COVID-19 Vaccination records

COVID-19 Vaccination certificates

Do public offices need to retain vaccination certificates?

No.

Many public offices need to sight proof of vaccination or exemption to comply with public health orders or internal business requirements. This could be from members of the public entering buildings, lawyers attending Court buildings to conduct a case, employees, contractors and service providers entering workplaces, and organisations or individuals who are licensed or accredited by the public office. Recent examples we have been asked about include members of the public on jury lists, family daycare operators who are approved to operate by Councils, employees returning to work, and members of the public entering buildings.

In most cases vaccination or exemption certificates need to be sighted but not retained. If for some reason, the validity of the certificate needs to be checked at a later stage it can be requested again. The primary record of vaccination is the Commonwealth Medicare system. We recommend:

• returning the certificates without copying them and creating and capturing a record that the certificate has been sighted
• deleting the email if the certificate has been attached, and capturing the response that the certificate has been sighted.

The level of detail needed to record that a COVID-19 certificate has been sighted depends on the circumstances. For example:

• if it relates to an employee you may want to create a register or annotate the employee record. This is because your public office has a resposibility to ensure a safe workplace.
• if it is a member of the public attending a building where they need to sign in, it might be an additional tick in the sign-in book. If they are entering the building using a QR code and their details are captured in the contact tracing system, it is probably sufficient to ensure that your procedures note that certificate are sighted by relevant staff members. The new Vaccine Passport will reduce the need to check COVID-19 certificates as the Passport is part of the QR code check-in.

If you do need to retain a copy of the certificate for verification purposes or transmission to another public office, dispose of the copies as soon as business use ceases

Note in your communications with the individual submitting the certificate that it will be deleted, returned, or destroyed once it has been sighted and will not be retained in your systems.

We recommend public offices have documented procedures for handling of these types of documents based on a risk assessment. Creating and capturing a record that the documents were sighted fulfills the requirements of the State Records Act and your retention and disposal authorities.

How long should a record that vaccination or exemption certificates have been sighted be retained?

There is no one answer to this question. It depends on the reason the certificate was required and the minimum retention periods in the relevant retention and disposal authorities issued by SARA. Please note that if a risk analysis shows the records need to be retained longer than the minimum retention periods in our disposal authorities then this should be documented and the record retained as per your risk analysis. Common examples are:

• employee and volunteer vaccination required by the employer: 7 years after employment ceases (GA28, 14.5.5 or GA39, 22.9.3)
• family day care providers and family members residing in the property: 3 years after the last date on which the nominated supervisor or staff member provided education and care on behalf of the service (Section 183 of the Education and Care Services National Regulations)
• contractors required to enter workspaces: 7 years after action completed (GA28, 14.5.4) or maintain as per the record of the contract which is 7 years after expiry or termination of the contract (GA28, 4.0.1)
• members of the public or individuals entering property managed by the public office: this depends on how the public office already captures their presence in the building. If they are required to sign in and show proof of identification it may be simpler to record the sighting of a certificate as part of the secure sign on process. Sign in books to secure areas are required to be retained for 7 years (GA28, 16.24.5). If a separate sign in record has been created to facilitate COVID - 19 contact tracing the sighting of certificates could be managed as part of that process and retained until administrative or reference use ceases (GA28, 16.24.7). This aligns with the Public Health Orders which stipulate that contact tracing records are to be destroyed as soon as practicable when no longer required for contact tracing purposes (i.e. within 28 days).

This does not apply to public offices that provide vaccinations - a record of the vaccination should be retained in accordance with the disposal authority for public health services - 7 years after last attendance or official contact or access by or on behalf of the client, or until client attains or would have attained the age of 25 years, whichever is the longer (GDA17, 1.2.1).