AIR privacy information

The following details are recorded in the AIR: 

Your health number (National Health Index or NHI), date of birth (DOB) and gender, 

Details about the vaccination you receive such as vaccine type, batch number, date of administration, vaccinator, and facility, 

Whether you decline a vaccination, and 

Your contact person's name and contact details (if applicable).

Other personal information associated with your NHI (such of name, address, healthcare provider, and ethnicity) is not stored in the AIR but can be accessed by authorised users of the AIR through the National Health Index and National Enrolment Service Systems. By using these systems, healthcare providers can link your name to your information in the AIR

It is not mandatory that you be vaccinated in New Zealand. If you choose to be vaccinated, we will hold your vaccination records in the AIR.  

Health providers are required to keep complete and accurate records of any health service provide to you. The AIR is the clinical record for many vaccinators. For other vaccinators we will securely hold in the AIR a copy of the vaccination records they create in their own systems to enable all health providers to be able to check your AIR vaccination records wherever you present for a vaccination or for other health services.  

It is also important for Te Whatu Ora to have a full view of Aotearoa New Zealand’s vaccination coverage and understand where there may be risks to public health, and how many people are immunised against a range of vaccine-preventable diseases. We may need to check this information to help us manage national outbreaks, and to deliver public health campaigns. This information may also be used by Te Whatu Ora and other health providers as part of vaccination outreach campaigns.  

If you choose not to be vaccinated, we will record that in the AIR and about that specific vaccination.  

You can request your personal information, and your vaccination records, as held in the AIR by making a request to hnzprivacy@health.govt.nz.

If you wish to request a correction to your information, please email hnzprivacy@health.govt.nz.

Only those people with AIR logon access rights can see, add or change the information held in the AIR, and all access to the AIR is recorded and can be audited. Everyone who has access to the AIR is trained to keep the information safe before being given access.

These people include:

• people involved in managing or administering vaccines (such as vaccinators and administration staff) and other health professionals who work with you (such as your GP and hospital staff);
• Te Whatu Ora staff working on vaccination programmes and vaccine related public health campaigns, including outbreak response, contract tracing and recall programmes. 
• Information may be shared with organisations and individuals who provide health services but do not have AIR logon rights in accordance with Data Sharing Agreements approved by the Te Whatu Ora Data Governance Group.

If you choose to restrict access to your information in the AIR, your immunisation history will not be available to these people except in limited circumstances (see ‘Restricting access to your information’ above).

The information collected as part of the AIR processes may be used for: 

• managing your health 
• keeping you and others safe 
• planning and funding health services 
• carrying out authorised research 
• training health care professionals 
• preparing and publishing statistics 
• improving publicly funded health services 
• enabling broader health and social support services. 

Information may be used for statistical analysis and research purposes, in line with usual Health NZ processes and when permitted by the Privacy Act 2020 and Health Information.

We will hold this information in our secure record keeping environment. Direct access to the information remains limited to those with logon access rights, and all access is recorded and can be audited.

In accordance with relevant legislation, records are likely to be retained for at least the lifetime of an individual as a resource to confirm who has or has not been vaccinated, and with which vaccine throughout their lifetime.

If you do not wish for your immunisation history to be available and shared in the ways described in this privacy statement, you can ask for access to be restricted. This will mean that:

• Health care providers (including your doctor and other vaccinators) will not be able to view your full immunisation history in the AIR.
• AIR users within Health New Zealand will not have access to your immunisation history.
• Health New Zealand will not proactively contact you about free immunisation services that you are eligible for unless there is an emergency which requires this. However, your doctor and other health services may still contact you about immunisations independent of the AIR or ask Health New Zealand to do so (subject to your general consent).
• You will not be able to access your immunisation records via My Health Record (my.health.nz). You can request your records held in the AIR as per this Privacy Statement and Health New Zealand will still process requests for your information which have your consent.
• Your immunisation records in the AIR may still be used by Health New Zealand for statistical analysis and reporting, but you will not be identified.
• Your immunisation records will not be shared with any external agencies unless you consent.
• In the event of an emergency which seriously threatens your safety or the safety of others, Health New Zealand may contact you and may access information about your immunisation history or status as required (normally only with your consent).
• Your immunisation records in the AIR may still be used to support the funding of health services; specifically, providers claiming subsidies from Health New Zealand for relevant immunisations provided to you.

