Employers directed to destroy COVID-19 vaccination information

Following the revocation of the Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations, employers who recorded or held COVID-19 vaccination information specifically under these regulations have until Friday 11 August 2023 to destroy that information.

The regulations were introduced in mid-2022 following the removal of certain vaccination requirements under the Pandemic Orders and supported employers to collect, record, hold and use COVID-19 vaccination information from specified persons attending a workplace under their management or control in order to determine and to implement reasonably practicable measures to control COVID-19 risks.

A specified person includes employees, independent contractors and their employees, volunteers and students on placement permitted to attend the workplace.

The destruction of information requirement does not apply to employers that are permitted or required under other laws to collect, use, record, or hold vaccination information.

Employers are reminded that a person’s COVID-19 vaccination status is health information protected by other legislation such as the Health Records Act.

The Regulations don’t explain exactly how the vaccine information must be destroyed, but we would recommend that you:

• notify employees that these records are now being destroyed; and
• destroy the data securely, and in a manner that avoids inadvertent recall (recovery) or disclosure to a third party.

For advice or assistance with managing your obligations under these regulations, please contact us.