Guidelines for handling COVID-19 records
Most COVID-19 records relate to staff immunisation programs and security for premises. These can be sentenced according to the General Retention and Disposal Authority for administrative records (GA28) or local government records (FA450). The Health sector may also use GDA17 and GDA21. In short, handle COVID-19 records as you would normally.
Identifying and retrieving COVID-19 records
It’s important to make sure that COVID-19 records can be easily identified and found in your agency’s records management system. We recommend adding a clear tag, like ‘COVID-19’ or something similar, to help identify these records. This will make it easier to retrieve and export them if needed in the future.
COVID-19 vaccination certificates
Public offices do not need to retain COVID-19 vaccination or exemption certificates in most cases. Certificates often need to be sighted for compliance with public health orders or internal requirements but should not be stored.
No.
Many public offices are required to sight proof of vaccination or exemption to comply with public health orders or internal business requirements. This applies to:
- members of the public entering buildings
- lawyers attending court buildings
- employees, contractors, or service providers entering workplaces
- organisations or individuals licensed or accredited by the public office.
Examples include:
- members of the public on jury lists
- family daycare operators approved by councils
- employees returning to work
- members of the public attending buildings.
In most cases, vaccination or exemption certificates only need to be sighted, not retained. If there is a need to verify the certificate later, it can be requested again. The primary record of vaccination is managed through the Commonwealth Medicare system.
Recommendations:
- Return certificates without copying them and create a record stating the certificate was sighted.
- Delete emails with attached certificates and record that the certificate was sighted.
Recording details:
The level of detail needed depends on the situation:
- Employees: You may need to create a register or update the employee record. This ensures workplace safety.
- Members of the public: For building access, you can:
- add a tick in the sign-in book
- include a note in procedures that staff sight certificates during the QR code check-in process.
- The Vaccine Passport, integrated with QR codes, will reduce the need for manual certificate checks.
If you must retain a copy of the certificate for verification or transmission purposes:
- Dispose of the copy as soon as business use ends.
- Clearly communicate to the individual submitting the certificate that it will be deleted, returned, or destroyed after sighting.
We recommend public offices have documented procedures for managing these documents, based on a risk assessment. Creating and capturing a record that a certificate has been sighted fulfils the requirements of the State Records Act and relevant retention and disposal authorities.
Retention periods depend on:
- The reason the certificate was required
- The minimum retention periods in the relevant disposal authorities issued by SARA.
If a risk analysis determines records need to be kept longer than the minimum periods, document this decision and retain records accordingly.
Common retention periods:
Employees and volunteers
- Retention: 7 years after employment ceases.
- Reference: GA28, 14.5.5
Family daycare providers and family members residing in the property
- Retention: 3 years after the last date the staff member provided education and care.
- Reference: Section 183, Education and Care Services National Regulations
Contractors entering workspaces
- Retention: 7 years after action is completed.
- Alternatively: Maintain as part of the contract record (7 years after contract expiry or termination).
- Reference: GA28, 14.5.4 and GA28, 4.0.1.
Members of the public entering public office property
- Retention depends on how presence in the building is recorded:
- if proof of ID is already required for sign-in, include the certificate sighting in the secure sign-in process.
- secure area sign-in books: Retain for 7 years. (GA28, 16.24.5)
- COVID-19 contact tracing records: Retain until administrative use ends (e.g., within 28 days).
- reference: GA28, 16.24.7.
For public offices providing vaccinations, retain records according to the Public Health Services Disposal Authority:
- Retention: 7 years after last attendance, official contact, or access by the client.
- If the client is under 18, retain until the client reaches (or would have reached) 25 years of age, whichever is longer.
- Reference: GDA17, 1.2.1
Summary
Public offices should:
- sight certificates when required, without retaining copies
- follow documented procedures based on risk assessments
- retain records only as long as required by retention and disposal authorities.
For further guidance, contact your records management team or refer to relevant disposal authorities.
Other common COVID-related records
Scenarios for handling COVID-19 records.
Your agency has changed its telecommunicating policy and other operational procedures due to new physical-distancing requirements arising from the COVID-19 pandemic.
