Appendix One - Reviewing vaccination requirements in a Public Service Workplace

Stage one – Conduct a health and safety risk assessment

Each public service agency must conduct a systematic health and safety risk assessment to determine whether, and to what level, vaccination is required to work in the workplace. This includes reviewing an existing policy as part of the regular review cycle, in light of new health advice or some other substantive reason.

Agencies are advised to consider the use of boosters when determining whether a vaccination policy is required, or when reviewing their existing vaccination policy.

This assessment must be consistent with the Health and Safety at Work Act 2015.

The assessment process can use agencies’ usual health and safety risk assessment framework. It can be a high-level desktop analysis of the work undertaken in the agency. Worksafe have provided further guidance on undertaking and reviewing risk assessments.

The risk assessment should be developed in consultation with workers, unions and health and safety representatives. Agencies also need to ensure that they meet the overlapping duties to consult, cooperate and coordinate with other PCBUs. MBIE have provided further guidance and FAQ to help organisations through the review process

The outcome of this process will determine whether vaccination is required to work in the workplace and inform the development, and review, of a vaccination policy (see stage two).

Identify work tasks and situations

Agency risk assessments must consider risks of both agency workers transmitting COVID-19 to others during work, and agency workers becoming infected with COVID-19 at work. Assessments should be based on an assumption of community transmission of a highly transmissible variant.

The first stage of the risk assessment process is to identify where the infection of COVID-19 is most likely to occur for each role, based on the way work tasks are done in the agency. The most likely source of infection in the workplace is where workers interact with others. Consider:

  • Work tasks that involve contact with others
  • The nature of that contact (frequency of exposure and duration), vaccination status being known or unknown, whether the work is undertaken indoors or outdoors, physical distancing
  • What factors the agency has influence and control over (environment, people and processes).

Assess inherent risk

With the work tasks and likely transmission situations identified, the consequences and likelihood of infection occurring should be considered and mapped against the agency’s risk assessment matrix/definitions. These should be defined as if there were no controls currently in place.


  • The consequence of the most credible worst-case scenario associated with the risk of infection with COVID-19
  • The likelihood of transmitted infection occurring and it leading to that consequence.

Information on the Ministry of Health website may provide support with this assessment.

Assess risks and mitigations to determine residual risk

For each work type identified, the following questions must be considered:

  • What is the inherent risk to the community and to agency workers (as assessed in the previous step)?
  • What is the residual risk with current proactive controls (such as barriers, masks, handwashing, social distancing, remote working and rapid antigen tests)? 
  • Does being vaccinated materially reduce residual risk after current proactive controls are taken into account?
  • If all workers who work in that area were vaccinated, what would the effect be on the risk rating?

Further reading: COVID controls for work health and safety reasons, including employer vaccination requirements (Link).

Determine what is reasonably practical

The level of residual risk and what is reasonably practical in terms of managing the risk can then be considered, in discussion with workers and their representatives.

Stage two - Determine if unvaccinated workers can continue to be present in the agency’s workplaces and develop a draft vaccination policy

Based on the risk assessment, agencies should determine if there is any work that must only be done by vaccinated workers, what work can be done by unvaccinated workers, with or without other reasonably practicable risk mitigations, and from this, develop a draft vaccination policy. The policy should include a timeframe and implementation plan for bringing the policy, or any changes to an existing policy, into effect.

Further reading: Other reasons for requiring vaccination of workers (Link)

Aligning vaccination policy and business continuity planning

If the draft policy or policy review includes that some or all work must be done by vaccinated workers, this may support the agency’s business continuity plan. Take this into account when considering reasonable timeframes for the implementation of the policy.

Stage three – Consult workers and unions on draft vaccination policy

As set out in the Health and Safety at Work Act, workers, unions, and health and safety representatives should be engaged throughout the health and safety risk assessment process and the development of a draft policy (stages one and two). At stage three, the agency must consult formally with workers.

Stage four – Finalise and implement vaccination policy

To support implementation of the vaccination policy, agencies must determine if they need to understand the vaccination status of their employees to meet their health and safety obligations to employees and people who come onto their premises.