Restricting access limits the information healthcare providers can access to support your health. We encourage you to carefully consider this before choosing to restrict access. You may wish to talk to your healthcare provider about this.

Read more about restricting access to information in the AIR

You can also contact help@imms.min.health.nz if you have questions.

To request access restrictions please download and complete the ‘Request to change access restrictions on immunisation information in the Aotearoa Immunisation Register’ form, which can be returned to hnzprivacy@tewhatuora.govt.nz.

Healthcare providers can download and order free copies of the AIR Privacy Brochure from the HealthEd website, to support conversations with the public about AIR information and privacy. 

AIR Privacy Brochure (PDF, 541KB)

There are some updates to the AIR Privacy Impact Assessment that are still to be incorporated.

Download: AIR Privacy Impact Assessment- PDF, 1.2 MB

Download: PIA Annex for ISD Reporting Capability- PDF, 1.1 MB

For questions relating to reporting on the AIR Vaccinator Portal (ISD) please contact help@imms.min.govt.nz

If you wish to limit how your immunisation history will be accessed, you can request that access to your information is restricted. If you change your mind, you can lift restricted access.

The process to implement restriction and lift restriction can take up to 20 working days.

As part of a request to restrict access, you can ask Health New Zealand to provide you with your immunisation history that is held in the AIR (see ‘Managing your own immunisation information’ below).

You can request to restrict access to the immunisation history for children in your care (aged 16 years and under), or other dependents, if you have legal authority to do so.
You can also request your child’s immunisation history that is held in the AIR. Proof of relationship must be supplied.

Please note that if you are listed as a contact person for someone who does not have restricted access in the AIR, you may still be contacted about that person’s immunisations. If asked to by your doctor or other healthcare provider, Health New Zealand may also contact you about free immunisations for children in your care (see ‘What you need to know’ below).

• Health care providers (including your doctor and other vaccinators) will not be able to view your full immunisation history in the AIR. They will only be able to view records about the immunisations they have given you at their facility. 
• The AIR will not share your immunisation records with your doctor if you receive an immunisation from a different health provider.
• Immunisations that you receive will still be recorded in the AIR. Where the record does not meet data standards, this will be corrected by authorised Health New Zealand staff. Once resolved, the immunisation record will become restricted. 
• Health New Zealand will not proactively contact you about immunisation services unless there is an emergency to prevent a serious threat to you or others. 
• However, your doctor and other health services may still contact you about immunisations or may ask Health New Zealand to do so. If you do not want your doctor to contact you about immunisations please speak with them. 
• You will not be able to access your immunisation records via My Health Record (my.health.nz) but you can still ask for these records. Please see the ‘Request to receive immunisation records held in the AIR’ form below. Requests may take up to 20 working days to be completed.
• Your immunisation records in the AIR may still be used by Health New Zealand for data analysis and reporting, but you will not be identified.
• Your immunisation records in the AIR may still be used to support the funding of health services; specifically, providers claiming subsidies from Health New Zealand for relevant immunisations provided to you.

Where possible, restricted access will only be lifted with your consent. However, there may be situations where it is not practical to do this such as in the event of an emergency which may seriously threaten your health or the health of others – such as a serious disease outbreak. In this case Health New Zealand reserves the right to access information needed to reduce that threat.

• Health care providers may not have access to your full immunisation history, which could affect the services and care they provide to you, this includes public health advice on quarantine measures and advice on what vaccines you are due to receive.
• Health New Zealand won't proactively contact you about immunisation services you're eligible for or send immunisation reminders. However, your doctor may continue to do this unless you ask them not to.
• We recommend that you keep your own records and inform healthcare providers about your immunisation history. Please see ‘Managing your own immunisation information’ section below.
• Having a copy of your immunisation records will be important in some situations, for example if you are identified as a contact of someone with an infectious disease such as measles. In these situations, if you do not have your vaccination records available you may need to quarantine until your immunity can be confirmed. Please note that quarantine means you must stay at home and not leave the house except to access health care.
• You might miss out on getting information about free immunisation programmes and whānau events.

