Key documentation

The following details are recorded in the AIR: 

• Your health number (National Health Index or NHI), date of birth (DOB) and gender, 

• Details about the vaccination you receive such as vaccine type, batch number, date of administration, vaccinator, and facility, 
• Whether you decline a vaccination, and 
• Your contact person's name and contact details (if applicable).

Other personal information associated with your NHI (such of name, address, healthcare provider, and ethnicity) is not stored in the AIR but can be accessed by authorised users of the AIR through the National Health Index and National Enrolment Service Systems. By using these systems, healthcare providers can link your name to your information in the AIR.  

It is not mandatory that you be vaccinated in New Zealand. If you choose to be vaccinated, we will hold your vaccination records in the AIR.  

Health providers are required to keep complete and accurate records of any health service provide to you. The AIR is the clinical record for many vaccinators. For other vaccinators we will securely hold in the AIR a copy of the vaccination records they create in their own systems to enable all health providers to be able to check your AIR vaccination records wherever you present for a vaccination or for other health services.  

It is also important for Te Whatu Ora to have a full view of Aotearoa New Zealand’s vaccination coverage and understand where there may be risks to public health, and how many people are immunised against a range of vaccine-preventable diseases. We may need to check this information to help us manage national outbreaks, and to deliver public health campaigns. This information may also be used by Te Whatu Ora and other health providers as part of vaccination outreach campaigns.  

If you choose not to be vaccinated, we will record that in the AIR and about that specific vaccination.  

If you do not want to share your identifiable immunisation information held about you in the AIR, you can apply for ‘Suppression’. The ability to ‘suppress’ your information will be available from April 2024 and will mean that:

• Information about the vaccines you choose to receive or not to receive will still be recorded in the AIR, however this information cannot be viewed or shared with anyone. 
• Your immunisation records will not be available to the health services you access. 
• Your immunisation history is not available to clinicians who you are receiving health care from, if this information is not held locally (such as within your enrolled GP patient Management System) ‘
• We will not contact you about free immunisation services that you are eligible for.

If you choose to ‘suppress’ your information you will not be able to access a copy of your immunisation records via our digital consumer channel if you wish to view them.

Suppression will only allow your immunisation records to be for statistical purposes. This information will not be able to identify you as an individual. These reports are used to understand the total level of risk that the health sector would need to plan for in the event of an emergency.

If ‘'suppressed’, your identifiable information will only ever be accessible when you give permission, or in the event of an emergency.

You can request Suppression of your information now. However please note this functionality will not be in place until April 2024.

Until the ‘Suppression’ functionality is in place, your information will be accessible to those outlined in the ‘Who can access the information’ section below but they can only use this for the purposes outlined in this privacy statement.

If you would like us to apply this control to your records held in the AIR please contact us at hnzprivacy@health.govt.nz.

You can request your personal information, and your vaccination records, as held in the AIR by making a request to hnzprivacy@health.govt.nz.

If you wish to request a correction to your information, please email hnzprivacy@health.govt.nz.

Only those people with AIR logon access rights can see, add or change the information held in the AIR, and all access to the AIR is recorded and can be audited. Everyone who has access to the AIR is trained to keep the information safe before being given access.

These people include:

• people involved in managing or administering vaccines (such as vaccinators and administration staff) and other health professionals who work with you (such as your GP and hospital staff);
• Te Whatu Ora staff working on vaccination programmes and vaccine related public health campaigns, including outbreak response, contract tracing and recall programmes. 
• Information may be shared with organisations and individuals who provide health services but do not have AIR logon rights in accordance with Data Sharing Agreements approved by the Te Whatu Ora Data Governance Group.

The information collected as part of the AIR processes may be used for: 

• managing your health 
• keeping you and others safe 
• planning and funding health services 
• carrying out authorised research 
• training health care professionals 

• preparing and publishing statistics 
• improving publicly funded health services 
• enabling broader health and social support services. 

Information may be used for statistical analysis and research purposes, in line with usual Te Whatu Ora processes and when permitted by the Privacy Act 2020 and Health Information Privacy Code 2020. Any reports produced will not contain any identifiable information about you.

If we need to use or disclose the AIR information for other purposes, we will have this reviewed by the Chief Privacy Officer at Te Whatu Ora and discuss it with the Office of the Privacy Commissioner to make sure your privacy interests are fully considered.  If considered appropriate, information will only be shared with other persons and organisations under Data Sharing Agreements. These Data Sharing Agreements will be developed in accordance with the Privacy Act 2020 and Health Information Privacy Code 2020 and will be approved by the Te Whatu Ora Data Governance group responsible for overseeing the AIR.

