Information processing vaccines

Status of this web page

This web page is a working tool to support the decision-making process. It contains a state of affairs of the insights but is not meant to be an official source of the final policy decisions. The text parts in italics are still under discussion.

Overview

The information system with regard to COVID-19 vaccination has to support the following processes

selecting the people to be invited for vaccination
inviting the people to be vaccinated
booking a vaccination slot
registering the vaccination
managing the individual vaccination scheme
disclosure of personal vaccination data to
- the vaccinated person
- health care providers and health care institutions having a care relationship with the vaccinated person
- contact centers for contact tracing in order to evaluate the actions to be taken towards high risk contacts
delivery of a vaccination certificate
calculating the distribution of the costs of vaccination between Federal State and the federated entities
pharmacovigilance and traceability of the vaccines against COVID-19, in accordance with the current regulation
post-authorization monitoring and surveillance, after anonymization, or at least pseudonymization of data, in case that anonymization would not allow the post-authorization monitoring and surveillance to be carried out
support of scientific and statistical studies after anonymization, or at least pseudonymization of data, in case that anonymization would not allow the scientific or statistical study to be carried out

In order to support these processes, 4 databases are used

the vaccination codes database at the federated entities responsible for the organization of the vaccination and Sciensano
Vaccinnet at Vlaams Agentschap Zorg & Gezondheid, with joint controllership between the federated entities and Sciensano
VONS (Vigilance Online Notification System) at Federal Agency for Medicines and Health Products (FAMPH)
COVID-19 TestResult database at Sciensano

Process descriptions

1. Selecting the people to be invited for vaccination

Selection means that a person is selected according to a prioritization on the basis of established criteria to be allowed to be vaccinated from a certain moment.

The selection of the people to be invited for vaccination throughout the different phases can be made by several authorities and be based on different sources

as far as the selection is function of the fact that people are working or residing in a collectivity, or working in a company: the list of people available at the collectivity or the company
as far as the selection is function of the fact that people are health care worker: Cobhra
as far as the selection is function of the fact that people have been infected in the past: COVID-19 TestResult database
as far as the selection is function of age criteria: the national register
as far as the selection is function of the health situation: registers such as the cancer register, databases of the sickness funds, … and/or EHR held by the general practitioner (preferably the holder of the global medical file)
…

In order to prevent an undesirable multiple vaccination of the same person, a dual check has to be performed before inviting the selected people to be vaccinated

a check that the person has not been vaccinated yet
a check that the same person has not been selected multiple times

This check will be performed by the use of a vaccination codes database. This database is similar to the CTPC database, containing corona test prescription codes.

In order to prevent the mere fact of being included in the database from indirectly revealing information about a person’s health status, each person is assigned a vaccination code.

The vaccination code is only activated for a person to be invited for vaccination if the source that has selected the person doesn’t administer the vaccine itself. An active vaccination code permits the person concerned or a vaccination center to book one or two moments of vaccination at a vaccination center.

If the source of selection doesn’t administer the vaccine itself, the selection induces the activation of a vaccination code to the person concerned within the vaccination codes database by using a web service. A vaccination code is not activated if the person has already been vaccinated.

A person selected to be invited for vaccination is warned during the invitation and/or booking process about contraindications. The decision to be vaccinated or not is freely taken by every individual.

As soon as a vaccination has been registered at Vaccinnet and transmitted to the COVID-19 TestResult database at Sciensano, the vaccination status of the person and, if relevant, the period during which any necessary second vaccine can be administered on the basis of the vaccination code, is updated within the vaccination code database.

Insofar as the selection of a person to be vaccinated by priority is made by another source than the general practitioner that holds the global medical file (GMF-holder) of the person concerned, the GMF-holder is informed about the assignment of a vaccination code via an eHealth-box message.

General practitioners will have the ability to update the patients’ vaccination status in their EHR by calling a batch or transactional web service from Vaccinnet based on their patients’ SSIN. Moreover, they will have the possibility to check the vaccination status and the usage status of the vaccination codes of their patients by calling a transactional web service form the vaccination codes database based on their patients’ SSIN. Collectivity doctors will have the possibility to check the vaccination status and the usage status of the vaccination codes of the people working or residing in a collectivity by calling a transactional web service from the vaccination codes database based on the people’s SSIN. Company doctors will have the possibility to check the vaccination status and the usage status of the vaccination codes of the people working in the company by calling a transactional web service from the vaccination codes database based on the people’s SSIN.

