New York launches nation's first 'vaccine passports.' Others are working on similar ideas, but many details must be worked out.
Starting Friday, New Yorkers will be able to pull up a code on their cellphone or a printout to prove they've been vaccinated against COVID-19 or recently tested negative for the virus that causes it.
The first-in-the-nation certification, called the Excelsior Pass, will be useful first at large-scale venues like Madison Square Garden. But next week, the pass will be accepted at dozens of event, arts and entertainment venues statewide. It already lets people increase the size of a wedding party, or other catered event.
The app, championed by Gov. Andrew Cuomo to support the recovery of industries most affected by the pandemic, is funded by the state and available free to businesses and anyone with vaccination records or test results in New York.
As they would with an airline boarding pass, people will be able to prove their health status with a digital QR code – or "quick response" machine-readable label. They'll need to download the Excelsior Pass app, enter their name, date of birth, and ZIP code, and answer a series of personal questions to confirm their identity. The data will come from the state's vaccine registry and will be linked to testing data from a number of pre-approved testing companies.
The New York system, built on IBM's digital health pass platform, is provided via blockchain technology, so neither IBM nor any business will have access to private medical information. An entertainment venue will simply scan the QR codeand get a green check mark or a red X.
The pass is part of a growing but disjointed effort to provide vaccine "passports" or certifications so people won't have to hang on to a dog-eared piece of paper, worry about privacy or forgeries, or fork over extra cash to prove they're not contagious.
In addition to IBM, open-source computer experts, who provide code anyone can use free, have been developing such systems, as have retailers like Walmart, which is also offering digital proof of vaccination to anyone who gets a shot in one of its pharmacies.
The biggest challenge will be linking these systems together so people won't need different apps for every venue or use.
Open-source computer advocates already have been collaborating to "figure out how to piece together the different pieces of the puzzle," said Brian Behlendorf, executive director of Linux Foundation of Public Health, an industry-driven consortium that builds open-source software.
"It's really the nerds getting together in kind of a nerd U.N. to piece this all together," he said.
New York hasn't worked out those connectivity details yet, but it hopes to eventually, as well as linking tickets to the Excelsior Pass, so people going to an event at Madison Square Garden, for example, will be able to link their admission and health passes rather than fumbling with multiple apps.
Another hurdle will be finding a consistent set of standards, so what counts as an acceptable test or vaccine in one state or country will count in another.
At least two competing sets of standards are being developed globally to allow secure access to information about vaccination status, particularly for international travel.
At the moment, New York is using its own, established by its state health department, but it's not clear what will happen if or when Connecticut, New Jersey and other states establish their own certification systems.
Amy Fairchild, dean of Ohio State University and a historian and ethicist, said the biggest challenges with such certifications will be cultural, not technological.
"IBM or Abbott or somebody can develop an app, but the question is, what's it going to be? Is it realistic to see it being used?" she asked.
The use for international travel is obvious. Countries, including the U.S. will want to deny entry to people who can't prove they're not contagious with the virus that causes COVID-19.
But whether American consumers and businesses will accept the idea of providing proof before entry is not so obvious, she said. Just as many Americans have resisted wearing masks during the pandemic, some will reject the idea of showing a certificate to get into a ballgame or nightclub.
Requiring vaccination "is not something we have done before within this country outside of school systems and hospitals," said Fairchild, adding it would be incredibly useful from a public health standpoint and could eventually be expanded to cover flu and measles shots – if public opinion would allow it.
"To the extent that it could be used to help build up our public health infrastructure, that would be fabulous," she said.
But such efforts have typically fallen apart because of cultural resistance to the idea of being required to do things. "We are ideologically as a culture pretty resistant to the idea of mandates, unless it's kids."
That's part of why developers are using blockchain technology to protect privacy.
And why – although the Biden administration says it wants to leave vaccine passports to the private and nonprofit sectors – the White House has said that any certification process must be free, equitable, safe and private.
Preventing forgeries is key, too.
Already, scammers are selling fake CDC vaccination identification cards on sites like Craigslist, eBay, and OfferUp, Chad Anderson, a senior security researcher for Domaintools, a group tracking cyber threats told WMAQ, the NBC station in Chicago. Some of the cards are being sold for up to $200.
