In short: Vaccine fridge temperature monitoring in most UK practices and pharmacies still rests on one manual reading each working day, which leaves fridges unwatched from Friday evening to Monday morning. A data logger only closes that gap if its alarm reaches a person out of hours, so the sensor's network connection, its power during an outage and the escalation list matter as much as the probe.
Key Takeaways
- The daily reading leaves a 62-hour weekend gap — The Green Book's "read, record, reset, react" routine runs on working days, so a fridge that fails after the practice closes on Friday is first noticed on Monday morning.
- A logger nobody hears is a logbook — CQC warns that loggers checked weekly, or alarms that clear themselves when the temperature recovers, can let staff use vaccines that have already been out of range.
- The alarm needs its own network and power — A Wi-Fi logger behind a router on the same circuit as the fridge goes silent in exactly the power cut it should report, so the connection needs separate power and a path that does not depend on the clinical LAN.
In a nutshell
What does UK guidance require for vaccine fridge temperature monitoring?
UK vaccine fridge temperature monitoring rests on Chapter 3 of the Green Book, Immunisation against infectious disease, and the matching Public Health England protocol for ordering, storing and handling vaccines. Vaccines must be kept between +2°C and +8°C in a validated pharmaceutical fridge, never a domestic one. Someone must read the current, minimum and maximum temperatures at least once every working day, record them on a standard form, sign the entry, reset the min/max thermometer and act at once if the reading is out of range. The Green Book calls this the four Rs: read, record, reset, react.
The guidance also asks for a second thermometer, independent of the fridge's built-in display, both to cross-check accuracy and to keep recording if the power to the fridge is interrupted. It suggests a switchless socket, or at least a plug labelled "Do not unplug", because a cleaner unplugging the fridge to run a hoover is one of the commoner causes of a cold chain breach.
CQC inspects against this guidance. Its GP mythbuster 17 on vaccine storage, last updated in August 2024, tells practices that inspectors may ask for the fridge temperature log, the maintenance checks and the written policy for a temperature breach, and may open the fridge to look at how the stock is packed. Community pharmacies work to the same Green Book standard for the flu and COVID-19 vaccines they give, and hospital pharmacies apply similar rules across every ward medicines fridge.
Why does the daily reading miss so many failures?
The daily reading is a sample. It shows what the fridge did between two readings only through the min/max thermometer, and it shows nothing at all until somebody next opens the log.
Count the hours. A practice that closes at 6pm on Friday and opens at 8am on Monday leaves its fridges unwatched for 62 hours, every week of the year. Bank holidays stretch that. This year Christmas Day falls on a Friday and the Boxing Day substitute holiday on Monday 28 December, so a practice that closes on the evening of Thursday 24 December may not open the fridge log again until Tuesday morning, a gap of more than four and a half days. If the compressor fails on Christmas Eve, the max thermometer will record it faithfully, and the practice will find out on 29 December with a fridge full of stock that has to be quarantined.
The timing makes the problem worse in autumn. Between September and December a GP or pharmacy fridge holds flu vaccine, COVID-19 vaccine and, for eligible patients, RSV vaccine on top of the routine childhood schedule. The fridges are at their fullest when they are opened most often, and an over-packed fridge has poorer airflow and warmer spots near the door. The stock is valuable. When childhood vaccines were stolen from a County Durham practice in a weekend break-in, Pulse reported the stock was worth £10,000 to £15,000, and that was one practice's routine supply, before the autumn programme is added. In December 2020 a fridge failure at one GP surgery cost at least a day of COVID-19 vaccination appointments, as Metro reported at the time. Replacing the doses is only part of the cost; the practice also has to rebook the clinic and check the immunisation record of anyone who may have received compromised vaccine.
Doesn't a data logger solve the problem?
A data logger records the temperature every few minutes and keeps the history, which is exactly what a practice needs after a breach to show how long the fridge was out of range and by how much. Manufacturers' stability data often allow some vaccines to be used after a short excursion, but only if the practice can show the duration and peak temperature, and a logger trace is the evidence that supports that conversation with the vaccine manufacturer or the screening and immunisation team.
CQC is careful about what a logger does not do. The mythbuster says a practice using a logger must still read and record the fridge's own thermometer each working day, and it names two failure modes directly. A logger downloaded only weekly or monthly may reveal a breach weeks after the affected vaccines were given. And an alarm system may turn itself off once the temperature returns to range, without anyone investigating why it went off.
Both failures have the same cause. A logger is only as useful as the route between its readings and a person who can act. A standalone logger with a USB port has no route at all until somebody plugs it in, and a networked logger has a route only while its network is up.
