National Vaccination Programmes

How we use personal data to support the national COVID-19, and Flu and MMR Vaccination Programmes

The National Immunisation Management Service

Purposes for processing

With the availability of a vaccine for COVID-19, there is a need to coordinate vaccination for the population of England.

The seasonal flu programme is a long-established and successful vaccination programme. The service is offered to patients who are particularly susceptible to the flu for example because of their health condition, age or because they are pregnant.

NHS England has established a centralised service for the management of both the COVID-19 and seasonal flu vaccination programmes. This service is supported by a central system, the Immunisation Management System.

The key functions of this system are to enable identification of priority groups, to send invitations to book appointments for vaccination, to manage and monitor the progress of the programme.

In summary, the system works as follows:

Loading personal information about people in England

The demographic details of everyone resident in England or registered with a GP in England are imported into the system from the Primary Care Registration Management Service operated by NHS Digital on behalf of NHS England. After an initial load from NHS Digital, the data is kept up to date overnight.

Information about patients who are particularly susceptible to the flu because of their health condition or because they are pregnant is also uploaded into the system from data held by NHS Digital.

Further data such as lists of shielded patients, NHS staff,  social care workers, unpaid carers and ethnic category information are also uploaded. This data can then be used for prioritising invitation for flu or COVID-19 vaccination, and for reporting purposes.

Selecting people to invite for immunisation 

The system has an interactive dashboard which will allows us to select groups of people to invite for immunisation. Factors such as age, ethnic origin, gender and underlying health conditions can be applied. We can also select NHS staff, social care workers and unpaid carers.

The system shows how many people will be invited if the selected criteria are used. The analysis will include a full geographical breakdown so users can ensure there are sufficient vaccinations and delivery capacity to meet demand.  People already vaccinated will be excluded automatically so they are not invited again.

The system sends invitation letters to the people selected.

Sending invitations for vaccination

The list of people to be invited to book an appointment is sent to an automated mailing service. The mailing service prints and sends invitation letters, which explain how to book an appointment for vaccination either for flu or COVID-19.

We also send messages by SMS text messages and email using mobile phone numbers and addresses that are held on the Personal Demographics Service. We send invite notifications to people who have registered on the NHS App and have opted into push notifications.

The Immunisation Management System keeps a record of everyone who has been invited for vaccination. NHS England uses this information to send reminders to people by the methods described above, if they have been invited to attend for vaccination and have not been vaccinated. We may also send reminders to people who have been invited for COVID-19 vaccination and have not booked an appointment through the National Booking System.

The NHS App Messaging Service will be run and managed by NHS South, Central and West CSU Immunisation Management Service.

NHS App Messaging Service will be processing data received from the NIMS Database and sending specified Messages to citizens via the NHS App.

These messages will be Invitations & Reminders for patients who are eligible for specific immunisations.

Any message failures will be scraped up and sent for onwards processing to the NIMS Hybrid mail partner for onward processing via existing processes for SMS / Email or Letter invitations.

The role of NHS Digital is to:

  • define cohorts for vaccination, based on guidance from JCVI and NHS England on which groups are priority
  • send notifications of vaccine eligibility to people based on NHS England cohorts
  • provide a national booking service that enables people to book vaccination appointments through the NHS website, and staff at vaccination sites to manage and check-in people for appointments
  • continue to link national and local booking systems
  • coordinate and assure third party systems to capture and manage vaccination events
  • provide and/or manage data flows and make sure they are shared safely and appropriately
  • oversee the clinical safety, quality and security of the solutions within each of the vaccination settings

Booking appointments

The list of people that have been invited for a COVID-19 vaccination is sent to the National Booking System, which invitees can use to book an appointment online. This system is managed by NHS Digital.

NHS England and the Department of Health and Social Care have also established a COVID-19 vaccine telephone booking service – available by dialling 119.

Informing GPs

The system sends daily updates to GP systems to allow them to update their local record and monitor progress for their patients.

Recording vaccinations given

When someone attends for vaccination, the immuniser will be able to use one of a number of applications provided by NHS England as a controller to record the details of vaccinations administered and any adverse reactions. The central Immunisation Management System is updated with this information.

Other attributes are collected at the point of care include:

  • Carer
  • Social care worker
  • Health care worker
  • Care home worker
  • Care home resident
  • Ethnic category
  • Vaccination location
  • Care home details

These applications obtain details of current immunisation status from the Immunisation Management System to so that the immuniser can make an informed decision on whether it is safe to administer the immunisation or not.

Vaccination providers that use these applications are able to obtain reports from them on the people they have vaccinated, to enable them to conduct second dose COVID vaccination recall.


The system includes a business intelligence tool which provides comprehensive analysis of how the vaccination programmes are progressing, nationally and locally.

Categories of personal data and sources

The Immunisation Management System obtains names, addresses telephone numbers, other personal details, and GP registration information from the Primary Care Registration Management service that NHS Digital manages as a processor for NHS England.

