This privacy policy sets out how we (the Australian Government Department of Health and Aged Care) handle the personal information that is collected about you in the Australian Immunisation Register (Register) in accordance with the Privacy Act 1988 (Privacy Act) and the Australian Immunisation Register Act 2015 (Register Act). This policy also provides information on the role played by Services Australia with respect to the Register.
This policy may be updated from time to time.
What is the Register?
The Register is a whole of life, national immunisation register which records vaccines given to all people in Australia. The Register includes vaccines given under the National Immunisation Program, through school based programs, and privately, such as for seasonal influenza or travel. The Register may also include details of vaccines administered outside of Australia.
The Register came into existence in 2016 when the Australian Childhood Immunisation Register was expanded to become the Register. The Australian Childhood Immunisation Register began in 1996.
What role does Services Australia have in relation to the Register?
Services Australia administers the Register on our behalf, and handles your information in accordance with the Register Act and the Privacy Act.
This means that Services Australia is responsible for the operational, day-to-day running of the Register. This includes helping you access your immunisation history statement and providing telephone and processing services for customers and vaccination providers.
What personal information is collected in the Register?
When you receive a vaccine, the person administering the vaccine (who must be a ‘recognised vaccination provider’), or someone on their behalf, may report personal information about you to the Register.
The personal information that may be reported to the Register includes your name, date of birth, contact details, gender, and Indigenous status, as well as your Medicare number (if any) and healthcare identifier (if any). Other information may also be reported to the Register, including details of the vaccination, and information about the person who administered the vaccine.
For COVID-19 and influenza vaccinations, the recognised vaccination provider will be required by law to report information to the Register.
Information collected by your vaccination provider will only be reported to the Register where it is authorised or required by the Register Act.
When can information in the Register be used and disclosed?
The Register Act contains protections and restrictions on how information in the Register can be handled.
Personal information in the Register can only be used and disclosed for the purposes set out in the Register Act. These purposes include:
- monitoring vaccination coverage across Australia and parts of Australia
- collecting, analysing and publishing statistics and other information about vaccination coverage across Australia and parts of Australia
- identifying any parts of Australia at risk during disease outbreaks, because of the number of unvaccinated individuals in those parts
- an individual or a recognised vaccination provider checking an individual’s vaccination status
- advising an individual when they are, or were, due to receive a vaccine
- certifying when a course of vaccination has been completed
- monitoring the effectiveness of vaccines and vaccination programs in preventing vaccine preventable diseases
- promoting individuals’ health and well‑being by giving information on new developments associated with vaccinations to them and to recognised vaccination providers
- making payments relating to vaccinations
- conducting research relating to vaccinations
- checking vaccination status to determine eligibility for family assistance.
Personal information in the Register can also be used and disclosed in other circumstances permitted by the Register Act, including where the use or disclosure:
- has been authorised by the Minister for Health and Aged Care and is for a public interest purpose
- is for the purposes of the National Cancer Screening Register Act 2016
- is authorised by law or court or tribunal proceedings.
We only ever use or disclose your personal information in accordance with the Register Act and the Privacy Act.
Who can access, use and disclose personal information in the Register?
The Register Act governs who can access, use and disclose your personal information in the Register.
For example, access is permitted by:
- the individuals to whom the information relates
- recognised vaccination providers
- authorised Commonwealth personnel, including officers and contractors engaged by us or Services Australia to work on the Register
- prescribed bodies, which include state and territory health departments.
Information in the Register is only accessed and transmitted through secure channels.
Information in the Register is also regularly uploaded to and stored in our Enterprise Data Warehouse. The Enterprise Data Warehouse is an established platform already in use that supports our storage of data in a secure environment within Australia.
We, and the above individuals and entities, can only use and disclose your personal information for a purpose permitted by the Register Act. Your information may be de-identified before it is used to prepare aggregated reports, for example, about vaccination coverage in Australia.
The Register has mechanisms which interact with the Medicare Online, myGov, the Medicare Express Plus app and My Health Record systems, so that you can access your information through those systems.
How is my personal information stored?
Information in the Register is securely stored in Services Australia’s IT environment, and our Enterprise Data Warehouse.
All of your information will be stored within Australia and will not be sent overseas.
Can I opt out from my vaccination information being included in the Register?
No. Once you have been vaccinated, you cannot opt out of your information being put into the Register where the Register Act requires reporting of the information.
However, under the Register Act you can opt out of having your vaccination information being made available to third parties. You can find further information about this on Services Australia’s website.
If you do opt-out, this means that no third parties (including your healthcare providers) will be able to view any of your information in the Register. Your decision to opt out will apply to all of your vaccination information (you cannot opt out for specific vaccines).
How can I access and correct my information in the Register?
You can access your immunisation history contained in the Register through your Medicare Online account through myGov, the Medicare Express Plus app, or your My Health Record.
Alternatively, you can contact Services Australia to request access to your immunisation history in the Register. This includes by calling the Australian Immunisation Register line on 1800 653 809 (Monday to Friday 8am to 5pm).
You will not be able to access specific details of the vaccine product (such as the vaccine batch number) that was administered to you. In the event that you require specific details of the vaccine product your vaccination provider can assist you.
If your personal details in the Register are incorrect, you can correct some details through your Medicare Online account or you should contact Services Australia.
If any of the immunisation details shown on your immunisation history statement are incorrect or missing, you should contact your vaccination provider. Information on your record about the vaccinations you have received can only be changed if the changes are made or authorised by a recognised vaccination provider.
Further information about privacy
As well as this policy, we have an Australian Department of Health and Aged Care privacy policy.
In addition to this link to the policy, you can obtain a copy of the privacy policy by contacting us using the contact details set out below.
For further information about the use of information in relation to COVID-19 vaccines, see our Privacy Notice for COVID-19 vaccinations.
Complaints
If you wish to make a complaint about the way your personal information has been managed, you can lodge a complaint with us using the details listed below. Please provide as much information as possible so we can investigate and respond.
We will:
- let you know that we have received your complaint
- do our best to respond within 30 days of receiving your complaint. If we can’t respond within this timeframe we will let you know.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner.
