As mask mandates fall to the wayside, COVID-19 digital health passes, often called vaccine passports, hold promise as a tool to verify whether individuals may enter a space without a face covering.
Vaccine passports, however, also pose a number of ethical and legal challenges. Panelists discussed these concerns during an April 28 webinar hosted by the Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics titled, “Vaccine Passports: A Path to the New Normal?”
This article highlights key points made during the conversation.
Carmel Shachar J.D./M.P.H. ’10, executive director of the Petrie-Flom Center, moderated the discussion.
The panel featured:
- I. Glenn Cohen ’03, faculty director of the Petrie-Flom Center, deputy dean of Harvard Law School, and James A. Attwood and Leslie Williams Professor of Law;
- Natalie Kofler, Senior Advisor, Scientific Citizenship Initiative, Harvard Medical School, Visiting Fellow, Edmond J. Safra Center for Ethics at Harvard University, and Founder, Editing Nature;
- Iris Goldner Lang, Jean Monnet Professor of European Union Law and UNESCO Chairholder, University of Zagreb, Faculty of Law, and former Fulbright Visiting Researcher at Harvard Law School; and
- Seema Mohapatra, Associate Professor of Law and Dean’s Fellow, Indiana University Robert H. McKinney School of Law.
The transcript has been edited and condensed. Watch the full event video, which is captioned, below.
- Vaccine credentials aren’t new.
Carmel Shachar: Can you articulate what are the main challenges and benefits that digital health passes or vaccine passports pose? Why are we talking about these kind of programs?
I. Glenn Cohen: Why don’t I start on the benefit side? And here, I’ll just say that while there’s a lot that’s exceptional, there’s actually a lot that’s not exceptional.
Anybody who’s traveled to many parts of the world knows that little yellow book with your proof of yellow fever vaccination, and the like. Anyone who’s had a kid in school knows that many public schools require you to show proof of vaccination. Indeed, in this country, if you look back to the turn of the century, the smallpox epidemic, we had a huge amount of soft mandates, “show the scar,” show that you were inoculated, by employers, public spaces, schools.
Okay, so, why have we done this in the past? And why do we do it now?
The idea is to improve public safety, and also, and this is important, as a less restrictive alternative, compared to a background rule where people would be in further lockdowns, where particular institutions would be shut, including universities. So it’s attractive for that reason.
Iris Goldner Lang: When it comes to coordination and free travel, this is what these so-called Digital Green Certificates, the way they are called in Europe, are supposed to enable — primarily for EU citizens, but, to a certain degree, also for third country nationals, like U.S. citizens.
The EU certificates will enable movement not only of the people who have been vaccinated, but also of the ones who haven’t been vaccinated, but have a negative test, or have recovered and have antibodies. But the problem is that if you look at the numbers in the EU, in terms of what percentage of the population has been vaccinated, the numbers are extremely low, and there are huge disparities among member states.
- But COVID-19 vaccine credentials pose unique concerns.
Natalie Kofler: I think that these inequities that we’ve witnessed throughout this pandemic are continuing now, both domestically and internationally, and I have a lot of concern that broad use of a vaccine passport to be able to access leisure and everyday activities could very much run the risk of codifying those inequities.
Seema Mohapatra: As the discussion has focused more and more on vaccine passports, part of the concerns that I’ve had are when we try to look for a technological fix for what has been an ethical disaster, in terms of inequity.
What I’m worried about is the focus shifting. I do draw a distinction between requiring vaccinations for schools, like has been done for many years, and thinking about a Vax Pass, like in Chicago, in a city that’s so segregated, and where we know that access to vaccinations has been limited, even though everyone technically over 16 can get vaccinations.
And it’s really hard to think about these vaccine passports or digital health pass systems without thinking about it in a global context. So often we look at things just from a U.S. perspective. We were ignoring what was happening [abroad], in the beginning of the pandemic — you know what happened because of that. And I worry that when we focus on, well, let’s get back to normal, we are not going to actually end the pandemic.
- Whether or not you’ve been vaccinated isn’t sensitive health information, but the why behind vaccination status might be.
CS: Privacy concerns are frequently mentioned with respect to vaccination data, but why should this data be private at all? Most of us seem comfortable sharing our vaccination status online with virtually everybody.
IGC: The fact that you’ve been vaccinated, that’s not top secret information. I think the place where people are a little bit more worried is, any equitable system has to figure out what to do about people who have medical contraindications.
There is a concern that if the digital health pass contains details about that, or even the fact that you are a person with a disability, that’s an area where we might think that there is more privacy concern.
- And because vaccine passports aren’t being developed by health care entities, the typical health data privacy protections do not apply.
CS: Why doesn’t HIPAA apply to these types of vaccine passports?