Understanding vaccination status of workers

Agencies may need to require employees to disclose their vaccination status. For example, this could be if the vaccination policy, informed by the risk assessment process, determines that some or all work in the agency requires vaccination, or where the information is material to a Health & Safety plan. In line with the Privacy Commissioner’s advice, agencies can then ask employees for this information.

When collecting information on vaccination status, agencies must advise employees of the purpose for which it is being collected and how it will be stored. Employees do not have to provide the information, but they must be advised that not providing the information will result in the agency presuming them to be unvaccinated and the consequences of this.

Collecting and storing information on vaccination status

Be aware that vaccination status is personal information and collecting, storing and sharing information about vaccination status must be done in accordance with advice from the Privacy Commissioner. This includes how requests from workers to know the vaccination status of other workers are handled. Agencies need to be mindful of privacy requirements when implementing the outcome of individual discussions with unvaccinated workers.

Agencies need to establish a process for collecting information on vaccination status and how they will store the information in a way that meets privacy and confidentiality requirements.

Evidence of vaccination

Agencies should run educative sessions for workers who are required to be vaccinated on how to obtain evidence of their vaccination status – work through the process provided on the My Covid Record website. They will need an email address or RealMe account.

Where the assessment results in a decision that workers must be vaccinated to work in the workplace, agencies should turn their minds to what evidence of vaccination they require.

My COVID Record is the strongest level of evidence but does require agencies to have robust privacy systems in place to collect, store and process the proof of vaccination.

Applications for medical exemptions, other than the ones contemplated by Director-General of Health will require particular consideration. Ministry of Health advice on  medical exemptions can be found here.

Employees may raise other objections to vaccination, which may lead to exemptions from the vaccination policy.

Implementing the vaccination policy - options and outcomes for employees who are not vaccinated

Once the agency has information on the vaccination status of employees in roles where the policy requires vaccination, agencies should engage directly with unvaccinated employees.

Agencies should arrange an individual conversation with each employee who is not vaccinated or boosted (if applicable) or has not provided their vaccination status. These conversations should be handled sensitively and should identify and acknowledge the personal circumstances of the individual including any objections that the individual may have due to their religious beliefs or other grounds under the Human Rights Act. It is important that the conversation is initiated in sufficient time that the employee has the opportunity to meet the vaccination requirement by the implementation date.

Remind employees of their right to be supported by a union representative or support person of their choice for this conversation.

The purpose of the conversation is to:

  • Discuss in good faith the assessment that shows the employee’s role includes work that the vaccination policy has determined needs to be done only by vaccinated (or vaccinated and boosted) workers
  • Outline the timeframe by which the work will only be undertaken by vaccinated (and boosted) employees
  • Offer an opportunity for the employee to provide feedback on the assessment and timeframe
  • Offer further support to be vaccinated or boosted including assurance that any time required to get the vaccine and deal with after-effects will be paid time
  • Outline the consequences if they do not meet the deadline for a second dose of the vaccine (or booster, as applicable)
  • Explore alternative options, some of which may have been considered at stage two of the assessment, such as:
    • Any reasonably practicable risk mitigations, other than vaccination, that reduce the risk to the health and safety of other people
    • Changes to how the employee carries out the work, including working from home, bubble of one or other altered working arrangements
    • Changes to the employee’s role (including location at which work is performed) to ensure it does not include work that could put others at risk
    • Leave without pay
    • Agreed redeployment to suitable alternative duties.

Ensure the employee has the opportunity to respond to any proposed changes. Agencies must take any feedback into consideration and look for solutions that address the employee’s concerns. 

If an employee does not meet the deadline for receiving the vaccine as specified in the policy, consider options such as working from home or a form of agreed leave (such as annual leave or leave without pay) as you work through options to resolve the situation.

Allow sufficient time to explore reasonable options in good faith. Termination should only be considered as a last resort. Where this is necessary, ensure the employee receives four weeks’ (or the notice period of their employment agreement if more than four weeks) paid notice of termination.

Stage five – Review risk assessment and vaccination policy

As the environment and circumstances are dynamic, the risk assessment should be reviewed in light of any changes in public health advice, availability of vaccination types and boosters, changes to the workforces covered by mandatory orders and the use of testing and other measures.

A review of the risk assessment and vaccination policy no later than three months after implementation would be prudent.

Last modified: