Press "Enter" to skip to content

Venues Want Vaccinations. Audiences Need Privacy.

Race Is On For Fast, Secure Vaccination Verification

By Joanne Cleaver

From concerts and soccer games to the Late Show with Stephen Colbert, large gatherings are rapidly re-emerging in the post-COVID recovery period – and privacy is now a factor in the price of admission. 

As the world attempts to stabilize, event managers are rushing to apply new technologies and tools to determine COVID-19 vaccination status without mishandling consumer data or running afoul of new regulatory guidelines. 

Governments and entrepreneurs are also working to establish their apps as the go-to technology for event venues and related industries. 

This global scramble is setting up a whole new category of personal data and privacy management chores for consumers, said Travis Gemoets, a partner with Los Angeles law firm Jeffer Mangels Butler & Mitchell LLP. 

“Consumers will have to keep track of what databases have their vaccination cards,” Gemoets told Digital Privacy News. 

“You’ll need documented medical proof of having been fully vaccinated – and that it has been two weeks from your final shot – to access the venue, whether it’s an amusement park or sporting venue or concert, where social distancing is difficult to impossible.”

Quick-Look Status

The quickly developing standard appears to be privately owned and managed apps that venues use to quickly ascertain a guest’s vaccination status via a “thumbs up or thumbs down” without showing the underlying data, said Gemoets. 

A quick-look status check obscures the underlying details from casual observers and users – like ticketing and admission staff – while also requiring individuals to manage yet another type of data being collected and disseminated about them, he said.  

To reopen, employers of all stripes need a fast, accurate mode of verifying the vaccination status of both employees and customers, said Gemoets and public health advocates.  

Ensuring a safe workplace for workers and consumers is a basic operational requirement, which is why new federal guidance was released May 28 by the Equal Employment Opportunity Commission. It affirmed employers’ responsibility and right to require employees to be vaccinated against COVID-19 before returning to the workplace. 

Fast and easy vaccination validation is the next land rush for digital entrepreneurs – private and public – who are eager to corral consumers’ records into standalone databases that can provide health clearances for people traveling, going to events and staying at hotels. 

Ensuring that the personal health “green light” is also anonymous depends on how the new industry creates standards and distances itself from public health record databases, entrepreneurs and lawyers said. 

Validation Tools

People eager to be in the Late Show audience must validate their vaccination status as part of the process of buying tickets. 

The validation is through New York state’s “Excelsior Pass,” which digitizes a state resident’s vaccination card and is used in conjunction with another form of personal identification, such as a driver’s license. 

“Excelsior Pass is a voluntary system that creates a digital copy of a preexisting paper record – it is not a standalone identification document,” said a spokesperson for the New York governor’s office. 

“The entire system was created with privacy and security in mind, however, those who post personal information online such as their CDC [Center for Disease Control] card, risk having someone use their information to create a false record, which is why every Excelsior Pass has to be cross-referenced with photo ID when you enter a venue,” the spokesperson said. 

The state’s privacy policy for the pass indicates the data is not sold to third parties. The policy states: “When your Pass is scanned, the Excelsior Pass Scanner app collects analytics about the type of Pass and the result of the scan. No personal information from Passes is collected or stored.”

But Excelsior Pass is only valid in New York, leaving entrepreneurs in a race to create national vaccine-validation tools.  

Keeping It Private

Last fall, a California doctor named Geoff Trenkle realized his medical practice already had the skills, infrastructure and culture to extend its management of confidential patient data to a vaccination validation app. 

He and his wife, Lauren, also a medical professional, formed Total Testing Solutions, which is signing up sports franchises eager to get fans into stadiums – if those fans are confirmed to be vaccinated. 

“The question is, how do you show proof of vaccination but keep it private?” said Trenkle.

The solution, he explained, is to use medical data privacy standards to validate status on the spot with a checkmark that flashes vaccine compliance with a glance. That relieves admission staff of reading data on tiny vaccination cards and protects consumer privacy by keeping the underlying medical records out of sight. 

Total Testing Solutions’ app connects only to health departments, which confirm the validity of the vaccination status. Limiting the data sharing only to public health authorities is intended to quell worries about vaccination status being sold to third parties, Trenkle said. 

“A lot of people are skeptical because they don’t want their information to be given to anyone, but to reopen the economy we have to have a state registry and the data is supposed to stay there,” he said. 

“There’s a clause for departments of health to have the right to share with other departments of health. There have been companies that are trying to purchase into that resource but that’s a complete violation of all our privacy. Nobody should be tapping into that.” 

Long, Strange Trip

In February, CLEAR, the company best known for VIP lanes through airport security with its private pass system, announced a $100 million round of funding, some of which will support its new “Health Pass.”  

According to a company statement, the Health Pass is a digital app that “securely links and validates individuals’ vaccination credentials.”

The CLEAR statement listed a range of event-driven businesses already using the Health Pass, including the National Hockey League, the 9/11 Museum and MGM Resorts. 

CLEAR did not respond to repeated requests for comment from Digital Privacy News. In its announcement, the company stated that it has five million individual users. 

Gemoets, meanwhile, expects to show his vaccination card to get into the Grateful Dead concert he eagerly anticipates attending this summer. 

When he bought the tickets, he had to check a box promising to comply with vaccination validation at the door. 

Whether that entails an app or flashing his card, it’s worth it, he said, to get back to the show.