2. Inviting the people to be vaccinated

People can be invited to be vaccinated by

the company or collectivity doctor;
their general practitioner;
their sickness fund;
the competent vaccination center;
the vaccination codes database;
the municipality or city of residence;
for a required second vaccine, the person who administered the first vaccine

If persons are invited for vaccination on the basis of the vaccination codes database, this can be done via sms, via e-mail (eBox citizen or regular mail) and/or via a paper letter.

The cell phone numbers and email addresses are obtained from

the sickness funds for their affiliated members
the CSAM service for people who have activated an eBox citizen
the CoBRHA database for health care providers

The address details of the main residence for the invitation by paper letter are obtained from the National Register.

Invitation by the competent vaccination center (applied in Flanders (except Antwerp and Ghent) and in Wallonia for citizens)

The invitation by the competent vaccination center implies that for a person, depending on the vaccine to be administered, 1 or 2 vaccination moments are booked, and that those moments are communicated to the person concerned together with the vaccination code, with which the person concerned, his representative or a contact center agent

either can confirm the reservation moment(s);
either can change the reservation moment(s);
either can cancel the reservation moment(s) and indicate that he does not want to be vaccinated;
either can cancel the reservation moment(s) and indicate that he wants a home vaccination for health reasons.

Either both vaccination times are communicated at once, or at first only the first vaccination moment is communicated and the possible second moment is communicated by the receptionist of the vaccination center when the first vaccination takes place.

From the vaccination codes database, the vaccination center receives an electronic list of vaccination codes and associated NISS and postal codes of the place of residence with regard to the number of people it indicates in function of the available vaccination capacity. For the persons concerned, one or two vaccination moments are booked in the reservation application, depending on the vaccine to be administered. The vaccination center keeps a number of vaccination slots free so that people can change the vaccination moment. The vaccination center has a reserve list (the following people to be vaccinated) to organize last minute reservations by calling people. The last minute reservation is made on the basis of the vaccination code with feedback to the vaccination codes database.

If a GSM-number and/or an email address of the person concerned is available in the vaccination codes database, the reservation application send san SMS and/or email through this channel, stating the reservation times, name (and in case of email the address) of the vaccination center and the vaccination code. A letter can also be sent.

If no GSM-number or email address is known for the persons concerned in the vaccination codes database, a letter will be sent anyway with the same information.

The prioritization of the persons invited to vaccination is carried out according to criteria established for the whole country by the competent bodies. The prioritization takes place within the cohort of persons for which a vaccination code has been activated within the vaccination codes database for all postal codes for which a vaccination center is competent. There is therefore no stratification per zip code.

The reservation application allows a vaccination center, within its area of competence, to very easily make a selection by zip code of the residence of the person concerned of persons aged 65 or older (wave IA group A) or 18 years or older (wave II) who are invited, but who have not yet confirmed or canceled the reservation moments. Provided there is a legal basis for this, these lists can be securely communicated by the vaccination center to the municipality where the person has his main residence, so that the municipality can contact those concerned to raise their awareness. The municipalities cannot receive lists from which health information can be derived directly or indirectly and can of course only use the lists to support the vaccination campaign.

Invitation by the vaccination codes database (applied in Antwerp, Brussels and Ghent, and in Wallonia for health care providers)

The invitation by the vaccination codes database implies that the person concerned receives an invitation containing the vaccination code, with which the person concerned, his representative or a contact center agent

can book reservation moment(s);
can change reservation moment(s);
can cancel reservation moment(s) and indicate that he does not want to be vaccinated;
can cancel reservation moment(s) and indicate that he wants a home vaccination for health reasons.

In function of the available vaccination capacity, the vaccination center regularly indicates the number of people that have to receive an invitation from the vaccination codes database. The vaccination center has a reserve list (the following people to be vaccinated) to organize last minute reservations by calling people. The last minute reservation is made on the basis of the vaccination code with feedback to the vaccination codes database.

If the person’s GSM number and/or email address is available in the vaccination codes database, that database sends an SMS and/or email through this channel, indicating a link to the application where the person can book vaccination moments as well as the vaccination code.

If no GSM number or email address of the person concerned is available in the vaccination codes database, a letter will be sent with the same information.