Other approaches for vaccine certification might include putting a notice on driver's licenses, as many states do for those who have opted to be organ donors.
“That’s about the only piece of authentic ID that we’ve got that’s used relatively universal,” said Cimarron Buser, president and CEO of the Appointment Scheduling & Booking Industry Association.
The state immunization registries would have to send the information to state DMVs and get new driver licenses issued, which wouldn’t be simple but would at least not require a separate ID card, he said.
Lots of businesses will be competing to create their own certification systems.
“All these companies are foaming at the mouth to be the business that builds the system,” Buser said.
Vaccine passport standards?
The standardization question may be stickier to resolve. Everyone agrees there should be common standards among apps, but whose standards? Without federal involvement that will be challenging to resolve, Fairchild said.
One standard for vaccine passports will be issued next month, said Dr. Brian Anderson, chief digital health physician at the MITRE Corporation, a nonprofit health infrastructure company that helped found the group.
Members of the Vaccine Credential Initiative has been working together since September. It includes household names like Microsoft, the Mayo Clinic, Oracle, Walmart, CVS and Salesforce as well as less well-known nonprofits working to ensure people’s health information is freely and safely accessible.
Once the standards are set, companies and nonprofits can use them to build systems that let someone prove they’ve been vaccinated. They’d be something like the digital boarding passes airlines increasingly issue instead of paper tickets.
For full security, people might also have to show aphoto ID, though not every place would demand such two-factor authentication.
A restaurant might simply ask patrons to scan their code and not demand “security-grade identity management,” Anderson said.
There would also be a way for people to print out, or have printed out, the QR code so the confirmation is accessible to everyone, not just those who have smartphones.
“Vaccinations are a human right, and these sorts of credentials should be seen as equally important,” Anderson said.
The goal is to create a set of guidelines that a company or nonprofit could use to create a digital vaccine passport, whether it’s Kaiser or BlueCross or Walgreens ora local health department.
“We all want something that's trustworthy, dependable and interoperable and easy to use,” said Anderson.
Excelsior Pass expected to evolve
IBM also plans eventually to use the same kind of technological platform to provide other health data, said Eric Piscini, vice president of emerging business networks for IBM, which has been working on the idea for years.
The goal would be "to empower every individual on the planet to be able to collect information on their phone (and) expose that information to the right parties with consent," Piscini said. The data would remain with the health care provider, not with IBM or its partners.
A system like that would allow data to "pivot around the patient not the health care provider or insurance company," said Behlendorf, who has also been working on such technology.
The first large-scale test of this kind of system is launching now in New York.
Beta testing at a few venues including a recent Buffalo Bills game showed the pass system worked effectively and was usable by people of different backgrounds. For those without a smartphone, there is a printing option to provide a QR code on paper.
The state is paying $2.5 million for the system, which will be provided free to businesses and individuals.
Businesses will not be required to use the pass, but may be allowed to fill more seats or admit more patrons if they do.
People will be able to store multiple Excelsior passes on a single cellphone, so a parent could hold a child's, for instance.
It will not require constant connectivity to the Internet or cellular phone system.
Someone who gets a state-approved coronavirus test at one of the participating labs will have their results expedited through the Excelsior Pass system. Results will be valid for 72 hours for a PCR test and six hours for an antigen test. The QR code will no longer scan when the time has elapsed.
The state will continue to improve the Excelsior Pass system over time, several state officials involved in the effort said, but wanted to get something out quickly to simultaneously support the economy and public health.
“The innovative Excelsior Pass is another tool in our new toolbox to fight the virus while allowing more sectors of the economy to reopen safely and keeping personal information secure,” Cuomo said in a prepared statement. “The question of ‘public health or the economy’ has always been a false choice – the answer must be both.”
Contact Karen Weintraub at firstname.lastname@example.org, and Elizabeth Weise can be reached at email@example.com
Health and patient safety coverage at USA TODAY is made possible in part by a grant from the Masimo Foundation for Ethics, Innovation and Competition in Healthcare. The Masimo Foundation does not provide editorial input.