The many private companies in charge of vaccine passports

Your COVID vaccine data might be flowing to private companies without your knowledge.

Paper cards are the primary way people receive records of their COVID-19 vaccinations. However, some governments and businesses are looking for ways to digitize these records. That would let people display proof of their vaccination status on their smartphones, and have a record that’s less easily lost than a slip of paper. 

This is partially in service of the idea of “vaccine passports,” or digital records that would allow stadiums, airlines, restaurants, or other businesses to make sure people are vaccinated before entering. The idea is already being implemented in Israel with a state-run program called the “green pass,” that lets people gain entry to public spaces by scanning their smart phones. The same concept is also in place with some airlines, and is underway in the European Union. 

Stateside, things are diffuse. The Biden administration announced in early April that it would not create a federal vaccine passport. However, according to the Washington Post, it is working to release data and software standards for what the digital record should look like, presumably so there is some consistency between systems. That’s a work in progress, but it’s already racing against the clock; the Post reported that the administration found there are already 17 different vaccine passport systems in the work across the globe.

To complicate matters further, the issue has become a politicized flashpoint of “personal freedom”: Some politicians on the right, such as the governors of Texas and Florida, are banning or trying to create legislation against requirements for proof of vaccination.

From privacy concerns to digital literacy, the sheer variety of these programs could lead to questions on multiple fronts for citizens. One reason is that governments are relying on partnerships with private companies to produce these systems. At the same time, the world of COVID vaccines and records is rife with fraud, and concern about the security of your medical records are valid.

You also might be confused about just how these companies offering you vaccine passports got your data. Most likely, they have signed a contract with a healthcare provider (like a clinic or a government public health agency) that names them a “business associate.” Under the health data privacy and portability law HIPAA, it’s legal for providers to share patient data with business associates, as long as they adhere to HIPAA privacy guidelines. This is the policy that allowed the healthcare system Ascension to share its patient data with Google in 2019.

As states, counties, and cities all roll out different programs created by different companies people might not have ever heard of, how are we supposed to know what companies offering vaccine passport services are legit?

There are few vaccine passports and digital records programs in place in the U.S. right now. But we’re compiling a list of the companies different governments are working with, and will keep this updated as the world of vaccine passports widens. 

IBM (platform for New York)

New York is the only state that’s launched a vaccine digital records program at the state level. After completing an initial pilot program, New York made the “Excelsior Pass” available for New Yorkers on its website. It’s linked to state records, so the site says citizens can “retrieve” their Excelsior Pass after entering some identifying information. 

A little company called IBM is behind the program. While Excelsior Pass is its own New York ~ thing~, it’s built on IBM’s Digital Health Pass technology.

Healthvana, Carbon Health, Othena (platforms for California)

Gov. Gavin Newsom recently announced that the state of California state would not be creating a central vaccine passport system, so delivering digital records falls to counties and cities.

It’s a big challenge: The country’s most populous state also has seven of the most populous counties. Some of these counties have announced different vaccine passport-like programs, each working with different private companies. Los Angeles County alone (the country’s largest) has two companies managing digital vaccine records: one for the county, and one for Los Angeles city proper.

Los Angeles County: Healthvana has been working with digital medical records since 2016, including on ultra-sensitive HIV patient record keeping. It began delivering digital vaccine records to LA county residents in December 2020. It was the first county in the country to do so. Despite the fact that you can add the records to your Apple Wallet, the company and the county department of public health are adamant that these records are not a vaccine passport.

L.A. City: The city tapped healthcare startup Carbon Health to be the portal citizens use to book and manage vaccine appointments. It is also delivering digital records to patients. After a patient gets a vaccine, they’ll receive an email with information about how to access their digital records.

Orange County: Southern California’s conservative bastion is testing digital vaccine passports with a company called Othena, which is “powered by CuraPatient,” which is run by the blandly named Composite Apps — a digital consulting company that’s been around since 2010, and has a Rockefeller on its leadership team. Recently, Orange County walked back the program after residents complained it could infringe on their freedoms. They’re now saying the passports won’t be required for citizens, and that the program is more about digital vaccine records than passports. 

Vaccination Credential Initiative

Dozens of public entities, non-profit organizations, and private companies have joined together to create a set of standards for digital vaccine records. The project is still in development, and the founding members include the Mayo Clinic, MITRE Corporation, Microsoft, The Commons Project Foundation, Evernorth and the CARIN Alliance.

Change Healthcare

This health/tech startup has a digital vaccination records project that it is explicitly describing as a vaccine passport. It says patients can access vaccine passports in “2000 (possibility more soon) community, regional, and national pharmacies in 40+ states.” Change isn’t saying where this program is specifically, but it has clinics across the country. 

United Healthcare is attempting to acquire Change. However, the DOJ hasn’t signed off on the acquisition yet.

Illinois/Cook County/Chicago

Illinois has not announced its plans for digital vaccine records yet. However, the state does keep digital records of its own in a portal called ICARE. 

Mashable has reached out to the Cook County Department of Public Health to learn more about the role the ICARE portal might play in digital records. 

Florida, Texas, and Montana

The governors of Texas, Florida, and most recently Montana, have issued bans that prohibit businesses from requiring proof of vaccination. Given that stance, it’s unlikely these states will be taking on the challenge of state-issued vaccine passports, or partnering with private companies to do so.

Other global and private initiatives

Some companies, industries, and worldwide organizations are taking the availability of vaccine passports into their own hands. 

• The Commons Project and the World Economic Forum have created a vaccine status and COVID test results pass with an aim to create a worldwide standard. It’s called CommonPass and is already in use by airlines JetBlue, Lufthansa, Swiss International Airlines, United Airlines and Virgin Atlantic out of some airports.

• The International Air Transport Association created its own IATA Travel Pass. Singapore Airlines and Qatar Airways have launched pilot programs.

• Clear is a biometric data company that provides expedited security screening at airports, among other places. Clear’s Health Pass will store COVID test and vaccination records. Most recently, it announced a partnership with the NBA, that will allow stadiums to make sure fans are vaccinated and COVID-negative. So if you want to go to an NBA game, you’ll have to let this data company have your health records. Ticketmaster is reportedly also in talks with Clear to make COVID clearance a pre-requisite to event entry.

• Currently in use by New York, IBM’s Digital Health Pass is a platform that other organizations could theoretically build upon, too.

• Google and Amazon have reportedly had conversations with health officials about digital records, but nothing concrete has been announced.