Data sharing for COVID vaccination – No. 22

Data sharing for COVID vaccination – No. 22

Data sharing for COVID vaccination

In a Primary Care Network setting we are relying on the new ISS information sharing agreement, using COPI legislation as the legal basis for sharing. For TPP practices, until such time as separate instances of TPP are provided to PCN units this is being mediated through RA extension to access permissions on smartcards.

Many vaccination centres are currently using Accubooks to support vaccine administration. There is a helpful Youtube presentation on how this works here:



It is important to recognise that because this is a new way of sharing, that each locality is required to undertake a DPIA to look at the way the data is being shared, as well as to assess and mitigate any identified risks. Accubooks has produced a template DPIA which covers most of the requirements:

accuRx DPIA Template Covid-19 Vaccine booking and recording

Whilst this will cover most of your bases you must make the DPIA specific to you own data sharing and ensure that it addresses considerations related to your locality.

If you have any questions please email NWL Infogovernance Support


Sharing Vaccination Data with Local Authorities


You will be aware of the data sharing recently undertaken in response to the low COVID vaccination uptake levels in NWL. A limited amount of patient data has been provided to Local Authorities through WSIC, using COPI as the legal basis to provide care. A Memorandum of Understanding (MoU) outlining the principles was endorsed by the NWLCCG and ICS accountable officers. Evidence to date suggests that where patients have been contacted through this route, vaccination rates have risen in the order of 27% and that this has been life-saving action.

We have since been working closely with the LLMC to ensure that GP data controller responsibilities can be exercised. As a result, GPs are now being asked to sign up to an information sharing agreement with LAs to share this limited dataset. Practices wishing to share will be provided with an information sharing agreement, a template DPIA and a clause to insert in your practice FPNs with information about further communications with your patients.

The proposed data sharing agreement is:

  • Appropriate: We believe that this data sharing exercise will save lives (above)
  • Proportionate: The data is limited to the contact details of a subset of NWL patients over 50 years old, who do not live in the Grenfell area, who are eligible for but have not received COVID vaccination
  • Time limited: valid only for the duration of COPI legislation
  • Safe: We have separately approached the LAs signing this agreement who have provided assurances that the appropriate security measures are in place through the use of access control mechanism, secure data transmission, storage, management and duration/expiry of this sensitive data.
  • Legally sound: COPI is used as the legal basis but the sharing agreement is GDPR compliant, consistent with the agreed NWL structure of information sharing agreements and has been approved by the NWL Primary Care IG group.
  • Agreed: We have discussed the pros and cons of this matter in some detail with individual GPs, the vaccination programme, the NWL IG Board (where there is patient representation), Primary Care IG group, NWL CCGs and with the LLMC. Individual GP data controller will be able to decide about how to implement this sharing.

GP data controllers are expected to sign this sharing agreement which is recommended by the NWL Primary Care IG group, the NWL vaccination programme and the Accountable officers of the NWLCCGs and ICS, who have been working closely with the LLMC. It is recognised that a small number of practices, depending on their geography, may have higher numbers of potentially vulnerable or other groups of patients not happy to share their data with LAs. These practices do not have to sign up but will be asked to provide evidence that they have promoted COVID vaccination uptake by engaging in collaborative work with their LAs.

The data has already been shared (although it is time limited by the duration of COPI legislation). For the anticipated small proportion of practices who decide not to sign, no further data flows will take place.

Required actions:

Your registered data controller lead or PM will shortly be contacted by the Data Controller Console (DCC) and invited to sign the LA information sharing agreement. All practices should respond, in most cases this will be to sign up, but practices who prefer to use other ways of increasing vaccination uptake, must let us know that they dissent (which will inform the cessation of existing data flows).

Respond to the DCC controller invitation.

A) If you are happy to proceed you should:

  1. Sign the sharing agreement on the DCC
  2. Check you are happy with the DPIA
  3. Add the FPN clause to the existing notice published on your website (see below under FPN / patient communications).

Everything else will be managed through WSIC.


B) If you do not wish to share data with the LAs:

  1. Log on the DCC and register your dissent to share the information agreement.
  2. Liaise with your local authority to work collaboratively with them and consider using honorary contracts as a mechanism of doing so (see below under Working with Local Authorities)


FPN / patient communications

Your responsibility as data controllers is to inform your patients about what data you are sharing, with whom and why. This can be done in a number of ways, first and foremost  through the Fair Process Notices (FPN) which should be published on your practice website. This is a new form of sharing and if you are signing the sharing agreement you should insert the following paragraph in your FPN (you may wish to reword as you see fit).

“Sharing Vaccination Data during the COVID Pandemic:

During the COVID pandemic we have signed an agreement with our Local Authorities to allow trained Public Health personnel access to a limited amount of patient information. This has been restricted to the contact details of North West London patients over 50 years old, who do not live in the Grenfell area, who are eligible for but have not received COVID vaccination. The purpose is to provide those patients with direct care and to save lives by increasing the update of COVID vaccination. The legal basis for sharing is the short term COPI legislation (introduced by the secretary of state for health for just this purpose) and when the COPI legislation expires the data will be deleted. We have taken measures to ensure this data is safely transmitted and managed securely and that PH personnel are trained to understand their professional responsibilities of confidence.”

Patient Participation Groups. You should mention this sharing in your patient participation groups and may choose to let them know that the NWL vaccination uptake has been amongst the lowest in the country and that these measures has been taken to provide care for our patients by increasing vaccination uptake and in doing so, saving lives.

Working with Local Authorities

A minority of practices have higher proportions of patients (for example BAME and other groups)  who may have a mistrust in the system, where the sharing of that data might further widen the mistrust.  If they decide not to sign up to this recommended information sharing agreement, they will be expected to demonstrate that they are working towards increasing their vaccine uptake figures in other ways. One mechanism for doing so would be to undertake collaborative work with their Local Authority (see the presentation recently shown by the vaccination team which gives an exemplar of this sort of outreach work).

Practices working in this way may wish to allow limited access to data to trained LA personnel taken on at the practice under an honorary contract which outlines their roles and responsibilities and which documents accountability. See template document

Practices wishing to explore these options further should contact their LA vaccination leads and we are currently drawing up a list of contact details and will shortly publish them below:








If you have queries, please email us on


We hope you will sign up to this data sharing agreement. Local Authorities are part of our ICS and we need to learn how to share data with them appropriately, proportionately, and securely to support patient care. This is a potentially sensitive area, and this first step is a measured and well worked-up agreement which we believe will save live and which we strongly recommend to you.


Comments are closed.