongoing care they provide. 

This will also support clinicians providing direct care to patients, who might not have a GP medical record or a Summary Care Record with Additional Information.

For the purposes of data protection law, NHS England is the Controller of the vaccination event Information gathered from vaccination sites. NHS Digital is the organisation responsible for operating the SCRa and is the controller for some of the information contained within it.

NHS Digital will input the vaccination event information in to the SCRa under the instruction of NHS England as their processor. This will involve NHS Digital analysing and linking the data under instruction from NHS England which they have instructed us to do under the COVID-19 NHS England Public Health Directions 2020 (COVID-19 Directions).

For GDPR purposes, NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…public interest and the exercise of official authority…’; and:

For the processing of special categories  of personal data, the exemptions relied upon under Article 9 are 9(2)(b) – ‘…social protection law…’ (for monitoring equality of access), 9(2)(g) - ‘...substantial public interest...’, 9(2)(h) – ‘…health or social care…’, and 9(2)(i) – ‘…public health purposes…’.

The data being processed for this purpose includes the data to ensure we have the correct patient (such as NHS Number, surname and date of birth), clinical information about the vaccinations administered, including information on the products used to vaccinate the patient (such as vaccine type, dose, batch number) and any adverse reaction information if the patient should a reaction occur during the vaccination process (such as description and severity). 

Data is collected on systems that have been approved and assured by NHS England and NHS Digital, at the point of care, such as when the vaccinations are given.

The data is then collected, on behalf of NHS England, by NHS Digital who then further process the data for the purposes described above.   

The information gathered at the point of care for each coronavirus vaccination administered is made available through the SCRa, but in an additional section of the SCRa that is restricted to clinical staff only. This information will be used for the patient care and ongoing management primarily in the following NHS settings:

• 111 
• unscheduled and emergency care 
• pharmacies
• maternity 
• other NHS settings may access this information if providing care to the patient and this information is relevant for their direct care. 

We will retain the information for as long as is necessary for the purposes outlined above in accordance with the Records Management Code of Practice for Health and Social Care 2016 and our records management policy.

The healthcare professionals identified above, who we share your personal data with, have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data.

At the moment, we are only sharing this information for the duration of the coronavirus pandemic. We will review this arrangement before the end of September 2021 and decide with NHS England and healthcare service providers if this arrangement should continue beyond then.

Further information regarding the personal information we collect about users of SCRa and why we collect it is available in the privacy notice and terms and conditions for NHS Identity and Care Identity Service (CIS) users.

All vaccination event information will be held within the UK on NHS Digital secure services.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our coronavirus (COVID-19) response transparency notice.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the end of the notice will also change. Any changes to this notice will apply immediately from the date of any change.

NHS England has established a centralised service for the management of both the coronavirus and seasonal flu vaccination programmes. This service is supported by a central system, called the Immunisation Management System. 

Read NHS England's privacy notice regarding the national COVID-19 and flu vaccination programmes.

Read the privacy notice and terms and conditions for NHS Identity and Care Identity Service (CIS) users.