Country-wide prioritization algorythm

The applied country-wide prioritization algorythm is as follows

Health professionals, in descending age; within the global category of health professionals, a priority is given to certain professions
Pregnant women, in descending age
Essential workers, in descending age
Citizens aged 70 or over, in descending age
Distribution at a percentage defined between the following categories (when one of those categories is exhausted, the result is completed with the other category until its own exhaustion)
- citizens aged 65-69, in descending age (75%)
- citizens aged 18-64, selected by sickness funds or general practitioners, in descending age (25%)
People residing in a centre for asylum seekers, in descending age
Citizens aged 18-64 not selected by sickness funds or general practitioners, in descending age

Invitation by paper letter

To the extent that communication takes place via a paper letter, the printing and sending of the letter is organized by the federated entities, without the data obtained for this purpose being used by the federated entities for other purposes or communicated to third parties, such as local authorities. As soon as a letter has been sent successfully, the data obtained is deleted by the federated entities. The data obtained are treated and the paper letters are sent under the responsibility of a medical doctor.

3. Booking a vaccination slot

In principle, company doctors, collectivity doctors, general practitioners, hospital doctors, obstetricians and pharmacists organize themselves the vaccinations they administer. The activation of a vaccination code is not necessary in that case. However, if they wish to use a reservation software, this software can use the functionalities of the vaccination codes database via web services.

Vaccination at a vaccination post always requires an active vaccination code. One will be able to book a one or two vaccination slot(s) at a vaccination post by using a common reservation application for all vaccination posts. The reservation application meets the functional requirements described in a call for tender and is offered by a private company following a public procurement procedure.

Each vaccination center is competent for residents of one or more zip codes. Any changes to this competence will only have an effect after all reservations made have been honoured, or the reservations have been transferred between the relevant vaccination centers.

Each vaccination center determines per vaccination line the capacity that is available on each day of the week + 2 (see calendar) and thus the number of people who can be vaccinated. This is done every Monday before 12 noon by specifying possible vaccination times in the reservation application. This will be done for the first time on February 15 (Monday of week 7) for all days of week 9.

As from March 30 an application will be available that permits people belonging to the actual priority group to indicate that they are available for a last minute booking on one or more days during the coming 2 weeks. This application meets the functional requirements described in a call for tender.

4. Registering the vaccination

Every vaccine against COVID-19 administered on the Belgian territory is registered in the Vaccinnet database by the health care provider that administers the vaccine, more especially

physicians
- general practitioners
- company doctors
- collectivity doctors
- hospital doctors
nurses
obstetricians
pharmacists
people mandated by the persons mentioned above under their responsibility

The vaccination is registered

via a web application offered by Vaccinnet after authentication of the identity of the user at CSAM level 400 or higher
via a software that uses an API (Application Programming Interface) to Vaccinnet
via a batch upload by health care institutions

Before a vaccination is performed, the person who administers the vaccine

consults Vaccinnet in order to check the vaccination status of the person to be vaccinated; this consultation is based on the SSIN of the person to be vaccinated
checks for any contraindications for vaccination based on the EHR or information collected from the person to be vaccinated

The data to be registered are

data about the vaccinated person
- Social Security Identification Number (SSIN)
data about the vaccine administrator
- RIZIV/INAMI number or SSIN
data about the vaccine administered
- name of the vaccine (CNK or ATK code)
- lot number of the vaccine
- identification number of the vaccine
data about the vaccination circumstances
- date of the vaccination
- date of coding in the database (automatically generated)
- place of vaccination (RIZIV/INAMI number or KBO/BCE number)
- serial number of the vaccination
- (immediate) reaction to the vaccine

The data indicated in blue are copied into the Vitalink vault, only for the purposes of disclosing the personal vaccination data to

the vaccinated person
the health care providers and health care institutions having a care relationship with the vaccinated person, for purposes of qualitative health care provision

All data registered in the Vaccinnet database with regard to the vaccines against COVID-19 are copied into the COVID-19 LaboratoryTestResult database, only for the purposes of this database as described within the Cooperation agreement establishing it.

5. Managing of the individual vaccination scheme

Vaccinnet is able to feed the process for inviting persons to get a follow-up vaccination.

6. Disclosure of personal vaccination data

The vaccinated person has access to his/her vaccination data available in Vitalink via a web application accessible via the Personal Health Viewer. Regional eHealth initiatives will be able to put a link to the web application on their patient portals.

Health care providers and health care institutions having a care relationship with the vaccinated person have access to the vaccination data available in Vitalink via the hub-metahub system.

As far as vaccination data are needed for the contact centers for contact tracing in order to evaluate the actions to be taken towards high risk contacts, a copy of the data within the COVID-19 TestResult database is used.

