Flu Vaccination Programme

< Back to policies & procedures

Data being collected    

Information reasonably required by the Local Health Boards to identify individuals eligible for a seasonable flu vaccination (in line with the criteria set out in the relevant Welsh Health Circular for the national influenza immunisation programme 2025 to 2026 (WHC/2025/020), and to support the management, delivery and reporting of the vaccination programme to those eligible.

Such relevant information includes:

• The eligible person’s NHS number 
• The category of the underlying health condition which makes the individual eligible to receive a flu vaccination. 

How data is used and disclosed    

As directed by Cwm Taff University Health Board, Data concerning eligible patients will be extracted from GP systems by Digital Health and Care Wales (DHCW) and will be added to the Welsh Immunisation System.

This is necessary for the effective monitoring and deployment of the flu vaccination programme. The data will be used for:

1.    Delivery of the 2025/26 Winter Flu Programme: 

• To identify relevant eligibility for vaccination and allow eligible patients to be appropriately offered a flu vaccination. 
• To allow invitations to be issued to eligible patients.
• To allow vaccination appointments to be booked.
• To support administrative processes relating to effective resource planning and delivery of the flu programme

2.    Statistical and monitoring purposes 

• To manage and monitor flu immunisations. 
• To assess the effectiveness of the vaccination programme.
• To support development and publishing of routine reports using anonymised data by NHS Wales staff. This reporting will subsequently inform decisions about how to improve the flu programme delivery by NHS Wales and Welsh Government. 

Legal basis for processing    

In accordance with paragraph 85 of Schedule 3 to the National Health Service (General Medical Services Contracts) (Wales) Regulations  2023 (“GMS Contract Regulations”), Welsh Ministers have directed Local Health Boards to request GP contractors disclose confidential patient information that is relevant for the delivery of the flu vaccination programme (“the relevant information”), in line with the eligibility criteria set out in the Minister’s written statement. . GP contractors are required to comply with this request under the terms of the GMS Contract Regulations. 

Local Health Boards will authorise DHCW in writing to collect and process this information as reasonably required in connection with the Local Health Board’s functions in respect of the flu vaccination programme.

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the flu vaccination programme. 

For GDPR Purposes the Practice’s lawful basis for processing this information is Article 6(1)(e) exercise of official authority and for the processing of special categories (health) data the conditions are 9(2)(h) Health and social care and 9(2)(i) public health purposes. 

Directions have been issued as follows that enable this processing to take place:

• a)    Local Health Boards (“LHBs”) in exercise of the power conferred by section 12(3) of the National Health Service (Wales) Act 2006 (“NHS (Wales) Act 2006”) for the purposes of the provision of information under paragraph 85 of Schedule 3 to the GMS Contract Regulations, and
• b)    Digital Health and Care Wales (“DHCW”) in exercise of the power conferred by section 23(1) of the NHS (Wales) Act 2006, for the purposes of article 3(a) and (b) of the Digital Health and Care Wales (Establishment and Membership) Order 2020 and paragraph 3(1)(a) of the Digital Health and Care Wales (No.2) Directions 2021.

How your information is stored and protected     

Your personal information is protected in a number of ways. The information required will be securely extracted from the practice system and stored by DHCW on computer systems that have been tested to make sure they are secure, and which are kept up to date to protect them from viruses and hacking. 

Your personal information is only stored within the UK and can only be seen by staff who have been specifically trained to protect your privacy. 

Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job. 

Your Rights over your information    

Under data protection law, you have a number of rights over your personal information. You have the right to:

• ask for a copy of any information we hold about you;
• ask for any information we hold about you that you think is inaccurate and needs to be changed;
• ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate;
• object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case;
• delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case; and
• ask us not to use your information to make automated decisions about you without the involvement of one of our staff.

You can access any of your rights by contacting the practice.