The MHRA’s Hidden Cohort

The MHRA has the data on vaccine harm but have still not released it

Dr Clare Craig

One in seven. That is the proportion of people in the MHRA’s own actively recruited surveillance cohort who reported a medically serious adverse reaction following covid vaccination. Over half reported at least one reaction of any kind. The data was collected between 2020 and 2022. It was not published until September 2025, and only then because Cheryl Grainger, through an FOI request and subsequent ICO appeal, forced it out.

The paper that eventually appeared, in the journal Drug Safety, was not written as a safety paper. It was written as a description of the digital platform used to collect the data — a methods paper published five months after Dame June Raine left as Chief Executive, nearly three years after the data was locked. The actual adverse reaction rates are reported but not analysed. The one stratification that could determine whether those rates are real was not performed.

The numbers buried inside it deserved rather more attention.

What the data shows

The YCVM was the MHRA’s premium data source. It was one of four pillars of their covid vaccine safety surveillance strategy. Unlike the passive Yellow Card scheme, where people report voluntarily and sporadically, the YCVM actively recruited individuals and followed them up at set intervals. The MHRA themselves described it as a tool to “rapidly detect, confirm, characterise and quantify new risks.”

Of the 30,281 individuals who reported receiving a vaccination, 15,764 (52.1%) reported at least one adverse reaction. 4,134 (13.7%) reported a reaction classified as medically serious under the MedDRA system. This is a regulatory classification that includes events deemed medically significant by an internal MHRA panel and is broader than the lay meaning of “serious,” but not a trivial threshold. It encompasses hospitalisation, disability, life-threatening outcomes, death, but also other events judged clinically important.

However, the 13.7% might include people who volunteered for the monitor because they had been injured. The MHRA did not exclude people signing up after they had their vaccine.

The key question is how representative this cohort was. Any voluntary cohort, even an actively recruited one, may over-represent people who experienced problems. Other active surveillance systems internationally have reported lower rates, though none has been free of similar methodological limitations. The true rate is unknown – which is precisely the problem.

The YCVM was meant to be designed to quantify risk in a way passive surveillance could not because of reporting bias. However, the key simple analysis to enable interpretation was not done. The question is not whether 13.7% is the true rate of serious harm. The question is why the MHRA did not do the work to find out what the true rate is.

The cohort they did not analyse

The paper reports 35.6% registered before vaccination and 47.5% after. A further group registered on the same day, but the paper does not quantify it. Even allowing for this, the categories as presented account for only 83.1% of the cohort, leaving 16.9%, over 5,000 people, unclassified. The paper does not explain the gap.

The pre-vaccination and same-day registrants are the key group. They signed up before or at the point of vaccination, not in response to a bad reaction. Their data is substantially less vulnerable to post-event selection bias which is the main challenge to the headline figures. The criticism that people with bad reactions were more motivated to register does not apply to them. They were already in the system.

The obvious analytical step is to separate these registrants and compare their ADR rates to those who registered afterwards. If the prospective cohort shows substantially lower rates, the selection bias interpretation is supported and you would want to say so. If the rates are similar, the overall figures are validated and you would want to say that too. If the rates are lower then that is the rate that is of interest and should be published. In any case the comparison is critical and should have been presented.

The MHRA did not present the comparison. In a 21-page paper with 13 tables, this stratification – the single most important analysis for interpreting the headline findings – does not appear. I have submitted an FOI request for this data.

The dropout problem

27,403 people reported a first dose. Only 12,508, under half, went on to report a second dose. Yet UK vaccine uptake data shows over 95% of those who had a first dose went on to have a second. These people did not stop getting vaccinated. They stopped reporting.

The paper does not characterise the dropouts. The MHRA holds dose 1 injury data for both groups: those who continued reporting and those who did not. Comparing them would tell us whether the people who disengaged were the unbothered healthy or the worst affected. This analysis does not appear. The FOI request asks for it.

Among those still reporting at doses 2 and 3, the per-dose rates were strikingly consistent: around 21% reported any reaction and around 4.2% reported a medically serious event at each dose. These are not independent samples – it is the same retained cohort – so the stability could reflect consistent reporting behaviour rather than a consistent biological signal. But without dropout analysis, neither interpretation can be confirmed or excluded. The consistency is informative; it is not conclusive.

Reporting rates dropped substantially at doses 4 and 5, to 8.6% and 3.3% respectively. However, these doses were restricted to older and immunocompromised individuals who typically mount weaker immune responses, and the cohorts were small. The comparison is not straightforward.

There is a further point. Nationally, around 2% of people who received a first dose did not complete their primary course. There are many possible reasons: access, scheduling, prior infection, policy changes. But if the true serious adverse reaction rate after dose 1 is even a fraction of what active surveillance systems have reported, the non-completers would include a significant number of the seriously injured. The numbers are consistent with a world in which adverse reactions are driving a measurable fraction of non-completion. The MHRA holds the data to test this directly. It has not done so.

Pregnancy and menstruation

The paper claims the data “raised no safety concerns in pregnant and breastfeeding females.” The median follow-up for pregnant women was 72.5 days. A pregnancy lasts at least 280. Nineteen spontaneous abortions were reported, but most women in the cohort were vaccinated in their second or third trimester – past the period of highest miscarriage risk – and the follow-up was in any case too short to capture most pregnancy outcomes. The YCVM held NHS numbers for every participant, meaning linkage to maternity outcome datasets was straightforward. By 2025, the MHRA had had years to link this cohort to birth outcome data. It chose not to. Their claim of “No safety concerns” is in fact an absence of data presented as a finding.

On menstrual disorders, the paper attributes the reporting pattern to media stimulation. But the YCVM was built to overcome the limitations of passive reporting, where media coverage is a known driver. If the active system replicated the same pattern, the system failed at its stated purpose. And the interpretation ignores a simpler possibility: that women who had noticed menstrual changes were prompted by media coverage to complete the form they had already been asked to fill in. The parallel with death certification is instructive. Coroners did not record vaccine-related deaths until regulators acknowledged the possibility. Acknowledgement is not causation, but it is a precondition for reporting. A woman may very well not have made the connection and not felt that her problems were the type of problems that ought to be reported until seeing the media reporting.

The institutional story

The data was locked in December 2022. In April 2023, Cheryl Grainger filed an FOI request for the YCVM pregnancy data. The MHRA refused under s22 of the Freedom of Information Act, on the basis that they intended to publish but gave no publication date. This triggered the full appeals process. The preprint appeared on medRxiv in November 2024, days before the ICO appeal hearing. The peer-reviewed paper was then published in September 2025, five months after Raine departed.

The paper that eventually emerged describes a digital platform. It presents the technology, the recruitment process, the data architecture, and plans for future development. It does not contain a single analysis designed to test whether the adverse reaction rates it reports are real. The prospective cohort is unexamined. The dropouts are uncharacterised. The pregnant women were not followed to delivery. The menstrual disorder signal was attributed to media influence without testing the alternative. Two of the five subsections in the discussion are about technology. Only one is about the adverse reactions.

The MHRA spent public money building a bespoke active surveillance system, recruited 30,000 people into it, collected their data for two years, sat on it for a further three, and when finally compelled to publish, wrote a paper about the app.