General authority: administrative records (GA28) – Policies
19.15.1 Strategic management – Policy | Final, approved versions of the organisation's policies on cross-functional or organisation-wide matters, for example, equal employment opportunity policies, fraud control policies, internal circulars, code of conduct, and associated correspondence indicating who the policies apply to and responsibilities for their implementation. | Retain minimum of 7 years after policy is superseded, then destroy |
19.15.2 Strategic management – Policy | Records relating to the development and review of the organisation's policies on cross-functional or organisation-wide matters, for example, equal employment opportunity policies, fraud control policies, internal circulars, codes of conduct. Records include:
| Retain minimum of 3 years after action completed, then destroy |
General authority: administrative records (GA28) – Procedures
19.16.1 Strategic management – Procedures | Final, approved versions of manuals, handbooks and directives detailing the organisation's procedures on cross-functional or organisation-wide matters, for example, equal employment opportunity, fraud control, quality assurance, and associated correspondence indicating who the procedures apply to and responsibilities for their implementation. | Retain minimum of 5 years after procedures are superseded, then destroy |
19.16.2 Strategic management – Procedures | Records relating to the development and review of the organisation's manuals, handbooks, directives and detailing the organisation's procedures on cross-functional or organisation-wide matters, for example, equal employment opportunity, fraud control, quality assurance. Records include:
| Retain minimum of 3 years after action completed, then destroy |
Your agency's management send out regular updates to staff and/ or to the public on how policies and projects are affected by COVID-19 pandemic.
General retention and disposal authority: administrative records (GA28)– Advice to staff
15.1.1 Personnel – Advice | Records relating to the provision of advice and assistance to employees about employment conditions, career, personal matters, trauma, finances, salaries and superannuation. Includes orientation advice for new employees and rehabilitation or return to work assistance not related to a compensation case. Records include notes and reports. | Retain minimum of 7 years after action completed, then destroy |
Advice to general public: GA28
2.15.1 Community relations – Media relations | Final, approved versions of media releases issued by the organisation. | Required as State archives |
2.15.2 Community relations – Media relations | Records relating to administrative arrangements concerning the organisation's dealings with the media including the distribution of media releases, organisation of interviews and general media access. | Retain minimum of 2 years after action completed, then destroy |
2.15.3 Community relations – Media relations | Copies of media items relating to the organisation's operations or events and functions hosted by or involving the organisation. Records include news and electronic media items, transcripts or recordings. | Retain until administrative or reference use ceases, then destroy |
Your team is conducting a daily or weekly video chat to check in with each other about issues arising from the COVID-19 pandemic.
General authority: administrative records (GA28) team meetings
19.13.1 Strategic management – Meetings | Records relating to routine general and section or unit meetings of employees and administrative arrangements for meetings. Records include:
| Retain until administrative or reference use ceases, then destroy |
Your council is informing the public via social media or website re: park, library, beach or public area closures and/or safety tips, availability of support and assistance, hotlines during the COVID-19 pandemic.
General retention and disposal authority Local Government records (FA450) – Legal enforcement of closures
5.6 Laws and enforcement – Campaigns | Records relating to campaigns to raise awareness of laws and regulatory requirements and/or improve compliance. Records include:
| Retain minimum of 5 years after action completed, then destroy |
General authority: administrative records (GA28)– Media advice to general public
2.15.1 Community relations – Media Relations | Final, approved versions of media releases issued by the organisation | Required as State archives |
2.15.2 Community relations – Media Relations | Records relating to administrative arrangements concerning the organisation's dealings with the media including the distribution of media releases, organisation of interviews and general media access. | Retain minimum of 2 years after action completed, then destroy |
2.15.3 Community relations – Media Relations | Copies of media items relating to the organisation's operations or events, functions etc hosted by or involving the organisation. Records include news and electronic media items, transcripts or recordings. | Retain until administrative or reference use ceases, then destroy |
2.1.1 Community relations – Media Liaison | Records relating to the acquisition of services to support the conduct of community, public relations, marketing or public profile-raising activities, for example, news-cuttings services, where there is no tendering or contracting-out process, i.e. where the cost of the acquisition is below the threshold for tendering. Records include:
| Retain minimum of 7 years after action completed, then destroy |
Your agency is conducting external meetings virtually or via teleconference in response to COVID-19 pandemic. You need to create and keep records of these meetings.
Please check our guidance: Recordings of virtual meetings.
