17/07/2023

COVID-19 Vaccination Records Update – July 2023

The regulations under which Employers were permitted to collect and hold COVID-19 vaccination information in Victoria have been rescinded by the Victorian Government with effect from Wednesday 12 July 2023, triggering a positive duty to destroy that information within 30 days, namely by 11 August 2023.

In the midst of 2022, as specific vaccination requirements were eased under Victorian pandemic orders, regulations were enacted. These regulations granted employers a solid legal foundation to collect COVID-19 vaccination information from individuals attending their workplaces. The purpose was to assess and implement practical measures to effectively manage the health and safety risks linked to COVID-19 in the workplace.

What information needs to be destroyed?

As a result of the revocation, any COVID-19 vaccination information collected by an employer to comply with Victorian public health orders and/or to support their own COVID-19 vaccination policies must now be destroyed.

This relevant COVID-19 vaccination information encompasses details such as:

  • Whether a specified person has received any dose of a COVID-19 vaccine, including the date and number of doses.
  • Whether a person is or was unable to receive a dose or additional dose of a COVID-19 vaccine due to reasons such as a medical contraindication or acute medical illness.

The types of documents falling under this category include:

  • Information extracted from the Australian Immunisation Register, including immunisation history statements.
  • Correspondence from registered medical practitioners regarding an individual’s vaccination status.
  • Any certificate issued by Services Australia indicating that the person cannot receive a dose or further dose of a COVID-19 vaccine due to a medical contraindication or acute medical illness.


A “specified person” encompasses individuals such as employees, independent contractors, employees of contractors, volunteers, or students from whom vaccination information has been collected.

Employers should take into account the possibility that any registers or other documents established to oversee or document the collection of vaccination information may also require destruction to meet these obligations.

My organisation has a need to continue to ensure that workers are still vaccinated against COVID-19. What do I have to do?

The revocation of these regulations marks the conclusion of gathering information necessary to address the public health emergency and the corresponding imperative to manage workplace safety concerns. While Victoria still deals with the intermittent waves of COVID-19 within the community, the collection of vaccination information will revert to the standard procedure of collecting, retaining, and utilising health information.

If an employer believes there is an ongoing necessity to collect, record, retain, and utilise COVID-19 vaccination information, especially within the health or emergency services industries, it must be obtained with consent and in accordance with health records legislation.

Employers should also prudently reassess any obligations outlined in policies, procedures, or employment contracts that require employees to provide vaccination information. This ensures that the ability to collect, store, and utilise that information aligns with relevant health records guidelines.