Project Overview
An NHS Commissioning Support Unit managing childhood immunisation for 420,000 children under 16 needed to mode...
Technology Stack
Compliance & Standards
The Challenge
An NHS Commissioning Support Unit managing childhood immunisation for 420,000 children under 16 needed to modernise their child immunisation register — replacing a legacy CHIS (Child Health Information System) based on obsolete NHS infrastructure. NHS Immunisation Information System (NIIS — national replacement for regional CHIS), NHS PDS FHIR R4, NHS DTAC all 5 domains, DCB0129 (missed immunisation is a child health clinical safety risk), UK GDPR Article 9 (children's health data among most sensitive), ICO Children's Code (Age Appropriate Design Code — parent/child data), and WCAG 2.1 AA were mandatory. Budget: £90,000.
Our Approach
NHS NIIS Integration and Immunisation Records
NHS Immunisation Information System (NIIS): national immunisation record system replacing regional CHIS.
NIIS FHIR R4 API
Immunization resource (vaccine code, dose number, date administered, location, practitioner), Patient resource (NHS number via PDS), and Encounter resource (immunisation appointment).
UK Immunisation Schedule
- PHE/UKHSA immunisation schedule (8 weeks — 6-in-1, Men B, Rotavirus
- 12 weeks — 6-in-1 second dose
- 16 weeks — 6-in-1 third dose
- 1 year — MMR, Men B booster, Men C... through to 14 years — Td/IPV booster).
Platform
- age-appropriate immunisation status dashboard (what is due, what is overdue, what is complete) for each child on the register.
- Call-
Recall and Defaulter Management
- NHS childhood immunisation call-recall: invitation letter to parents when child due for immunisation.
- GOV.
UK Notify
automated invitation letters, SMS reminders (4 weeks after invitation if no appointment booked), and second reminder (8 weeks if still not booked).
Defaulter management
child who has missed an immunisation schedule point — automated alert to health visitor for follow-up.
Cohort management
annual birth cohort pulled from NHS PDS (all children born in the region) → immunisation schedule populated automatically.
Traveller and homeless families
enhanced follow-up workflow (health visitor personal contact).
Clinical safety hazard
child incorrectly recorded as up-to-date when immunisation is overdue — child not invited for missed vaccinations — preventable disease.
Mitigation
- 1NHS PDS synchronisation (weekly PDS pull — picks up moved children and new registrations),
- 2immunisation status calculated in real time from administered vaccine records (not a stored flag that can become stale),
- 3monthly data quality audit (random 200-record sample reviewed by clinical governance — administered vaccines reconciled against NIIS records).
NIIS data
- every vaccine administered at a GP practice or immunisation clinic submits to NIIS — platform reads NIIS as source of truth.
- ICO AADC and Children's
Health Data
ICO Age Appropriate Design Code (AADC): digital services likely to be accessed by children.
Parent portal
parents can view their child's immunisation record.
AADC compliance
- 1parent/guardian authentication via NHS Login (verified parental relationship),
- 2data minimisation — parent sees only their child's immunisation record (not siblings until all verified),
- 3health data is Article 9 special category — explicit consent basis for parent viewing own child's health record,
- 4child can access their own record from age 13 (Gillick competence — GDPR data subject rights).
Privacy notice
age-appropriate summary for parents and separate age-appropriate summary for young people 13+.
The Results
DTAC approved all 5 domains.
Platform live at 14 weeks, £84,000 — under budget. 420,000 children on register.
Immunisation coverage rate (2-year cohort fully vaccinated): 88.4% → 92.6% (4.2pp improvement — national target: 95%, improving trajectory).
Defaulter follow-up rate: 94% (health visitor contact for every defaulter within 4 weeks).
NHS NIIS synchronisation: daily (previously weekly).
Parent portal activation: 68% within 3 months.
DCB0129: zero clinical safety incidents related to platform.
WCAG 2.1 AA: zero non-compliances.
“Immunisation coverage from 88.4% to 92.6% — heading toward the 95% target. In childhood immunisation, every percentage point represents real children protected from preventable disease. Defaulter follow-up 94%. Parent portal 68% activation. DTAC first submission. DCB0129 zero incidents. The AADC compliance work for parent access — distinguishing parental rights from child data subject rights at age 13 — was the most nuanced data protection work we have encountered." — Director of Public Health, NHS CSU (name withheld)”
Project Details
Related Case Studies
View AllNHS-Connected Mental Health App — DTAC Approved
NHS-Connected Mental Health App — DTAC Approved. A UK mental health technology company needed to build a patient-facing digital therapy support app connected to NHS syst...
Workforce Management SaaS — UK Healthcare Staffing Agency
A UK healthcare staffing agency placing 2,800 NHS-registered nurses, doctors, and allied health professionals ...
NHS Outpatient Referral System — FHIR R4 Integrated
An NHS Foundation Trust needed to replace a 2007 paper-based outpatient referral system. GPs referred patients...
Ready to Transform Your Business?
Let's discuss how our technical expertise can help you achieve remarkable results.