7. Delivery of a vaccination certificate

Every vaccinated person will be able to get a printable, electronic vaccination certificate with regard to COVID-19 vaccines via the Personal Health Viewer. The certificate is quadringual (Dutch, French, German and English) and contains the following information

the SSIN, name, surname, sex, date of birth and nationality of the certificate holder
the indication of the Belgian state as the issuer of the certificate
for every vaccination
- the name of the vaccine
- the vaccination date

As soon as a standard model for the certificate would be defined by the WHO, this standard model will be used.

8. Calculating the distribution of the costs of vaccination between Federal State and the federated entities

To be added

9. Pharmacovigilance and traceability of the vaccines against COVID-19, in accordance with the current regulation

Undesirable effects of vaccines against COVID-19 can be reported via a webform by a citizen or health care provider. The user has to authenticate its identity at CSAM level 400 or higher. A citizen can only report undesirable effects for himself or for whom he is legally responsible. A health care provider can report undesirable effects for everyone. The SSIN of the person for whom an undesirable effect is being reported, is used in order to prefill the information about the vaccine(s) administered to the person as available in the COVID-19 TestResult database. The information about the vaccine(s) administered to the person that are prefilled, are

data about the vaccinated person at the moment of use of the webform
- age
- sex
data about the vaccine administered
- name of the vaccine
- lot number of the vaccine
- identification number of the vaccine
data about the vaccination circumstances
- date of the vaccination
- place of vaccination (RIZIV/INAMI number or KBO/BCE number)
- serial number of the vaccination
- reaction to the vaccine (coded list of unwanted effects)
- comments (free text)

The reported undesirable effects are stored in a pseudonymized way in the VONS database at the Federal Agency for Medicines and Health products.

It will be analyzed whether reporting an undesirable effect could also be possible by using an eForm generated by the software of a general practitioner.

10. Post-authorization monitoring and surveillance

Post-authorization monitoring and surveillance is based on anonymized, or at least pseudonymized data, in case that anonymization would not allow the post-authorization monitoring and surveillance to be carried out. The data are anonymized or at least pseudonymized by HealthData with use of the relevant basic service offered by the eHealth platform according to methodology to be approved by the Information Security Committee.

An adequate and formal separation of duties is put in place between HealthData and the people carrying out the post-authorization monitoring and surveillance in order to prevent any possibility of reidentification of the anonymized or pseudonymized data.

11. Support of scientific and statistical studies

Scientific and statistical studies are based on anonymized, or at least pseudonymized data, in case that anonymization would not allow the scientific and statistical studies to be carried out. The data are anonymized or at least pseudonymized by HealthData with use of the relevant basic service offered by the eHealth platform according to methodology to be approved by the Information Security Committee.

An adequate and formal separation of duties is put in place between HealthData and the people carrying out the scientific and statistical studies in order to prevent any possibility of reidentification of the anonymized or pseudonymized data.

Database descriptions

1. Vaccination codes database

The vaccination codes database is a database jointly managed by the federated entities responsible for the organization of the vaccination and Sciensano.

The vaccination codes database stores, for every person to whom a vaccination code is assigned

the SSIN of the person;
the name and surname of the person;
the sex of the person:
the date of birth of the person;
address of the place of residence of the person, including postal code;
phone number 1, preferably a GSM number, of the person;
the last SMS that has been sent to phone number 1 and the date of sending;
phone number 2, preferably a GSM number of the person;
the last SMS that has been sent to phone number 2 and the date of sending;
the mail address of the person;
the last mail that has been sent to the mail address and the date of sending;
the first source that has selected the person to be invited, without revealing precise medical information about the person that is invited to be vaccinated (possible values are: GP, sickness fund, national register, Cobrha, other);
the vaccination code that has been assigned;
the date of activation of the vaccination code;
the type of vaccine that can be administered based on the vaccination code;
the period during which the first vaccine can be administered on the basis of the vaccination code;
the period during which any necessary second vaccine can be administered on the basis of the vaccination code;
the usage status of the vaccination code (possible values are: activated but not used for any reservation yet, used for reservation of all necessary vaccination moments, only used for reservation for first reservation moment but not for any necessary second vaccination, deactivated);
the date of first vaccination;
the name of any necessary second vaccine to be administered;
the vaccination status of the person that is invited to be vaccinated (possible values are: not vaccinated yet, first vaccine administered and second vaccine is still necessary, completely vaccinated).

