Victorian businesses that collected COVID-19 vaccination information from staff and other workplace attendees have less than two weeks to destroy that data, after the expiry of temporary health and safety regulations next month.
Relevant data collected under those regulations must be destroyed by August 11, says SafeWork Victoria.
Introduced in mid-2022, the Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations put the onus of workplace safety on employers after the most stringent public health orders were formally lifted.
The regulations permitted employers to collect and store the COVID-19 vaccine status of any “specified person”, covering employees, independent contractors engaged by the employer, or volunteers and students on placement.
It also enabled them to record the date those “specified persons” received the jab and to take note of who was unable to receive a COVID-19 vaccine for medical reasons.
Gathering that information would allow employers to “determine reasonably practicable measures to control the risks to health and safety associated with COVID-19 at that workplace,” the regulations state.
“Employers are reminded that a person’s COVID-19 vaccination status is health information protected by other legislation such as the Health Records Act,” SafeWork Victoria now states.
Law firm Hall & Wilcox states businesses that fail to adequately dispose of that data could fall foul of both the Victorian Health Records Act and the Commonwealth Privacy Act 1988.
The regulations do not specify how the data should be destroyed.
However, Hall & Wilcox advises it should be done in a “secure and confidential manner”.
Separately, law firm Clayton Utz recommends employers inform the “specified persons” that their vaccine information is being destroyed, and that any destruction “avoids inadvertent disclosure of the information to a third party”.
SmartCompany has contacted SafeWork Victoria for comment.