Download the Access restriction request form. 

This can be used to request restrict access or to request to lift access restrictions.

It is recognised that organisations and employers offer workplace-based vaccination services, often provided by occupational health providers, to support their staff to receive vaccines in a time and manner most suitable to them.  

This guide aims to support employers and occupational health services when considering sharing information captured via the Covid Immunisation Register (CIR), Aotearoa Immunisation Register (AIR) or National Immunisation Register (NIR).

Please note this relates to privately funded vaccination data collected by the workplace-based vaccination service only. Data from publicly funded vaccinations cannot be shared unless required under a public health mandate. 

In accordance with Principle 3 of the Privacy Act 2020 and Rule 3 of the Health Information Privacy Code 2020, occupational health providers must ensure that individuals being vaccinated are made aware of the fact that personal information is being collected.

The purpose of this is to ensure any intended recipients (e.g. their employer), who holds the information, are made aware of the consequences (if any) of not providing that information, and their rights of access to and correction of, that information.  

Health New Zealand encourages all occupational health providers to review their privacy statements and ensure they accurately describe the collection and handling of personal information. This should include, where applicable, informing the individual that their personal information regarding the vaccination will be shared with their employer. For an example privacy statement, please see FAQ. 

It is recommended that staff are informed of the collection and handling of personal information when invited to attend a workplace-based clinic (i.e. before they agree to attend and receive a vaccination). 

Employers should be aware of the potential sensitivity surrounding the collection of this data and for the possibility of this being perceived as a mandated vaccine or having an impact on the staff’s employment, particularly in workforces who may have lost staff due to COVID-19 mandates. Care must also be taken to ensure that only relevant information is shared with the employer.  

The contracted occupational health service should ensure that the employer is provided with only the information essential to meet reporting requirements (i.e. vaccine recommended for their workplace e.g. Hep A, Hep B, flu or tetanus). Employers should not be provided the full data reports as they include the staff member’s full name, date of birth, NHI, nor should any publicly funded vaccination data be provided.  

Essential data to be shared must be identified at the point of contracting with an employer and reports provided to employers should be created with only the agreed content. Please be mindful of only using the minimum personal information necessary when creating any report. Occupational health providers should ensure that their vaccinators are aware that an employer has requested the details of employer funded vaccinations from CIR, AIR or NIR and what details this will include so that they can ensure staff receiving the vaccine are giving a fully informed consent.

Clear and transparent communication should be provided to staff about what information will be shared, where it will be held and for what purposes. The occupational health provider’s privacy statement must be updated to include details regarding data collection.  

Employers should be clear about the reasons for gathering information. For Te Whatu Ora occupational health services, this reason would most likely be to report on the percentage of staff who have received influenza vaccines. This is required to report on the target to reach 80% of staff vaccinated against flu. Some workplaces will require staff to have received particular vaccines for health and safety reasons as part of their employment, e.g. HepA and HepB vaccines. Staff should be informed that the reports generated will only include vaccines that have been administered at the site and will not include vaccines received elsewhere, e.g. GP or sexual health clinic.  

As part of this transparency, it is recommended that staff are informed of this data sharing when invited to attend a workplace-based clinic (i.e. before they agree to attend) and what this may include. The organisation or occupational health provider should ensure their consent form includes personal information which will be shared with an employer if they have an agreement with the vaccination provider to generate reports from CIR, AIR or NIR.

It may be appropriate for the employer to have a representative at the vaccination clinics to answer any questions the staff may have regarding this data sharing as well as have copies of the occupational health provider’s privacy statements available.

The representative should not be present when the vaccination is given, as the employee must be given privacy to discuss any confidential matters with the vaccinator (e.g. if they are pregnant).