By Kelly Godfrey

From 12 July 2023, all businesses operating in Victoria must have, subject to any exception, destroyed within 30 days, any COVID-19 vaccination information recorded, used, collected or held by the business under the Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations 2022 (the Regulations).

Destruction was not required where a business was otherwise required, or under other laws permitted, to collect, use, record or hold vaccination information.

A failure to comply with the Regulations will result in breaches of the Privacy Act 1988 (Cth) and Health Records Act 2001 (Vic), which regulate the handling of health information about individuals in Victoria.

While the Regulations are silent on the method of destruction that must be undertaken, the information should have been destroyed in a manner that ensures the information will remain confidential. As part of best practice, the business should have advised the relevant party that their COVID-19 information would be destroyed.

COVID-19 information captures a vast array of material, including vaccination records (such as the number of vaccinations, date taken and pathology results), as well as medical exemptions provided to the business excusing the individual from receiving a COVID-19 vaccine.