SM: Unless you are either in the business of payment, treatment, or health care operations, you are not going to be subject to HIPAA; you’re not a covered entity. And in this case, the vaccine passport schemes, as they are being proposed, would not be subject to HIPAA protection, because that information is not going to be for payment, treatment, or health care operation purposes.
I think one of the worries about a national vaccine passport system in the United States, or even [one implemented by] state or private actors is once that infrastructure is in place, what else is it going to be used for, and what unintended uses are there?
if there are going to be vaccine passport schemes, we do need to make sure that there are protections. right now there aren’t laws that protect the use of that kind of data in ways that we might not anticipate because HIPAA doesn’t apply, and we don’t have an all-encompassing privacy law like GDPR.
- Vaccine passports may be used to enforce vaccine mandates, but they’re not the only option.
IGC: I think there are two separate conversations: One is, is it proper for institutions like universities, like employers, like public schools, to require proof of vaccination, or some other thing, as a condition [for access]? And the second is, is a vaccine passport system a good way to do this?
And some people are just opposed to the first, so if they’re opposed to the first, they’re not going to like the vaccine passports. But there’s a group of people who think it’s perfectly acceptable for the correct institutions to react in the correct ways about setting up these requirements in the name of public health and public safety, but who are resistant to the idea of a vaccine passport as opposed to a more analog system, and I think it’s useful to disentangle those two sets of kind of objectors.
I think some of the people who are objecting vaccine passports are also objecting to mandates, and there are other people who are actually fine with certain kinds of mandates, but don’t like this way of achieving them.
There are some states like Florida, Texas, that have basically taken the position that we want to proactively outlaw these vaccine passports before they’re ever in place. Now these statutes particularly reference these passports, but they’re actually, for the most part, anti-mandate statutes.
- Vaccine passports are largely driven by the private sector in the U.S.
CS: Who are the key stakeholders in developing these apps? Who is pushing this forward in the U.S.?
NK: In the United States, it seemed like the really early activators of this space were two groups. One, the technology companies, and then the other, private sectors that think this can help them to reopen their businesses; places like Ticketmaster, American Airlines, the NBA.
That’s where some of these questions of privacy and equity do come up. You’re seeing this patchwork, I think there’s like 17 different apps under development in the United States, all with different operating systems and different levels of privacy.
- From a legal perspective, it doesn’t matter that the vaccines are authorized for emergency use, rather than approved under a Biologics License Application (BLA).
CS: Can you mandate that somebody get a vaccine that is currently under emergency use authorization?
IGC: As a matter of federal law, there’s no difference between an emergency use authorization and a BLA and approval, in terms of the legality of requiring people to undergo vaccination as a condition of coming to something. [Cohen, Shachar, and Dorit Rubenstein Reiss have made this argument in Stat, among other outlets.]
I want to just be clear here that many civil libertarians frame this as, keep the government off my body, don’t force me to do that, and that’s true: nobody’s forcing you to get vaccinated, but to say, as a condition of doing x, you must prove that you’re not posing a risk to others or to yourself, is completely consistent with the history of this country in many public health regulations.
Now, that said, even though that’s true as a legal matter, in terms of the way it registers in people’s minds, they have a different reaction to hearing something’s gone through an emergency use authorization than an approval, and it’s my fervent hope that for at least some of the vaccines, if not all of them that we’ve authorized, the United States will move to full approval soon, because I think it takes away that one strand of the argument.
- The future of COVID-19 vaccine credentialing apps remains uncertain, especially in the U.S.
CS: This time last year, the topic that everybody wanted to talk about were exposure notification apps, also referred to as digital contact tracing apps. And then it sort of fizzled out. Does this panel think that the same will happen with digital health passes, or do you think there is a chance that they really will become a reality for many global citizens, especially Americans and Europeans?
IGL: I think that it’s quite likely that these passes will become a reality in the European Union because so many EU member states and private businesses, especially, for example, in tourism, really want these certificates to be adopted. And I think that if they do get adopted, they will exist until there is no herd immunity, because if you look at the proposal, it stated that the certificates will be suspended when the WHO declares the end of the pandemic. So we might have them for quite a while.
NK: In the U.S., I’m not sure, but I do think internationally, we are certainly going to start seeing reciprocal implementation of some sort of vaccine passport model.
A real concern for me is it’s just one other way of benefiting the rich global north. We’re going to be traveling between Europe and the states, and it’s going to be a great summer… whereas healthcare workers in Kenya still aren’t fully vaccinated.
When we look back, this is going to be an unbelievable moral stain on humanity that our future generations will be outraged about. That’s, I think, the direction we’re going, and I think this has the ability to do that, and I think we have to be very careful.