Workplace vaccination: responsibilities and privacy

HYL Health · Employer information · Updated 3 October 2026

Employer responsibilities

Are UK employers legally required to provide seasonal flu vaccination?

No. For most employers, a flu clinic is a voluntary staff benefit rather than a legal duty. Where the job itself creates an exposure risk, a workplace risk assessment and occupational health advice decide what is needed.

Is the position different for health and social care staff with occupational exposure?

Yes. Health and social care employers are expected to offer flu vaccination to frontline staff to protect them and the people they care for. Check the guidance and any funding for your setting and UK nation.

What is the difference between a voluntary flu benefit and vaccination required by a workplace risk assessment?

A voluntary benefit makes vaccination easy for staff who want it. An occupational programme responds to a specific risk identified in your risk assessment. Both rely on individual screening and consent, which our pharmacists handle.

Do we need a COSHH assessment before offering an ordinary office flu clinic?

Not for an ordinary office benefit. A COSHH assessment matters where work involves exposure to biological agents, such as blood or body fluids. Our occupational health page covers those programmes.

What responsibilities stay with us and which belong to the pharmacy?

You provide the room, access, staff release and internal communication. We handle everything clinical: screening, consent, the vaccine, administration, observation, waste and records.

Does pharmacy registration cover the proposed service, or are other permissions relevant?

Our GPhC registration confirms who we are. Our procurement pack covers the rest: clinical arrangements, insurance and the responsibilities of our superintendent pharmacist.

Does the clinical authorisation cover vaccination away from the pharmacy at our premises?

Yes. Our clinical arrangements cover vaccinating your staff at your premises, and we include the details in our procurement pack.

Do arrangements or regulatory requirements differ between England, Scotland, Wales and Northern Ireland?

Yes. We are regulated by the GPhC, which covers England, Scotland and Wales. Northern Ireland has its own pharmacy regulator, so please contact us before planning a clinic there.

What reasonable adjustments should we consider so employees can access the clinic?

Step-free access, a private room, extra appointment time and clear information in advance all help. Invite staff to ask for adjustments privately, and tell us so we can plan around them.

What records should an employer keep to show it offered and organised the programme appropriately?

Keep the agreed scope, your supplier checks, the invitation, the timetable, the invoice and our aggregate uptake report. There is no need for HR to keep screening forms or reasons for declining.

Information and confidentiality

What employee information does HR need to collect to organise the clinic?

Only what you need to run the timetable: name, work contact and slot. Keep allergies, medicines and medical history off HR sign-up sheets; employees give those to our pharmacist directly.

Can employees give their medical information directly to the pharmacist so HR never handles it?

Yes. Employees complete paper screening and consent forms with our pharmacist on the day, so HR never handles medical information.

Who is the data controller for the vaccination and medical screening records?

HYL Health is the controller for the clinical records we create. Your organisation is the controller for its own administrative records, such as the booking list. Our privacy policy sets this out.

What are the lawful bases for using employee health information, and how do these differ from consent to vaccination?

Consent to vaccination is a clinical decision, separate from the legal basis for keeping records. We document our own lawful basis for clinical records in our privacy policy; your organisation documents its basis for any HR records.

Do we need a data-sharing agreement, a processor contract or another arrangement with the pharmacy?

In most cases neither is needed, because we share only aggregate figures with you. If your procurement team requires a specific agreement, send it with your enquiry and we will review it.

What exactly will you share with us in the report after the clinic?

Within 48 hours you receive aggregate figures: the number vaccinated by site and, if you give us a workforce total, a participation percentage. No individual medical answers are included.

Will managers be told who refused, was deferred or had an adverse reaction?

No. Our reports never identify who declined, was deferred or had a reaction, or why.

How do you stop aggregate reporting identifying people in a small team?

We combine very small groups or leave out breakdowns that could reveal an individual. We agree the reporting categories with you before the clinic.

How are paper consent forms stored, transported, retained and eventually destroyed?

Completed forms are clinical records. Our pharmacist takes them away securely, and the pharmacy stores, retains and destroys them in line with our privacy policy. HR never needs copies.

How can an employee obtain their own record, exercise data rights or raise a privacy complaint?

Employees can contact us at contact@hylhealth.co.uk about their clinical record or any privacy concern. They can also complain to the ICO if they are unhappy with our response.

Respecting decisions

Can we require employees to have a flu jab?

Our workplace flu service is always voluntary and relies on each person's informed consent. If you are considering making vaccination a condition of a role, take employment law and occupational health advice first.

What should a manager say if an employee declines?

Something like: “Thanks for letting me know. Taking part is completely voluntary. If you have any questions, you can speak to the pharmacist privately.” Then leave it there.

Do employees have to give HR a reason for refusing vaccination?

No. For a voluntary benefit, nobody needs to give a reason. If a role carries a specific occupational risk, handle that through a separate, confidential occupational health process.

How do we respond to concerns that the flu vaccine causes flu?

The injected flu vaccine cannot give you flu, as the NHS explains. Some people get a sore arm or feel tired for a day or two. Our pharmacist is happy to talk through any concerns on the day.

What should we do if employees have religious, cultural or personal concerns?

Offer employees a private conversation with our pharmacist about the vaccine and any concern they have. Taking part is always an individual decision.

Can we keep a list of who declined, and would we actually need one?

For running the clinic, a list of booked appointments is all you need. A list of refusals rarely serves a purpose, and holding one creates privacy risk.

How should we handle a refusal in a role with an identified occupational exposure risk?

Refer it to occupational health and whoever owns the risk assessment, and review other protective measures confidentially. It is not a disciplinary matter.

Can refusal affect someone's duties, and when should occupational health or employment advice be involved?

Only after an individual risk assessment with occupational health and employment advice. A manager should never change someone's duties on their own assumption.

How do we avoid employees feeling singled out because they cannot be vaccinated?

Keep medical decisions private, avoid public sign-up lists and make clear that not being able to have the vaccine is nobody's fault.

What other workplace infection-control measures should continue whether or not staff accept vaccination?

Keep up good hygiene and ventilation, and clear policies for staff who are unwell. Vaccination works best alongside these measures, not instead of them.

Further information: HSE occupational immunisation.

Further information: ICO occupational-health information guidance.