Quietly and over some objections, a national digital vaccine card has emerged

[Stone]

Quietly and over some objections, a national digital vaccine card has emerged
The SMART Health Card is voluntary and minimal by design to protect personal information. About 80 percent of vaccinated people in the U.S. most likely have access to it.


University of Southern California students, faculty and visitors use their phones to display their "Trojan Check" QR code

 to enter the campus in Los Angeles on Aug. 23.Al Seib / Los Angeles Times via Getty Images

NBC | Jan. 13, 2022

Whether they realize it or not, about 200 million people in the United States now likely have access to a Covid-19 digital vaccine card.

The digital pass known as the SMART Health Card is voluntary and minimal by design to protect personal information. It has a person’s name, date of birth and the dates and brands of vaccination doses, all contained within a type of scannable bar code known as a QR code.

And after a relatively quiet start, it has built momentum in recent months as more states and companies have signed on, making it something of a de facto national digital vaccine card.

“The beautiful thing about this is that this multistate coalition is a coalition of the willing,” said Dr. Brian Anderson, chief digital health physician at MITRE, a research nonprofit, and an architect of the health cards.

Video: June 2021: Should people have to prove they got their shots with vaccine passports?

Any such card seemed like a remote possibility a year ago, when people first began receiving paper cards as proof of their Covid vaccinations. The Biden administration said in March that it would not take the lead on any national health pass and instead defer to the private sector, and the idea of a vaccine “passport” has faced opposition and even bans, especially in Republican-led states such as Alabama and Texas.

Rather than a single app, the SMART Health Card is open-source computer code that anyone can use to ping a verified source of health data and produce the unique QR code. The digital cards are now widely available from more than 400 sources including states, pharmacies and health care organizations.

The fact that the system exists in any form is a triumph for a loose coalition of technologists, nonprofit groups and mostly Democratic states that championed the development of a digital vaccine card even before the first coronavirus shots were administered.

“This is a de facto standard,” said Rick Klau, California’s chief technology innovation officer. “This is essentially the one common way for residents to secure that digital copy and then use it.”

The digital card offers a few benefits beyond a paper card. QR codes can't be forged in the way a paper card could be, because a restaurant or a music venue can use a scanner app to verify that it's legitimate. People can also download the QR code again if they lose it, adding a convenience factor.

People can get the QR code from their state health authority if they've been vaccinated in one of the 13 states now participating, but they may also be able to get them from a hospital or from a national pharmacy chain, such as Albertsons, CVS, Rite Aid, Walgreens or stores like Walmart if they've been vaccinated at any of their locations.

Vaccine QR codes are also spreading internationally. Japan launched a similar system last month, and Ontario, Canada, is requiring people to have scannable proof of vaccination to eat inside restaurants or go inside certain other businesses. QR codes are increasingly required as part of international airline travel.

Within the U.S., the QR codes are still voluntary. California and Louisiana became the first states to roll out the SMART Health Card last June, and the number of issuers grew slowly at first before picking up pace over time.

Colorado signed on in November, followed by Connecticut and Illinois in December. On Monday, Massachusetts became the 13th state to voluntarily embrace the system, and another 10 or so states are privately exploring the possibility, Anderson said.

Washington has issued about 840,000 QR codes, according to the state’s health department. That’s equivalent to about 11 percent of the state’s population. The numbers in Colorado and New Jersey are similar.

The QR codes work on paper, too, if people would rather print them out than keep them on a phone.

Klau, a former manager at Google, has advised other states as they put the system in place. In California alone, 7 million individuals have downloaded their QR code, and he estimated that about 80 percent of the vaccinated U.S. population of 247 million people have access to a SMART Health Card if they want one through either their state health authority or the site where they were vaccinated, such as a pharmacy or a hospital.

“It’s inspiring to see what has largely been a grassroots effort not only take hold, but develop so completely,” he said. “It has certainly not been mandated.”

A critical feature is that the QR codes are standardized and interoperable, so they work across state lines. A resident of New Jersey visiting San Francisco can use the same system to prove vaccination as a Californian.

And they can work internationally. Countries including the United Kingdom, Israel and Singapore have said they’ll recognize the QR codes if Americans present them abroad, Klau said.

It’s not clear if the Biden administration will ever endorse the project. The U.S. Department of Health and Human Services and the Centers for Disease Control and Prevention did not respond to requests for comment.

“It has forced many states to take leadership roles in implementing and coordinating around multistate coalitions,” said Anderson, who is also co-lead of the Vaccine Credential Initiative, or VCI.

Anderson said other countries haven’t always known whom to speak with in the U.S. to plan cross-border systems. “They’re turning to the states, they’re turning to VCI, and it’s a challenge for a state to conduct foreign diplomacy,” he said.

One barrier to creating a truly national digital vaccine card is that there’s no federal database of vaccination records. Each state maintains its own registry of vaccination records, so either the states or the health care providers need to be the ones to issue verified copies or credentials.

Some of the most thorny political questions remain up in the air nationally, including: Should a business have the right to turn away someone without a vaccine QR code? Or in a pandemic, should a city or state even require businesses to turn people away, as in Canada? What about people who, for health reasons, can't get a vaccine?

“We won’t be safe until venues are able to *require* SMART Health QR codes and stop accepting paper cards, or photos of cards. And that won’t happen until state or local governments mandate that,” said Jamie Zawinski, a software developer who also owns a night club, DNA Lounge, in San Francisco. He requires customers to have the QR code or, for now, their paper CDC card.

DNA Lounge not only requires people to display the QR code, but it also scans the code using a smartphone app to verify that the codes are authentic — making the club one of the few businesses anywhere in the U.S. to take that extra step.

The primary scanning app available, the SMART Health Card Verifier App, has been used about 750,000 times this month, and the trend line indicates usage is doubling month over month, Anderson said. He said he doesn’t know where the scanning is happening, because by design neither the health card’s creators nor the states have the ability to collect that data.

Only a few places in the U.S. require proof of vaccination to enter indoor businesses, and that list is growing slowly. A mandate in Boston is scheduled to take effect Saturday, even as Massachusetts Gov. Charlie Baker, a Republican, has pushed to keep the state system voluntary.

“The Administration is not requiring residents to show proof of vaccination to enter any venue, but this tool will help residents who would like to access and produce a digital copy of their record,” his office said in a statement.

The idea that airlines or even local businesses could attempt to collect data from digital health cards remains a chief concern for the Electronic Frontier Foundation, a nonprofit group in San Francisco that advocates for privacy online and that criticized the health cards last June soon after California adopted them.

“The scanning of your health information at the door of any business still worries me because generally we do not have a federal data privacy law,” said Alexis Hancock, EFF’s director of engineering. She pointed to software, unrelated to vaccines, that venues can use to scan driver’s licenses.

That danger could be lessened, she said, if Congress or state legislators pass new consumer protections. A bill pending in the New York state Legislature would create new safeguards for medical immunity information.

But Hancock also said the SMART Health Cards have alleviated at least some of EFF's concerns about digital vaccine records by making the computer code behind the cards open-source, which allows others to inspect it, and nonproprietary.

"Obviously, a lot has happened since last year," she said.