Using the NHS Covid pass for staff

From 1 April, the government will no longer recommend the use of the NHS Covid Pass, although it will still remain available for a limited period.

What is the NHS Covid pass?

The NHS Covid pass is available in England to individuals aged 18 or over. The current requirements for obtaining a pass are as follows:

Booster vaccinations are not currently a requirement for a valid NHS Covid pass for domestic purposes.

The international version of the pass can be used by fully vaccinated individuals as evidence for overseas travel. It is able to evidence that a booster vaccination has been received. A positive PCR test in the last 6 months is also sufficient to obtain an international pass for travel purposes but not for domestic purposes.  

What does the NHS Covid pass look like and how would we check it?

The government have provided various examples of valid NHS Covid passes. Most users are likely to have obtained a digital version of the pass through the NHS app. This shows a barcode, a green stripe across the bottom of the screen and the date of expiry. The digital NHS Covid pass is time limited (even where an individual is fully vaccinated) but can be renewed.

It is possible to verify the barcode by using a separate app released by the Department of Health and Social Care named NHS COVID Pass Verifier. The app is freely available to download and allows a camera to scan an individual’s barcode on a device or printed out copy. Used for domestic purposes, the app will either confirm the barcode is valid or expired. The verifier will see the individual’s name, and either a green tick to confirm the QR code is valid and the date when the pass expires or a grey box stating the QR code is not recognised or has expired. 

How have the rules on using the NHS Covid pass changed?

As part of the government’s announcement on 19 January that Plan B restrictions will end, as of 27 January, it is no longer mandatory for nightclubs and large venues to use the NHS Covid Pass on the NHS App as condition of entry. Organisations can continue to use the NHS Covid pass on a voluntary basis. 

If an individual is not using the NHS Covid pass, they are able to rely on alternative evidence of a negative test, such as an email or text. We await updated guidance to confirm if this will still be an option given it was only introduced following mandatory use of the NHS Covid pass for certain organisations as part of the Plan B restrictions. A positive PCR test within the last 6 months no longer entitles an individual to a valid NHS Covid pass. 

The guidance is clear that essential services and retailers, in particular businesses that were able to stay open during lockdown, should not be using the NHS Covid pass. 

Can we use the NHS Covid pass for staff?

The emphasis so far has been on using the pass for customers and visitors, not staff.  The government position on using the pass for staff is currently unclear. A government press release heralding over 10 million downloads of the official NHS app stated the app would help allow people to “start returning to workplaces” as well as travelling and attending large events but, at the same time, government sources are reported to have denied that workplaces will be encouraged to use the NHS Covid pass for staff.

The working safely guidance, which includes detailed guidance for different types of setting, only specifically mentions the use of the NHS Covid pass in the guidance for events and attractions and restaurants, pubs, bars, nightclubs and takeaway services (specifically for nightclubs) and only in connection with customers rather than employees. 

However, pending further clarity in the guidance, employers could consider introducing use of the NHS Covid pass as an additional safety measure for staff, especially given that the legal rules on social distancing have been lifted.  It may be attractive in a number of situations including:

• as an extra safety measure in settings where staff have to spend prolonged periods in close proximity to customers (potentially even where the customers are not required to show a pass),
• as part of a gradual reopening of the office, where staff could show a pass on arrival or continue working from home if they do not have a valid pass to cover that day, and
• where employers have decided to implement lateral flow testing for staff and wish to exempt fully vaccinated individuals and those with assumed immunity from any repeat testing policy.

Employers should note, however, that the NHS Covid pass is designed for use in settings in England. Other parts of the UK have different arrangements.

There are also some issues with relying on the NHS Covid pass as a safety measure.

• The system involves an element of trust that those using lateral flow tests to obtain the pass actually take the test and accurately record the result (although NHS Test and Trace may be able to pinpoint the source of an infection and we may see sanctions introduced for false test reporting).
• The reliability of lateral flow tests is mixed, and vaccination does not necessarily prevent someone from contracting Covid-19, meaning it is not a fail-safe health and safety measure.
• There is the practical issue of how to check staff passes, particularly for shifts with different start times.  It may be possible to implement an online self-reporting system if physical checks are not practicable.
• The hospitality sector in particular tends to employ high numbers of non-UK staff, who have the right to work in the UK but may have been vaccinated elsewhere and so do not have an NHS Covid pass.

How to comply with data protection law if using the NHS Covid pass for staff? 

The Information Commissioner’s Office (ICO) has recently published data protection guidance on using the NHS Covid pass. 

The ICO guidance explains that it is possible for business to use the NHS Covid pass to allow access to workplaces without processing any data, by choosing not to scan the barcode and by making sure that none of the information is written down or stored in any way.  This approach involves someone simply looking at the pass at the point of entry, without using the scanner and without keeping any records.  

If staff are denied access, for example due to an expired NHS Covid pass, it may be more difficult to avoid record keeping in roles where the employee cannot return to work from home, although it will be up to the employer to decide how absence is recorded in these circumstances.

If the employer chooses to scan the barcode, or to create any records of any kind about someone’s Covid status, the employer will be processing special category health data. This means that, to comply with data protection law, the employer would need to do the following:

• Identify the legal basis for collecting the data. The safest legal bases will be compliance with legal obligations and/or “substantial public interest”. This means that preventing the spread of the virus and complying with the duty of care to employees need to be at the root of the justification rather than, for example, customer or staff preference or boosting confidence. 
• Carry out a data protection impact assessment. This sets out the proposed ways that data will be processed, the risks to data subjects, and the ways in which such risks will be mitigated (e.g. by limiting the number of people who have access to the record, only keeping records for as long as they are necessary, and complying with the other GDPR principles).
• Respect the principles of transparency, proportionality and security. Don’t hold on to the details for longer than necessary. Tell employees why you are processing their information, how the information will be stored, how long it will be retained and who will be able to access it.

