This week, the first doses of the Pfizer COVID-19 vaccine were administered in the U.S.
With the FDA expected to approve Moderna’s vaccine imminently, people are already looking forward to a world where travel and gatherings are possible. But for those activities to be maximally safe, the country will either need to reach herd immunity—unlikely until mid-2021 at the earliest, assuming essentially flawless vaccine roll-out and widespread adoption—or to find ways to verify people’s negative tests or vaccination status in advance.
Some companies are looking to digital solutions. Airlines like JetBlue, United, and Virgin Atlantic have begun using CommonPass, an app developed by the Commons Project and the World Economic Forum that shows whether users have tested negative for COVID-19 for international travel. Ticketmaster, too, told Billboard that its “post-pandemic fan safety” plans include digital health passes that verify event-goers’ COVID-19 negative test results or vaccination status. While these digital health passes could become a prerequisite for some activities, widespread adoption of so-called immunity passports would require a level of coordination and organization uncharacteristic of the country’s response to COVID-19 so far.
The first major hurdle towards a culture that uses digital immunity passports: ensuring widespread availability of the vaccine. Requiring someone to show proof they’ve been vaccinated when the vaccine is not yet available to them is a recipe for injustice. It will take months for the vaccine to become available to the general public, and up until then, we’re likely to see more demand for the vaccine than supply. After that initial surge of vaccinations, we could see a second “phase” in vaccine rollout. “At a certain point I think things are going to flip,” says Carmel Shachar, executive director of the Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics at Harvard Law School. Focus will turn from vaccinating people clamoring for it toward those who may have reservations. “That’s when you’re going to see states perhaps mandating the vaccine, school systems mandating vaccines, or employers like hospitals.”
From a legal perspective, requiring vaccinations for things like school enrollment, employment, or international travel is well-established. Typically, a doctor’s office might print out or email vaccination records, but given their novelty, there’s not yet a system for COVID-19 vaccinations. The CDC plans to distribute a card to people with information about which vaccine they received and when they’re due for their second dose, but that’s meant to be more of a reminder than solid evidence of vaccination—and it’s easily forgeable. “It would not be hard for a teenager with Photoshop to recreate the card,” says Shachar.
Digitizing proof of vaccination could standardize this process, making it harder to spoof, but creates new issues. The most obvious hitch in this plan is that not everyone has a smartphone, so requiring digital evidence immediately disenfranchises 19 percent of Americans. For those who can download such apps, data privacy could become an issue. Release of medical data like vaccination status is usually covered by the Health Insurance Portability and Accountability Act, but that’s because those releasing the information are “covered entities”: Doctors and insurers must abide by these rules. But, says Shachar, “HIPAA doesn’t apply if nobody involved is part of the medical system; it’s not technically a medical record.” Say a third-party app receives your medical information and you give them permission to share it with your employer, or Ticketmaster—that info may no longer be protected by HIPAA. (Other countries may be in a better position to protect users’ privacy; the EU’s General Data Protection Regulation, for instance, covers data privacy writ large rather than just medical records, which could help European countries develop more robust protections for third-party use of vaccination info.) If sharing health data means foregoing privacy, that might make people think twice about using it.
That problem could be magnified by the number of apps or services used to check vaccination statuses. If contact tracing apps were any indication, we could see many different iterations of the same app as states, schools, employers, airlines, and other entities make individual decisions about what kind of technology to adopt. “What we don’t want is to end up with 75 million apps that accomplish the same thing,” says Thomas Crampton, chief marketing and communications officer at the Commons Project. The nonprofit hopes to leverage relationships with a network of institutions who could form more partnerships, to help make CommonPass a major player. “We don’t see rivals,” says Crampton.
But in addition to CommonPass, there’s the International Air Transport Association’s new travel pass, expedited airline security company CLEAR’s Health Pass, and IBM’s Digital Health Pass, as well as other enterprising companies that could stand to profit from luring institutions to using their technology. That creates the potential for a fragmented immunity passport app market. “You could end up with a situation where you have one app for when you travel internationally, another app for showing your employer, or another for getting on the bus or subway to go to work, says Shachar.
It’s not just the app market that might be fragmented, but also what local businesses and states decide to do. There has been a patchwork of COVID-19 policies across the U.S. regarding mask mandates, test eligibility, and adoption of contact tracing apps, and it’s possible that will be the case for digital health apps, too. “There may be some states reaching out to the tech world and partnering with them, while other states wait to see what early adopter states are doing,” says Shachar. Cities or towns may also see variable use of such technology depending on local attitudes. If you run a store in a city where strict mask and distancing have been the norm, it might be a boon to your business to require proof of vaccination as a way to show you’re taking precautions; you might entice more customers to shop if they know risk is low. But that calculus might be different in areas where residents have been resistant to COVID precautions or vaccinations; requiring proof of vaccination might mean you might lose out on those people’s business.
Assuming all these hurdles are cleared—vaccines are widely available, companies or organizations require proof of vaccination, and people are willing to download apps to show their vaccination status—there’s still the challenge of actually checking those statuses. In an interview with Billboard, Ticketmaster President Mark Yovich mentions checking event-goers’ COVID-19 test or vaccination status before an event and barring people who don’t comply. Similarly, Shachar mentioned the possibility of public transit requiring such checks. Who, then, would have the unenviable duty of verifying people’s statuses on their health apps? Shachar says she could imagine a third-party company developing a business model that stations COVID-19 bouncers at a store or event venue, provided attendees use their proprietary health pass app.
But for now, we’re many steps removed from that kind of streamlined process even becoming possible. In the meantime, if you’re an international traveler, or work in a profession where proof of vaccination is compulsory, you might have to cough up evidence of your COVID-19 testing status or vaccination, once that becomes available to you. But otherwise, it will likely be months before you’re expected to produce a digital health pass—if ever.