We will hold this information in our secure record keeping environment. Direct access to the information remains limited to those with logon access rights, and all access is recorded and can be audited.

In accordance with relevant legislation, records are likely to be retained for at least the lifetime of an individual as a resource to confirm who has or has not been vaccinated, and with which vaccine throughout their lifetime.

Healthcare providers can download and order free copies of the AIR Privacy Brochure from the HealthEd website, to support conversations with the public about AIR information and privacy. 

AIR Privacy Brochure (PDF, 518 KB)

If you have any questions about the AIR and the privacy considerations, contact hnzprivacy@health.govt.nz

It is recognised that organisations and employers offer workplace-based vaccination services, often provided by occupational health providers, to support their staff to receive vaccines in a time and manner most suitable to them.  

This guide aims to support employers and occupational health services when considering sharing information captured via the Covid Immunisation Register (CIR), Aotearoa Immunisation Register (AIR) or National Immunisation Register (NIR).

Please note this relates to privately funded vaccination data collected by the workplace-based vaccination service only. Data from publicly funded vaccinations cannot be shared unless required under a public health mandate. 

In accordance with Principle 3 of the Privacy Act 2020 and Rule 3 of the Health Information Privacy Code 2020, occupational health providers must ensure that individuals being vaccinated are made aware of the fact that personal information is being collected.

The purpose of this is to ensure any intended recipients (e.g. their employer), who holds the information, are made aware of the consequences (if any) of not providing that information, and their rights of access to and correction of, that information.  

Te Whatu Ora – Health New Zealand encourages all occupational health providers to review their privacy statements and ensure they accurately describe the collection and handling of personal information. This should include, where applicable, informing the individual that their personal information regarding the vaccination will be shared with their employer. For an example privacy statement, please see FAQ. 

It is recommended that staff are informed of the collection and handling of personal information when invited to attend a workplace-based clinic (i.e. before they agree to attend and receive a vaccination). 

Employers should be aware of the potential sensitivity surrounding the collection of this data and for the possibility of this being perceived as a mandated vaccine or having an impact on the staff’s employment, particularly in workforces who may have lost staff due to COVID-19 mandates. Care must also be taken to ensure that only relevant information is shared with the employer.  

The contracted occupational health service should ensure that the employer is provided with only the information essential to meet reporting requirements (i.e. vaccine recommended for their workplace e.g. Hep A, Hep B, flu or tetanus). Employers should not be provided the full data reports as they include the staff member’s full name, date of birth, NHI, nor should any publicly funded vaccination data be provided.  

Essential data to be shared must be identified at the point of contracting with an employer and reports provided to employers should be created with only the agreed content. Please be mindful of only using the minimum personal information necessary when creating any report. Occupational health providers should ensure that their vaccinators are aware that an employer has requested the details of employer funded vaccinations from CIR, AIR or NIR and what details this will include so that they can ensure staff receiving the vaccine are giving a fully informed consent.

Clear and transparent communication should be provided to staff about what information will be shared, where it will be held and for what purposes. The occupational health provider’s privacy statement must be updated to include details regarding data collection.  

Employers should be clear about the reasons for gathering information. For Te Whatu Ora occupational health services, this reason would most likely be to report on the percentage of staff who have received influenza vaccines. This is required to report on the target to reach 80% of staff vaccinated against flu. Some workplaces will require staff to have received particular vaccines for health and safety reasons as part of their employment, e.g. HepA and HepB vaccines. Staff should be informed that the reports generated will only include vaccines that have been administered at the site and will not include vaccines received elsewhere, e.g. GP or sexual health clinic.  

As part of this transparency, it is recommended that staff are informed of this data sharing when invited to attend a workplace-based clinic (i.e. before they agree to attend) and what this may include. The organisation or occupational health provider should ensure their consent form includes personal information which will be shared with an employer if they have an agreement with the vaccination provider to generate reports from CIR, AIR or NIR.

It may be appropriate for the employer to have a representative at the vaccination clinics to answer any questions the staff may have regarding this data sharing as well as have copies of the occupational health provider’s privacy statements available.

The representative should not be present when the vaccination is given, as the employee must be given privacy to discuss any confidential matters with the vaccinator (e.g. if they are pregnant).