The records relating to meetings are covered by:
General authority: administrative records (GA28) – Inter-agency meetings
1.0.3 Committees | Inter-agency/external Records relating to inter-agency or external committees where (1) the organisation provides the secretariat and (2) the committee was established for the purposes of strategic planning or policy development and considers issues impacting on the core functions or responsibilities of the organisation. Records include:
Note: In the case of committees established to support collaboration or integrated service delivery, organisations should consider entries 1.0.3 and 1.0.4 carefully to decide which entry is the most appropriate given the terms of reference of the committee and its purpose and significance or influence of its decision making. | Required as State archives |
1.0.4 Committees | Inter-agency/external Records relating to inter-agency or external committees where (1) the organisation does not provide the secretariat or (2) where the organisation provides the secretariat but the Committee considers operational matters or matters relating to administrative or non-core functions of the organisation. Records include:
Note: In the case of committees established to support collaboration or integrated service delivery, organisations should consider entries 1.0.3 and 1.0.4 carefully to decide which entry is the most appropriate given the terms of reference of the committee and its purpose. Note: There may be some records relating to inter-agency or external committees dealing with operational matters that warrant retention as State archives, particularly where the records of the committee document decision making with respect to the organisation's core functions or responsibilities or consideration of matters attracting significant public interest. This should be assessed as part of the development of an organisation's functional retention and disposal authority and where warranted the records of the relevant committee/s should be included in the organisation's own functional retention and disposal authority. | Retain minimum of 5 years after action completed, then destroy |
Your agency is planning a new program or service in response to the COVID-19 pandemic.
General authority: administrative records (GA28) – Customer service
2.6.1 Community relations – Customer service | Final, approved versions of charters, standards or guarantees relating to the provision of services to clients. | Retain minimum of 2 years after superseded, then destroy |
2.6.2 Community relations – Customer service | Records relating to the development and review of charters, standards or guarantees relating to the provision of services to clients. Records include:
| Retain until administrative or reference use ceases, then destroy |
2.6.3 Community relations – Customer service | Records relating to the administration of specialised customer services, for example, help desks, websites, interpreters, services for disabled customers and outreach services. | Retain minimum of 2 years after action completed, then destroy |
Your agency's staff are applying for sick leave or other emergency leave in response to personal issues arising from the Covid-19 pandemic.
General authority: administrative records (GA28) – Personnel - Leave, attendance and absences
15.7.1 Personnel – Leave, attendance and absences | Summary details of leave taken by employees. Includes name, type of leave, dates taken, and approval. | Retain minimum of 75 years after date of birth of employee or minimum of 7 years after employment ceases, whichever is longer, then destroy |
15.7.2 Personnel – Leave, attendance and absences | Records documenting approvals for leave without pay in excess of 6 months, extended (long service) leave and study leave. Includes briefing notes and other supporting documentation. | Retain minimum of 7 years after employment ceases, then destroy |
15.7.3 Personnel – Leave, attendance and absences | Records documenting applications for leave. Records include leave requests and applications, and associated supporting documentation. Note: Where an appropriate summary record of leave taken by an employee is not available, approved applications will need to be retained for a minimum period of 75 years after date of birth or 7 years after employment ceases, whichever is longer. | Retain minimum of 7 years after action completed, then destroy |
15.7.4 Personnel – Leave, attendance and absences | Attendance records for employees, including flexitime sheets, time sheets and attendance sheets. Note: Licensees of children's services should meet the minimum retention requirements for these records outlined in National or NSW laws and regulations applying to early childhood education and care providers. | Retain minimum of 7 years after action completed, then destroy |
15.7.5 Personnel – Leave, attendance and absences | Records documenting the management of rosters where these are not required or used to record attendance, for example, where the signed attendance or time sheet is the accountable record of hours worked. | Retain minimum of 6 months after action completed, then destroy |
Your organisation is monitoring compliance with Public Health Orders. This includes reporting confirmed or suspected employee cases or COVID-19 and confirming vaccination status and travel permits.
This will include the following records:
- Employees demonstrating and/or providing proof of vaccination, test results, or travel permits
- Sighting an employee's vaccination certificate and creating a record to register certification, or annotating the employee's record. Vaccination certificates should be returned to the employee or deleted after sighting the copy of the certificate.
In this scenario, risk assess the following options to decide which is the most appropriate for the situation:
General authority: administrative records (GA28) – Occupation Health and Safety – Health promotion
14.5.4 Occupational health and safety – Health Promotion | Records relating to the management and administration of programs to promote a healthy working environment, such as routine immunisation and health monitoring programs. | Retain minimum of 7 years after action completed, then destroy |
14.5.5 Occupational health and safety – Health Promotion | Health promotion records relating to an individual employee, including:
| Retain minimum of 7 years after employment ceases, then destroy |