As more Utahns gain access to COVID-19 vaccines, a logical next step is to rely on technological credentialing systems—accessed through a smartphone app or website—to confirm whether a person is vaccinated. While it may be tempting to seek shiny, high-tech solutions to create these “vaccine passports” in Utah, these decisions should be approached cautiously and with careful consideration to protect privacy, promote equity, and ensure transparency in any system.
Recent experience shows that an over-reliance on technology, particularly when collecting and storing personal health data, raises privacy concerns that may result in unintended consequences. We encourage any person or institution considering a digital vaccine credentialing system to keep the following points in mind.
Download this statement as a (PDF)
First, state and local governments should remain focused on vaccinating as many people as possible, especially those from historically under-served communities, communities of color, tribal communities, those that are unsheltered, and individuals incarcerated in jails and prisons. With 45.5% of Utah’s eligible population vaccinated as of May 25, much work remains to be done ensure that everyone who wants a COVID-19 vaccine has access to one. Deploying technology to track vaccination status to prevent future spreads will not be effective if communities hit hardest by the pandemic are not given ample opportunity to receive the vaccine.
Second, during the 2021 Utah Legislative Session, lawmakers passed H.B. 308 (Covid-19 Vaccine Amendments) that bars state and local government entities, as well as public colleges and universities, from requiring an individual to receive a COVID-19 vaccine as a condition of their employment or to attend at an event hosted or sponsored by the organization. Lawmakers also passed H.B. 233 that prohibits the Utah Board of Higher Education and public colleges and universities from requiring proof of vaccinations to enroll unless they also provide exemptions for medical reasons and personal, or religious beliefs. Private businesses and entities in Utah, including private universities, and public health and medical institutions, however, may require vaccinations and proof of immunization.
Third, we believe private businesses, universities, and institutions interested in confirming an individual’s vaccination status should be aware that apps and websites with access to personal health data can generate many of the unintended and long-term equity and privacy concerns raised in the following points:
Over-reliance on technology to track an individual’s vaccine status can contribute to existing inequities that widened during the COVID-19 pandemic. While attractive, smartphone-based credentialing solutions will leave out tens of thousands of Utahns—including those with lower-incomes, seniors, and people experiencing homelessness—who lack reliable access to these devices. For this reason, any system used to verify if someone has been vaccinated should contain paper- or card-based options in addition to any smartphone version.
Equally important is adopting a data system that is decentralized and uses an open-source model that puts individuals in control of their identity data. Personal data can remain protected and private and still follow acceptable standards for transparency and user control. Despite promises and precautions, recent examples from Clearview AI to Utah’s Medicaid breach show how any system that harvests and stores personal health data is vulnerable to misuse and attack.
Even though Utah law prohibits state agencies and institutions from using “vaccine passports,” any use of this technology should be transparent and well-regulated. Vaccine credentialing applications and platforms should be prohibited from tracking, saving, or selling all location or personal data created by users. Without legal protections or a guarantee of privacy, this personal information could be sold or shared with law enforcement.
In conclusion, we advise any vaccine credentialing system developed or used in Utah to incorporate these equity and privacy concerns in their design and practice.
Download this statement as a (PDF)
# # #
