What must you do today?

If you are an approved residential aged care provider (RAC Provider), you must report the following to the Department of Health via the My Aged Care provider portal today (15 June 2021):

• the total number of service staff, including volunteers, at each aged care service;
• the number of service staff who have voluntarily informed you that they have received a single dose of a COVID-19 vaccine
• the number of service staff who have voluntarily informed you that they have received all required doses of a COVID‑19 vaccine.

The new requirements do not empower RAC Providers to make COVID-19 vaccinations mandatory, nor do they require staff to provide information about their vaccination status.

See the Accountability Principles 2014 and Records Principles 2014 (Principles) which were amended on 5 June 2021.

Reporting for in-home and community aged care providers is currently voluntary, but mandatory requirements are said to also commence over the coming weeks (although exact dates have not been specified).

What else do RAC Providers need to know?

1. ‘Service staff’ means staff (including volunteers) who access, or are reasonably likely to access, any premises where the operation or administration of a residential care service, flexible care service or multi-purpose service in a residential care setting occurs.

This includes staff who are responsible for resident care, support and services for residents, and maintenance and administration, such as nursing and personal care staff, administration staff, and kitchen, cleaning, laundry and garden staff.

2. Do not report any ‘personal information’ to the Department.

The Department of Health is only interested in vaccination data at an aggregated and de-identified level to assist with pandemic preparedness planning. This means RAC Providers are not disclosing ‘personal information’ for the purposes of the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APP) do not apply to these reports.

3. You must continue to report the above information each subsequent Tuesday until 30 June 2022 (unless the numbers since the last report have not changed).

From 30 June 2022 onwards, the number of service staff who have received a single dose of a COVID-19 vaccine will no longer need to be reported, but the number of service staff who voluntarily inform you that they have received the annual seasonal influenza vaccination and all required doses of a COVID-19 vaccine for the calendar year will need to be reported. The frequency of reports will also change to an annual reporting day on 30 June each year.

4. RAC Providers must keep records of the number of staff who have voluntarily disclosed their COVID-19 vaccination status.

The provision of vaccination status information by aged care staff is voluntary in every state and territory, except for staff of residential aged care facilities in South Australia where it has been made mandatory (see the relevant direction).

5. Records do not need to include personal information.

RAC Providers are only required to record de-identified data on:

(a) the number of staff who have voluntarily informed them that they have received a single dose of a COVID-19 vaccine

(b) the number of service staff who have voluntarily informed them that they have received all required doses of a COVID‑19 vaccine.

This means identifiable information, such as which named staff members have received the COVID-19 vaccination, are not required to be recorded.

However, from a practical point of view, RAC Providers need to have systems in place for accurately recording updated vaccination status numbers each week, such that duplicate records are avoided.

6. If a RAC Provider decides to include ‘personal information’ in their vaccination status record, the Privacy Act and APPs apply.

Where RAC Providers collect identifiable information, in addition to vaccination statuses, the Privacy Act and APPs apply. This could include, for example, collecting a name, date of birth or the position title of a staff member where that position is held by only one or a limited number of persons in an organisation.

There are limited circumstances where the collection of employee vaccination statuses is permissible – as this is health information, the individual must consent to the collection, and it must be reasonably necessary for the approved provider’s functions or activities to collect and hold that information. Furthermore, reasonable steps must be taken to notify staff about the matters set out in APP 5, which may be in the form of a written or verbal collection notice.

RAC Providers may form the view that recording the personal information of staff with their COVID-19 vaccination status would provide for:

(a) greater efficiency – for example, by recording the status of named staff members, you would only need to seek updated statuses from specific individuals who have not received the full dose of the vaccination, and

(b) greater utility – for example, nursing and personal care staff compared to garden staff may be exposed to or contribute to different levels of risk, meaning a more detailed understanding of the vaccination statuses of staff could better assist RAC Providers with their management and prevention of COVID-19.

If you wish to collect ‘personal information’ with vaccination statuses, consider seeking legal advice about the lawfulness of your collection and what information you need to provide to staff and volunteers at the time of or before voluntarily collecting their health information (in the form of an APP 5 collection notice). The exemption of these employee records from the application of Privacy Act and APPs does not apply until after the personal information is lawfully collected.

Tips for communicating with staff

• Be clear in your communications (verbal and written) about the new recording and reporting requirements.
• Acknowledge the importance of vaccination status information to pandemic preparedness planning.
• Reinforce the de-identified nature of the reports provided to the Department of Health.
• Explain that any collection of personal information will be in accordance with the privacy laws and ensure that measures are in place before collection of personal information to ensure compliance with privacy laws.

Tips for recording vaccination statuses

• Clearly set out the procedure for collecting vaccination status information, including what the approved process is, and what should be recorded and where.
• Train staff about the organisation’s privacy obligations, including the types of information that should and shouldn’t be recorded.

For more information, see the Department of Health’s fact sheets.

Please let us know if you require assistance with any of the above. We are experienced with drafting internal communications and APP 5 collection notices, as well as advising on the privacy risks associated with handling personal information.