Workplace vaccination: responsibilities and privacy

HYL Health · Employer information · Updated 20 September 2026

Employer responsibilities

Are UK employers legally required to provide seasonal flu vaccination?

An ordinary office flu benefit is not the same as a universal legal duty to vaccinate employees. Assess workplace risks and obtain occupational-health advice where exposure arises from the job; sector-specific obligations and guidance may apply.

Is the position different for health and social care staff with occupational exposure?

Yes. Health and social care settings require particular attention to exposure and protecting vulnerable people. The England seasonal programme discusses employer provision for frontline workers; confirm the relevant guidance and funding for your setting and UK nation.

What is the difference between a voluntary flu benefit and vaccination required by a workplace risk assessment?

A voluntary staff benefit aims to improve access. An occupational programme responds to an identified workplace exposure and sits alongside risk controls and follow-up. Both require individual clinical assessment and valid consent.

Do we need a COSHH assessment before offering an ordinary office flu clinic?

Do not commission a COSHH assessment solely as a marketing formality for a general office benefit. Review actual workplace hazards with a competent person; specific exposure risks may require an assessment and occupational programme.

What responsibilities stay with us and which belong to the pharmacy?

The employer organises safe premises, access, staff release and appropriate communications. The pharmacy manages clinical assessment, consent, vaccine handling, administration and clinical records. Agree emergency coordination and data-sharing responsibilities before the clinic.

Does pharmacy registration cover the proposed service, or are other permissions relevant?

Registration is an important identity check, not evidence of every permission needed for a particular service. Ask the provider to confirm the applicable clinical authorisation, off-site arrangements, insurance and professional responsibilities.

Does the clinical authorisation cover vaccination away from the pharmacy at our premises?

Ask the pharmacy to confirm that its legal mechanism for supply and administration covers the vaccine, staff, patient group and off-site location proposed. Do not treat the GPhC premises number alone as that confirmation.

Do arrangements or regulatory requirements differ between England, Scotland, Wales and Northern Ireland?

Yes, regulators and national programmes are not identical across the UK. Confirm the delivery and authorisation arrangements for each nation; Northern Ireland has a different pharmacy regulator from Great Britain. A UK-wide enquiry still needs site-specific confirmation.

What reasonable adjustments should we consider so employees can access the clinic?

Consider step-free access, a suitable private room, additional appointment time and accessible information. Discuss language and communication support privately, without asking staff to disclose unnecessary medical details to managers.

What records should an employer keep to show it offered and organised the programme appropriately?

Keep the agreed scope, provider checks, invitations, timetable, risk arrangements, invoice and appropriate aggregate report. Avoid routinely keeping employees’ screening forms, medical histories or lists of reasons for declining.

Information and confidentiality

What employee information does HR need to collect to organise the clinic?

Collect only appointment information you genuinely need, such as name, work contact and slot. Restrict access to organisers and agree how long the list is needed. Keep allergies, medicines and medical-history questions off HR sign-up sheets.

Can employees give their medical information directly to the pharmacist so HR never handles it?

Yes. HYL brings paper medical-screening and consent forms for employees to complete directly with the pharmacy team on the day. Employees should take confidential clinical questions to the pharmacist rather than a shared HR inbox.

Who is the data controller for the vaccination and medical screening records?

The pharmacy retains and controls its clinical records; the employer is responsible for its own administrative records. Confirm the actual controller roles and privacy information before exchanging data instead of assuming the pharmacy is simply HR’s processor.

What are the lawful bases for using employee health information, and how do these differ from consent to vaccination?

Consent to receive an injection is a clinical decision, separate from the legal basis for processing records. Health data needs both an appropriate UK GDPR lawful basis and special-category condition; each organisation must document the basis for its own purposes.

Do we need a data-sharing agreement, a processor contract or another arrangement with the pharmacy?

Choose the arrangement based on who actually determines the purpose and means of processing. A processor contract is not automatically suitable for an independent clinical provider; procurement should assess any required data-sharing terms with privacy advisers.

What exactly will you share with us in the report after the clinic?

HYL provides aggregate uptake reporting within 48 hours. Agree the sites, attendance total and denominator in advance; routine employer reporting should not include the individual medical answers collected during screening.

Will managers be told who refused, was deferred or had an adverse reaction?

Routine uptake reporting does not identify why an employee declined or was deferred. Any exceptional health-information disclosure needs a specific, lawful and proportionate basis; it is not justified simply because a manager is interested.

How do you stop aggregate reporting identifying people in a small team?

Combine small groups or omit breakdowns where a total could reveal someone’s health information. Avoid reporting rare clinical events by a tiny team or shift; agree useful reporting categories before collecting the data.

How are paper consent forms stored, transported, retained and eventually destroyed?

Paper forms remain clinical records with the pharmacy. Request its current privacy information covering secure handling, access, retention and disposal; do not invent a retention period or ask HR to store duplicate forms.

How can an employee obtain their own record, exercise data rights or raise a privacy complaint?

Employees can contact HYL at contact@hylhealth.co.uk about their clinical record or privacy concern, and their employer about HR-held data. Ask for a secure route before sending health details; unresolved data-protection concerns can be raised with the ICO.

Respecting decisions

Can we require employees to have a flu jab?

HYL’s workplace flu service is voluntary and requires valid individual consent. Do not introduce a compulsory-vaccination policy on the strength of a service webpage; obtain specialist employment and occupational-health advice for any proposed requirement.

What should a manager say if an employee declines?

A suitable response is: “Thank you for letting me know. Taking part is voluntary. If you have a clinical question, you can speak privately with the pharmacist.” Keep the conversation respectful and avoid seeking a justification.

Do employees have to give HR a reason for refusing vaccination?

For an ordinary voluntary benefit, HR generally does not need the employee’s clinical or personal reason to organise the clinic. If a role raises a specific occupational risk, use a separate, confidential occupational-health process.

How do we respond to concerns that the flu vaccine causes flu?

The NHS explains that the injected flu vaccine cannot cause flu. Give employees access to reliable information and a pharmacist who can discuss symptoms and side effects; do not dismiss their concerns or promise there will be no reaction.

What should we do if employees have religious, cultural or personal concerns?

Offer a private opportunity to discuss the actual product and concerns with the pharmacist. Avoid making assumptions about a person’s beliefs or treating a group as having one view; participation remains an individual decision.

Can we keep a list of who declined, and would we actually need one?

Ask what legitimate purpose such a list would serve before collecting it. For ordinary clinic administration, a booked-attendance list is usually more relevant than a record of refusal and reasons; seek privacy advice before retaining sensitive inferences.

How should we handle a refusal in a role with an identified occupational exposure risk?

Refer the situation to occupational health and the person responsible for the risk assessment. Review the exposure and other controls confidentially; do not treat it as a routine attendance or disciplinary issue.

Can refusal affect someone's duties, and when should occupational health or employment advice be involved?

Any proposed change to duties needs an individual risk assessment and appropriate occupational-health and employment advice. Neither a general vaccine webpage nor a manager’s assumption determines whether a change is lawful or proportionate.

How do we avoid employees feeling singled out because they cannot be vaccinated?

Keep medical decisions private, communicate alternatives where available and avoid public participation lists. Make clear that inability to receive a vaccine is not a failure to support colleagues.

What other workplace infection-control measures should continue whether or not staff accept vaccination?

Continue appropriate hygiene, ventilation, risk controls and policies for unwell staff. Vaccination is one measure and cannot make an unsafe working environment safe on its own.

Further information: HSE occupational immunisation.

Further information: ICO occupational-health information guidance.