It receives information about health conditions and other factors that can make people vulnerable to the flu from NHS Digital who collect it from GP Practices, acting under directions from the Secretary of State for Health and Social Care. We also obtain information about ethnic category from NHS Digital.

It receives information about vaccinations given from GP Practices, pharmacies and other vaccination centres. This is so that we can send out reminder letters, inform GPs for them to update their records, and monitor the progress of the vaccination programme.

The data collection and reporting system receives information about vaccination decisions – given or not given. It also includes demographic data about NHS staff from the NHS Electronic Staff Record, obtains NHS Numbers traced from the Primary Care Registration Management service.

Lists of unpaid carers are obtained via NHS Digital from the Department for Work and Pensions, Local Authorities and other sources.

Categories of recipients

The system sends lists of people to be invited for vaccination to the mailing service managed by NHS England, and for COVID-19 vaccination invitations, the National Booking Service managed by NHS Digital.

The system sends information to GP Practices so that they can update their records about vaccinations that their patients have received at pharmacies or other vaccination centres.

The system sends personal data to the NHS England COVID-19 datastore.

Personal data relating to COVID-19 vaccination from the Immunisation Management System is shared with the following external agencies:

  • Public Health England – an executive agency sponsored by the Department of Health and Social Care
  • Joint Biosecurity Centre (JBC) – a directorate of the Department of Health and Social Care
  • Trusted Research Environments – operated by the Office for National Statistics (ONS) and Health Data Research (HDRUK)
  • SPI-M – an independent group set up by the Government to support the Scientific Advisory Group for Emergencies (SAGE)
  • NHS Digital – joint controller with NHS England for processing to facilitate the analysis, linkage and dissemination of data about COVID-19 vaccination (under the COVID-19 Public Health (NHS England) Directions 2020) to requestors who have an appropriate legal basis to process it.
  • The Department of Health and Social Care receives data about individuals’ immunisation status in order to issue the NHS COVID pass.

The following organisations provide data processing services:

  • South, Central and West Commissioning Support Unit (part of NHS England) – authorised staff for the purposes of administering The National Immunisation Management Service
  • Synertec – a data processor engaged to send letters and texts
  • System C – a data processor engaged to provide the technical structure of the National Immunisation Management Service
  • Suppliers of systems deployed in provider organisations to record vaccination events
  • NHS Digital – management of data flows.

Measles, Mumps and Rubella call and recall service

Purposes for processing

The National Immunisation Management Service supports call and recall for Measles, Mumps and Rubella (MMR) vaccination as described below.

Measles is a highly infectious viral illness that can be very unpleasant and sometimes lead to serious complications, including infections of the lungs. Anyone can get measles if they have not been vaccinated or have not had it before, although it’s most common in young children.

Measles can be prevented by having the Measles, Mumps and Rubella (MMR) vaccine, which is given in 2 doses as part of the NHS childhood vaccination programme. The first dose is given on or around 12 months old, and a second dose is given at or soon after 3 years and 4 months old.  Adults and older children can be vaccinated at any age if they have not been fully vaccinated before. Children are at additional risk if MMR is circulating among the population.

NHS England wish to contact parents of the cohort of children age 1 rising to 6 years as quickly as possible so that catch up of missed or delayed vaccination as a result of the COVID-19 pandemic is achieved. The primary purpose is to increase MMR uptake for the wellbeing of the individual child and to decrease the risk to the public as a whole of a significant measles outbreak occurring. There is therefore a public interest in reducing likelihood of a measles outbreak and maintaining a good level of immunity.

The purpose of the MMR vaccination programme call and recall service is to promote the take-up of the MMR vaccine amongst individuals between the ages of 1 to 25 years who have not received dose 1 and/or dose 2 MMR vaccinations.  This will be achieved through the sending of letters, follow-up letters and texts to parents of children or individuals registered with a GP in England who have not received a full two doses of MMR vaccine, to remind them to arrange and take up an MMR vaccination with their GP Practice.

Letters and texts are scheduled to be sent from September 2022 onwards.  Communication scheduling will be subject to provider capacity, vaccine supply, priority age cohorts and emerging population susceptibility risks.

Sources of the data

GP Practices’ GP IT System Suppliers provide the MMR call and recall service dataset to NHS Digital.  The Immunisation Management System database will be updated daily with a new flow of data from NHS Digital to update any change in vaccination status.

Categories of personal data

The following personal data of individuals aged 1-25 years registered with an English GP practice who have not received the full two-dose MMR vaccination in England will be processed.

  • Name
  • Address
  • Date of birth
  • Gender
  • NHS number
  • MMR vaccination details and status for 1st and 2nd dose
  • Date and site where vaccination given
  • Whether refused vaccinations or vaccination not given
  • Date of refusal/not given

Choosing your COVID-19 vaccination invitation preference

We have set up a service for people to choose whether they receive invitations and reminders to attend for COVID vaccination. This is available at The service is available aged 16 and over.