What are the equalities issues if using the NHS testing pass for staff?

Using the NHS Covid pass raises fewer discrimination issues than a compulsory vaccination programme, because it provides other routes to demonstrating Covid status. Using the pass could nonetheless still indirectly disadvantage individuals with characteristics that are protected under the Equality Act 2010 (EqA), so the equalities issues need to be considered. The main groups who could be disadvantaged, their potential claims under the EqA and the mitigating steps you could take to reduce risk are set out below.

• Employees who cannot accept the vaccine for medical or belief reasons. As explained in our vaccination FAQs, the numbers falling into these categories are likely to be small. These employees may regard themselves as being put at a disadvantage because (unless they’ve previously tested positive using a PCR test and gain the pass through assumed natural immunity) they will have to submit to regular testing. This may be justifiable as a proportionate means of achieving a legitimate aim if there are workplace safety reasons to use the pass. If there are medical or belief reasons why a person cannot submit to testing, employers would need to consider this on case by case basis.
• Employees not vaccinated in England. The pass only shows that an individual is double vaccinated if they had both doses in England. Using the pass therefore has the potential to be indirectly discriminatory on grounds of race/nationality, especially for example in relation to employees who have only recently started work in England or are working here temporarily. Employers could easily mitigate this risk by accepting alternative evidence of vaccination.
• The “digitally excluded”. It is possible to obtain a paper copy of the NHS Covid pass, but only if you are double vaccinated. Paper copies cannot be used to show test results. There may be some arguments about whether this system disadvantages certain groups, especially the very elderly, but they are unlikely to be relevant when using the NHS Covid pass for staff as opposed to customers.  

Should we make using the pass voluntary or compulsory? 

Employers keen to use the NHS Covid pass but also to avoid risk could begin by making use of the pass voluntary to begin with, using the same social responsibility angle the government is applying to nightclubs and large events settings.

A voluntary approach reduces the risk of discrimination claims as there is no disadvantage to those who don’t volunteer. It also mitigates any data protection risks arising from the creation of records and processing of health data, because individuals volunteering to share information are much less likely to make a data protection complaint and a policy is more likely to be proportionate if there is no mandatory element. 

Some workforces may find they have a very high uptake of the vaccination making the ongoing use of the NHS Covid pass unnecessary. Some employees who are not vaccinated may agree to voluntary regular testing as a result of wanting to be seen to do the right thing. 

If an employer decides that a voluntary approach is not sufficient, then it could consider making the use of the pass compulsory. For employees who are unvaccinated, this will mean compulsory lateral flow testing. Employers will need to consider how staff should obtain the tests, whether they should do the tests at home or as part of an ongoing workplace testing programme, and any national minimum wage issues – see our workplace testing FAQs for more information.  Employers will also need to consider difficult issues about pay if an employee does not take a lateral flow test in time to achieve a valid pass. Any approaches taken, including regarding disciplinary action, should be recorded in a written policy communicated to staff in advance.   It would also be advisable to ensure that employers consult with employees about the use of the Covid pass as part of their consultation on health and safety arrangements. 

What if we make it compulsory and then someone refuses? 

If use of the NHS Covid pass is mandatory, employers should have a written policy outlining the rationale and how a refusal would be dealt with e.g. classed as a failure to follow a reasonable management instruction resulting in disciplinary action.  In the event that an employer dismisses an employee for refusing to co-operate, employees may bring claims relating to data privacy or discrimination (see above) and employees with more than two years’ continuous employment would also be eligible to bring an unfair dismissal claim. It would then be for an Employment Tribunal to assess the reasonableness of the employer’s decision to dismiss. 

Before moving to discipline or dismiss an employee, employers would of course need to discuss the problems and look for solutions. For example, an employee may have been advised not be vaccinated for medical reasons and may be finding repeated testing challenging. Solutions might include allowing an exception, redeployment to another role, or potentially keeping the employee working from home where possible. 

How do we know if individuals are exempt from vaccination or testing?

 
Exempt individuals are now able to apply for proof of evidence of their exemption which will mean they can use the NHS Covid pass in the same way as vaccinated or tested individuals. Until recently, individuals were asked to self-declare their exemption but this is not possible anymore as they will need to use the NHS Covid Pass.

The pass will not show the individual as medically exempt, only displaying the same screen as those that are fully vaccinated or tested.

In summary - practical considerations before implementing the NHS Covid pass for staff  

• Consider the possible use of the NHS Covid pass in the context of your risk assessment. Is a voluntary approach sufficient alongside other measures, or do your circumstances justify a mandatory approach?
• Decide if you need to scan barcodes or keep records. Can you avoid data protection requirements by simply looking at the pass on entry without writing anything down? When using the pass for staff, do you really need to verify the pass by scanning the barcode?
• Explain your proposals to staff as part of your ongoing engagement/consultation with staff on health and safety measures. See our article on the end of lockdown restrictions for the latest on risk assessments and consultation.
• Plan on how staff Covid passes will be checked on entry in a way that minimises disruption to shift times and without putting other aspects of health and safety at risk, for example by creating crowds at entrance barriers.
• Consider any relevant policies regarding sick pay and absence management, bearing in mind that regular testing could result in more staff needing to isolate.
• Ensure staff are trained on the various different ways an individual can demonstrate their status, for example by having a paper copy of the NHS Covid pass.
• Ensure staff are trained on how to deal with an individual claiming to be exempt and that they now need to have applied for an exemption that will enable them to use the NHS Covid Pass.
• Ensure that staff are aware that other health and safety measures remain in place.
• Keep any policy under review in line with the changing situation with Covid-19.