"What we realized with COVID is that all of a sudden there was this whole new reason that people would need to get access to their health information," Paul Meyer, co-founder and chief executive of The Common's Project, told Cheddar. "We also realized it was a global problem that in our view should be operated by a neutral entity that's not working on behalf of a single government or for some private company that's trying to maximize a financial return."
The Common's Project currently offers two apps: CommonHealth, which allows users to collect and store their private health data in a single location, and CommonPass, which allows them to present that data, such as their COVID-19 status, in cases such as returning to work or traveling.
The nonprofit is also a coalition member of the Vaccine Credential Initiative (VCI), which includes companies such as Microsoft and the Mayo Clinic.
In May, VCI plans to release open-source standards for digitally verifying vaccination status. The goal of these standards is to provide access to health data in a way that preserves privacy and works across different applications.
“The goal of the Vaccination Credential Initiative is to empower individuals with digital access to their vaccination records so they can use tools like CommonPass to safely return to travel, work, school, and life, while protecting their data privacy,” Meyer said earlier this year.
Open-Source vs. Closed System
The Common's Project and VCI's open-source approach stands apart from the current landscape of providers, in which a hodgepodge of proprietary systems are being used to track vaccination status.
New York's Excelsior Pass, for instance, which is now being used to check vaccination status or COVID status prior to entering large events, is strictly limited to those using the state's software.
"The Excelsior Pass is only accepted by the Excelsior Pass reader," Meyer said. "The challenge is what happens if you want to go to New Jersey or fly to Singapore."
The Federal Health IT Coordinating Council on March 2 presented a slideshow — obtained by the Washington Post — with a similar characterization of the present state of affairs.
"Many [vaccine credential initiatives] are single (or small group) of companies developing solutions based on proprietary standards," read the documents.
The same slideshow called on the federal government to step up with guidelines for the emerging space, despite the Biden administration's commitment not to mandate a credential.
"From a Federal perspective, vaccines and vaccine credentials are matters of individual choice," it read. "However, current trends suggest that vaccine credentials could nevertheless become a market-imposed de facto requirement for an individual’s return to day-to-day activities."
So if vaccine credentials seem to be inevitable, what should they look like?
What organizations like the Common's Project and VCI are pushing for is what data experts call interoperability. This is the basis capability of different computer systems to share information. In the case of digital health passes, some argue it's a make-it-or-break-it feature.
"A health pass isn't useful if it's not recognized and trusted," said Dakota Gruener, executive director of the Good Health Pass Collaborative, another nonprofit working to apply higher standards to vaccine pass systems and other health data. "If you think about a credit card, for example, if every different card required its own point-of-sale terminal, very often you would get to the grocery store and the cashier would tell you, 'Sorry, we don't accept that here.'"
Gruener outlined two other principles: privacy and selective disclosure.
"We are absolutely ensuring that health passes are implemented in a way that respects privacy and gives individuals meaningful control over their own data, so that they have the ability to choose whether to share their information or not," she said. "We think it's really important that only the minimum amount of data that's required in any given setting is asked for and shared."
Getting the Data
For all of the above to be possible, first the organizations that could provide digital health passes or vaccine credentials need to get their hands on the data. When it comes to vaccination status in particular, that means accessing the state registries that keep that information.
"Step number one has always been about where the data is," said Ryan Howells, principal at Leavitt Partners and program manager for the CARIN Alliance, a public-private initiative to make health information available to consumers. "We have three million people getting vaccinated every day, which is wonderful news, but the problem is that we don't know where the data is being stored.
Howells, who is also on the steering committee of VCI, said there are 64 state immunization information systems (IIS) around the country, and that doesn't include databases maintained by HR departments and other sources.
Getting this kind of private health information has gotten more important as the focus has shifted from checking COVID-19 status to checking vaccination status in recent months.
"When we first did our trials of CommonPass in the fall with [United Airlines] between London and New York, we were focused on people getting tested," Meyer said. "There's been a fundamental change with the advent and distribution of vaccinations."
While testing status was more appropriate for a more limited, proprietary model, checking vaccination status requires full integration with health information databases.
"This is not a travel problem," Meyer added. "It's a health data problem. You're not going to store your vaccination records in a travel app."
He predicted that much of this discussion and debate will play out exclusively in the domain of international travel, while other applications, such as back-to-work requirements or sports events, are more uncertain.
Check out more on vaccination passports:
