The unrealized promise in COVID apps

Digital vaccine credentials and exposure notification apps have unrealized promise in helping track the progression of COVID-19 and individuals’ safe integration into society, according to Government Accountability Office research on the efforts to date.

A digital vaccine credentialing app, sometimes called a vaccine passport, links a person’s verified identity to their vaccine status. In many states, vaccinated persons can download an app that connects their identity – which has been verified by the health authority administering the vaccine – to their vaccination status. The app generates a secure digital code confirming the users’ identity and vaccine status.

Also available in many states, exposure notification apps alert users when their phone has been near enough to another phone whose owner has reported a positive COVID test. They use the phone’s native apps to measure location and distance to determine exposure risk. Such apps can notify users quickly, giving them more accurate data on where they’ve been and cutting down on manual contact tracing.

These types of apps allow users to have higher confidence in the authenticity of the data, according to Hayden Huang, GAO’s assistant director for  science, technology assessment, and analytics. Speaking at FCW’s Dec. 1 Health IT workshop, Huang noted that digital credentials are also often easier to use. Unlike paper cards, phones (and their stored data) are less likely to get lost. Additionally, many of the credentialing apps use color-coded information, so language is not a barrier for those checking vaccine status.

These apps are typically developed and launched by individual states because the vaccination data is housed with state registries.  New York launched its Excelsior Pass in March after successful testing at a sporting event. The state also offers a Pass+ app for use outside the state, Huang said.

California issues a QR code that links to a registry. Hawaii launched a SMART Health Card program that allows residents to upload proof of vaccination and receive a QR code digital proof of their immunization against COVID-19.

Other states, including Pennsylvania, New Jersey and the District of Columbia are using VaccineCheck. That app allows users to upload their pictures along with an image of their vaccination card. Once the data is verified, users can access the VaccineCheck’s digital card. Louisiana incorporated a vaccine verification function into its LA Wallet, a smartphone app that hold users’ drivers licenses.

Apple also has a proprietary version of the vaccine verification app.

GAO also looked at about 10 exposure notification apps and noted quite a bit of variability in the development and implementation of the apps. They can take between two to five months to develop and cost between $400,000 and $3 million to design and market, with most supported by federal, state and nonprofit funding, Huang said.

The apps hold great potential for slowing the spread of disease because they make it easy to gather, redistribute information to potentially infected people. However, their success depends on a sufficient  number of people using the same system, Huang said.  “So long as all parties involved have compatible apps, this process for notification can be faster and somewhat more objective than conventionally done,” he said.

Unfortunately, uptake of exposure notification apps was slow, limiting the number of actual exposure notifications from between 1,000 and 40,000 as of June 2021 he said. They were also only deployed in 26 states and territories, which limited their effectiveness, as did their inability to operate across state lines, he added.

Plus, Huang said, it’s unclear how people acted once they received notifications that they had been exposed to a COVID-positive person. There is no data on whether people actually did quarantine or not.

While a standardized digital credential could speed vaccine checks at venues, streamline verification and enhance data security, the assortment of verification and exposure notification apps creates a fragmented landscape, Huang said.

The IT challenges of rolling out a smartphone app, whether for exposure notification or proof of vaccination, are great, Huang said.

Data and privacy must be protected. The apps collect health, location and personally identifying information, which can make users uncomfortable, as might the fact that the app must always be on, monitoring the user’s location.  A lack of clear standards about how the information is intended to be processed and how it would be handled also hinders adoption, Huang said.

Uniformity across vaccine registries, diagnostic testing results, testing standards, permissions, formats and outputs would help make the vaccine credentials interoperable, a requirement if the apps expect to be used nationwide or internationally.

Legacy devices, network issues and the fact that not everyone has a smartphone also present challenges to wide implementation. Plus, it’s unclear how accurate distance measurements in exposure notification apps are under a variety of circumstances.

Exposure notification apps also rely on users who test positive to report their results and persons notified they have been exposed quarantine themselves.

All these conditions must be met for tangible benefits to be realized, Huang said, making it difficult to determine whether these new types of apps “actually provide any public health service.”

To make the apps useful, Huang had several suggestions for federal, state, local governments and non-profits:

• Conduct studies to benchmark effectiveness of various approaches.
• Work to establish standards of effectiveness for apps and iron out interoperability and privacy issues, ensuring that data is collected, used and stored in ways to inspire confidence in users.
• Develop a national strategy leveraging messaging, funding and steps to address equity (language and accessibility are IT-solvable) that could help encourage adoption.

More info is available at GAO on digital vaccine credentials and exposure notification apps.