Why do wireless fridge alarms go quiet?
Most wireless fridge monitoring products in the UK use one of four connections: Wi-Fi, a cellular modem with a SIM, a low-power radio such as LoRaWAN talking to a gateway on site, or a proprietary radio back to a base station plugged into the practice network. Each one has its own way of going quiet.
Wi-Fi loggers depend on the practice or trust network. In general practice, the network is usually run by the integrated care board's commissioned IT provider, and adding a third-party device to it means a change request, a firewall rule and a password that someone remembers to update. When the Wi-Fi password changes or an access point is replaced, the logger stops reporting, and the cloud dashboard may show a stale reading rather than an alarm. In hospitals, IoT devices on the clinical network compete for attention with the electronic patient record rollout, as we described in why NHS Wi-Fi fails at the bedside.
Power is the more serious weakness. A fridge alarm exists to report the moment the fridge loses power, and in a small practice the fridge, the router and the Wi-Fi access point are often on the same distribution board. When the building loses power, the logger's battery keeps it measuring, but it has nothing to send its alarm through.
Cellular loggers avoid both problems, provided there is signal. Treatment rooms and pharmacy stockrooms are often at the back of the building or below ground, and a pharmaceutical fridge is a steel box, so the radio module must sit outside the fridge with a probe cable through the door seal or a dedicated port. Older loggers also used 2G or 3G modules. The UK operators have now switched off 3G, and the government has said 2G will go no later than 2033, so any logger bought on a 3G module has already stopped reporting, and a 2G one has a fixed end date. Practices that bought loggers in the last decade should check which radio is inside them; the same issue affected telecare alarms, as we set out in the 2G and 3G switch-off in social care.
Who should the alarm reach at 2am on a Sunday?
The hardware is the easier half of the problem. The harder half is the escalation list: who is called, in what order, and what they are allowed to do when they answer.
A sound arrangement for a practice or pharmacy has three parts. Firstly, the alarm goes to people, by phone call or SMS, not only to a dashboard or an email inbox that nobody opens at the weekend. Secondly, it escalates: if the first named person does not acknowledge within, say, 20 minutes, it calls the second, and then the third, with an acknowledgement recorded against each step. Thirdly, the people on the list have a short written instruction: check the plug and the breaker, keep the door shut, move stock to a validated cool box or a second fridge if the excursion is continuing, and quarantine anything affected until the morning. That instruction is the "react" step in the Green Book, made workable outside office hours.
Alarm thresholds need the same thought. A fridge door left open during a busy flu clinic will push the air temperature over 8°C for a few minutes without warming the vaccine packs, so many systems use a buffered probe, in glycol or a similar fluid, and a delay before alarming. Set the delay too short and staff learn to ignore the alarm; set it too long and the weekend failure goes unreported for hours. The setting should be written into the cold chain policy, so that CQC and the practice's own staff can see the reasoning.
When does a private network make sense for fridge monitoring?
For a single GP surgery with two vaccine fridges, a private network would be excessive. A good cellular logger with an outdoor or window-mounted antenna, a battery and an escalation service will do the job. The useful checks are signal strength in the treatment room, the radio technology inside the logger, and a test alarm at a weekend before relying on it.
The calculation changes on a hospital estate. A large acute trust can run several hundred medicines fridges across wards, theatres, outpatients and pharmacy, alongside laboratory fridges, freezers and blood storage, many in basements and in buildings where mobile coverage is poor. Running each sensor over the clinical Wi-Fi brings the change control and power problems above at a much larger scale. Running each over a public cellular network brings hundreds of SIM contracts and the coverage gaps of older buildings.
A private 4G or 5G network on the estate gives every sensor a SIM-authenticated connection that is separate from the clinical LAN, so the estates or pharmacy team can add a fridge without a change request to the IT department. The radio units and core can sit on the trust's UPS and generator supply, which the fridges' own sockets often do not, so the alarm path keeps working when the fridge circuit fails. The same network can carry the other telemetry that estates teams want from a hospital, such as plant room monitoring, asset tracking and porter devices, so fridge monitoring is rarely the only reason to build one. The trade-off is that a private network is infrastructure the trust has to own, monitor and maintain, which is a heavier commitment than renewing a logger subscription.
Whichever route a practice, pharmacy or trust takes, the test is the same: pull the plug on a test fridge at 6pm on a Friday and time how long it takes for a named person to answer the phone. If you would like help designing a monitoring network for a hospital estate or a group of sites, contact us or read more about our work in health and social care.