2. Vaccinnet

Vaccinnet is a database managed by Vlaams Agentschap Zorg & Gezondheid.

It contains the following data fields. Vaccinnet can at least be queried as follows

all vaccines for a particular SSIN
all SSIN for a particular unique identification number of the vaccine
all SSIN for a particular lot number of a particular name of vaccine

3. VONS (Vigilance Online Notification System) at Federal Agency for Medicines and Health Products

VONS is a database managed by the Federal Agency for Medicines and Health products.

VONS only contains pseudonymized data. When entering data about undesirable effects of vaccines against COVID-19 in the VONS database, however, the SSIN of the person concerned is requested so that the relevant data about the vaccination can be retrieved from the COVID-19 TestResult database and does not have to be entered by the person that declares an undesirable effect in VONS. The SSIN is not stored within the VONS database.

4. COVID-19 LaboratoryTestResult database

COVID-19 LaboratoryTestResult database is a database managed by Sciensano.

It is already available and its contents is very precisely defined by a Cooperation agreement of August 25, 2020.

Actual legal bases

Interfederal level

Cooperation agreement of August 25, 2020

Flemish community

Decreet van 21 november 2003 betreffende het preventieve gezondheidsbeleid (artikel 43)

Besluit van de Vlaamse Regering van 16 mei 20144 houdende diverse bepalingen van het decreet van 21 november 2003 betreffende het preventieve gezondheidsbeleid en tot wijziging van uitvoeringsbesluiten van dit decreet (artikel 9)

Ministerieel besluit van 29 januari 2015 tot het bepalen van het vaccinatieschema voor Vlaanderen

Gebruikersvoorwaarden voor Vaccinnet

French community

Accord de coopération du 29 novembre 2018 entre la Communauté française, la Commission communautaire commune et la Communauté germanophone relatif à l’usage partagé de la plate-forme électronique sécurisée de commande de vaccins et de registre vaccinal

Federal administration

Sciensano: artikel 4 van de wet van 25 februari 2018 tot oprichting van Sciensano – article 4 de la loi du 25 février 2018 portant création de Sciensano

VONS: artikel 12sexies van de wet van 25 maart 1964 op de geneesmiddelen – article 12sexies de la loi du 25 mars 1964 sur les médicaments

Information Security Committee: wet van 5 september 2018 tot oprichting van het Informatieveiligheidscomité – loi du 5 septembre 2018 instituant le Comité de la sécurité de l’information

Additional legal framework required

A cooperation agreement and, pending the coorperation agreement, a federal law and a royal decree, adapted to the opinion of the Data Protection Authority, and a protocol agreement between the ministers of health defining

a registration duty
the main characteristics of data processing for the vaccination codes database as well as for Vaccinnet
- purposes of data processing
  - providing qualitative health care and treatments
  - pharmacovigilance and traceability of the vaccines against COVID-19, in accordance with current regulation
  - managing schedules for vaccination against COVID-19 for every individual, and organization of the vaccination against COVID-19
  - determining the vaccination coverage against COVID-19 of all healthcare users
  - organizing contact tracing
  - calculating the distribution of the costs of vaccination between Federal State and the federated entities
  - carrying out post-authorization monitoring and surveillance, after anonymization, or at least pseudonymization of data, in case that anonymization would not allow the post-authorization monitoring and surveillance to be carried out
  - scientific and statistical studies after anonymization, or at least pseudonymization of data, in case that anonymization would not allow the scientific or statistical study to be carried out
  - organizing the vaccination
- controller(s)
- types of data which are subject to the processing
- data subjects concerned
- storage period (in the vaccination codes database, the Vaccinnet database and COVID-19 TestResult database)
the ability for the Information Security Committee to authorize and to define the modalities of personal data exchanges for purposes arising from the legal assignments of the federated entities, Sciensano, the Federal Agency for Medicines and Health Products, the public institutions financing the vaccines and the sickness funds.

Authorisation by the Minister of the Interior to access the national register by Vaccinnet.

Authorisation by the Minister of the Interior to access the national register by the vaccination codes database.

Deliberation of the Information Security Committee in implementation of article 12, § 3 of the Cooperation agreement of August 25, 2020 in order to permit Sciensano to obtain non-pseudonymized personal data on vaccination from Vaccinnet for the purposes described in article 3 of the Cooperation agreement of August 25, 2020.

Deliberation of the Information Security Committee in implementation of the cooperation agreement to deliver contact data and selections of people to be vaccinated to the vaccination codes database: Dutch version – French version