Covid-19: Complaints after England booking site reveals vaccine status

The NHS is revising the booking system for Covid-19 jabs in England after complaints that it could reveal individuals’ vaccination status.

By entering details such as their name, date of birth and postcode it may be possible to work out if another person has been given both doses, one or none.

Privacy campaigners Big Brother Watch called it a “shocking failure”.

NHS Digital said the system had no direct access to medical records and allowed millions to quickly book jabs.

The flaw in the website was first revealed by the Guardian, which said it could allow employers to monitor their workers’ vaccination status or put people at risk of peer pressure from anti-vaccination friends and colleagues not to get the jab.

It comes as the UK reported another 543,323vaccinations given in the last 24 hours, bringing the total number of people who have had both jabs to nearly 16.3 million, with 34.9m first doses given out.

A further 13 deaths within 28 days of a positive test were recorded, while there were 2,613 new confirmed cases.

The website allows people to book appointments without using their NHS number, by entering their name, date of birth and postcode.

But it gives different results depending on whether the individual has already had two doses, one or none, allowing another user to quickly determine other people’s vaccination status.

In the case of someone who has had both doses it currently says: “You do not need to book any coronavirus (COVID-19) appointments using this service.” The Guardian earlier reported that it said “you have had both of your appointments”.

For people who have had one dose, the site presents a screen referring to their booking for a second appointment.

And for those who have not had any jabs, it goes to a standard screening page.

Silkie Carlo, director of Big Brother Watch, said it is “a seriously shocking failure to protect patients’ medical confidentiality at a time when it could not be more important”.

She said the data was “exposed to absolutely anyone to pry into” because date of birth and postcode information can easily be found or bought.