NHS England has received requests from data subjects to stop sending them invitations to book for COVID-19 vaccination. We have treated these as right to object requests. To date (17/12/2021) we have declined them on the basis that we have compelling legitimate grounds to continue processing, underpinned by our statutory powers and the need to respond to the pandemic emergency.

With the success of the vaccination programme and wide publicity about how important vaccination is, we now acknowledge that grounds to continue processing specifically to send invitation letters for COVID-19 vaccinations where a subject has objected have diminished. So, we have set up the Choose your COVID-19 vaccination invitation preference service.

When you access this service, we need to verify your identity. You will need to provide your name, date of birth, and either your NHS Number or postcode. Once we find a match and verify this, using a security code sent to your registered mobile number or email address, we do not keep this information. There is a facility to find an NHS number if you do not know it.

You will also need to have an email address or mobile phone number that you have registered with your GP, and so with the Personal Demographics Service managed by NHS Digital. This is used to send you a security code (via the GOV.UK Notify service) which you enter into the system, before proceeding to choose whether or not to receive COVID-19 appointment invitations.

Once you have made your preference, your choice is saved against your NHS number. This is the minimum amount of information that we need to provide this service.

We also record and store audit data each time you use the service, including the date and time and internet protocol (IP) address. This is stored to help us monitor the service and protect the service for malicious use. Your data is stored on secure servers in the European Economic Area.

Access to the service is also available by calling 119. The call handler talks you through the process, entering the data you provide into the online service. You provide your name, date of birth, and either your NHS number or postcode to the call handler so they can verify your identity. You also need to have your registered mobile phone or email account available so you can receive the security code and provide it to the 119 call handler.

If you have difficulty communicating or are a British Sign Language (BSL) you can use textphone 18001 119 or the NHS BSL interpreter service.

Whilst you will no longer receive COVID-19 vaccine invites, your details will continue to be stored on the Immunisation Management System, for the purposes of managing and monitoring the progress of the programme.

If circumstances were to change, for example should the effects of the COVID-19 pandemic significantly worsen, we may consider whether we have compelling grounds to send vaccination invitations irrespective of any preference set.

Setting your COVID-19 contact preference using this central service will not stop other organisations such as your GP practice from sending you invitations for vaccination.

Vaccine Data Resolution Service

We have set up a Vaccine Data Resolution Service (VDRS) to rectify data quality issues identified within the COVID-19 vaccination records for people vaccinated as part of the Vaccination Programme. This involves adding missing vaccination records, amending or deleting incorrect records.

One part of the service is accessed by people calling 119 if they suspect that their vaccination records are incorrect. The VDRS call handlers check the caller’s personal details against the Personal Demographics Service then ask for details of vaccinations given or errors. When the resolution has been established the call-handler makes appropriate updates are in the Immunisation Management System (IMS).

Another part of the service involves searching for incorrect records, for example where there is a second vaccination recorded without the first. When we find incorrect records like this, our VDRS team call people on the phone number registered with their GP to ask them if they would like the record to be corrected. If they agree and the correct information is established, the IMS records are updated.

The third part of the service is to create records where people have been vaccinated abroad. Only records of vaccines that are approved for use in the UK are recorded. Someone who has had vaccination abroad and wants it recorded books an appointment on the National Booking Service – either online or via 119. They attend the vaccination centre they’ve booked where the evidence of the vaccination is reviewed by a trained clinical administrator. Photographic ID is checked to ensure it matches that of the booking, the Personal Demographic Service record and the individual presenting it. It is also matched with the vaccine evidence to be provided. The vaccination centre then sends the required changes to our VDRS team to update the records in the IMS.

Data Protection Impact Assessment: National Flu and COVID-19 Vaccination Programme including the National Immunisation Management Service (NIMS)

View the Data Protection Impact Assessment: National Flu and COVID-19 Vaccination Programme including the National Immunisation Management Service (NIMS)

Data Protection Impact Assessment: National Immunisation, Vaccination System – Health Care Workers

View the Data Protection Impact Assessment National Immunisation, Vaccination System – Health Care Workers

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’.

For the processing of special categories (health) data the conditions are

Article 9(2)(h) – ‘…health or social care…’

Article 9(2)(i) – ‘…public health purposes…’,

Article 9(2)(j) – ‘……archiving…research…or statistical purposes…’

For processing special categories (ethnicity) data the conditions are

Article 9(2)(b) – ‘…social protection law…’ (for monitoring equality of access)

Article 9(2)(h) – ‘…health or social care…’

Article 9(2)(j) – ‘……archiving…research…or statistical purposes…’

NHS England’s basis to process confidential patient information, setting aside the duty of confidence, is regulation 3(3) of the Health Service (Control of Patient

Information) Regulations 2002 (COPI), which were made under section 251 of the NHS Act 2006.