Privacy concerns a challenge for Trump administration's effort to track Covid vaccinations

The Trump administration’s plan to coordinate existing vaccine registries into a national database for the Covid-19 vaccine rollout is raising privacy concerns among some immunization officials who say the data should remain only with states.

States have always been charged with tracking vaccinations among their residents through what’s known as immunization information systems. Previous attempts to stand up a federal registry have been foiled by advocates who say personal health information should not be centralized under the federal government.

But federal officials say the national collection of Covid vaccination data is now urgently needed to ensure that the largest mass vaccination effort in history moves as smoothly as possible. Centralized data will help the government ensure people get their follow-up dose even if they leave their state, Operation Warp Speed officials said Monday, and will help officials track Covid vaccine uptake in various communities. That will help determine where the limited number of doses will have the greatest impact.

As part of that effort, the Centers for Disease Control and Prevention has asked states and jurisdictions to sign data use agreements that would share personally identifiable information from existing registries with the federal government. The New York Times first reported on the request.

The move, and its subsequent pushback, underscores the need to balance privacy with expediency as officials race to prepare for vaccine distribution and bring the crisis, which is killing more Americans than ever, under control.

The requested information, which includes “names and other identifying information of persons,” according to a draft of the agreement, would not be shared with any federal agencies, but would rather be anonymized in a “data clearinghouse.” Redacted information would then be made available to the CDC and other federal officials, the draft agreement says. But not every state has agreed to hand over the data yet.

Deacon Maddox, who runs Operation Warp Speed’s data and analysis programs, said Monday on a conference call with reporters that the number of states that have not yet signed are in “low single digits” and he added that “all of them [are] on track to be signed here in the first half of this week.”

“Due diligence was done on the part of all the jurisdictions to make sure they understood what was in that agreement,” he said, explaining the delay. “And it’s important to understand that the CDC took a lot of time to understand what those data elements were. They are truly the minimum data requirements of what would be asked for in a pandemic response.”

It’s not clear exactly what information states are agreeing to provide to the federal government, but Maddox said it includes names and birth dates, at least.

Claire Hannan, executive director of the Association of Immunization Managers, said recently in a phone interview with CNBC that there are “legitimate legal issues with sharing identifiable data.”

The biggest reason why it’s important to share the data with a federal registry, Hannan explained, is to ensure that people receive their follow-up shot even if they leave the state in which they were first vaccinated. Both the Pfizer and Moderna vaccines, which could be authorized this month, require two shots to be as effective as possible.

There’s a real need for state systems to be in communication with one another, Hannan added, and the data use agreements are one way to do that. She said she’s optimistic all states will eventually agree.

“We’ve been working for years trying to get these agreements in place for states to be able to share data,” she said. “We’re truncating something that normally takes a very long time, legally, and I think that as the oven gets hotter, so to speak, that the right people will be at the table working this out.”

Mary Beth Kurilo, senior director of health informatics at the American Immunization Registry Association, said in a phone interview last week that states have long been working on making their vaccine registries inter-jurisdictional. Her organization, she said, had been working with technologists and attorneys general in various states to set up the legal and technical infrastructure to do so.

“It was in a pilot phase when Covid hit, and now it’s been fast-tracked to a nationwide rollout, so we’re working on implementing. That implementation, of course, is going slower than we would like,” she said. “But ultimately, that’s our goal, to allow for a nationwide network of systems that can not only push messages across state lines but also query across state lines.”

But as the nation asks local and state health departments to report more and better data, Kurilo said, more funding is needed. She noted that the Association of State and Territorial Health Officers has requested $8.4 billion in additional funding to help with vaccine distribution, which includes data reporting requirements.

The money will help modernize outdated health record systems, bring on support staff to report the data and hire epidemiologists to help analyze it, Kurilo said.

“Public health has managed to do a lot without a lot of funding,” she said. “We need epidemiological resources who can mine the data, who can ensure that it gets back to health planners, who can use it to look at the immunization rates of their members, who can develop coverage maps and show pockets of need and of who’s immunized.”

There is general support for and recognition of the need to stand up a massive effort to track immunizations across the country at a federal level, Aaron Miri, the chief information officer for Dell Medical School and UT Health Austin, said in a phone interview. But Miri raised concerns about the method through which the effort is being implemented.

As the “custodian of tens of thousands” of people’s health records, he said, he is responsible for ensuring that their information remains legally protected.

Miri noted that Congress has prohibited the federal government from creating unique patient identifiers for anonymous data. So it’s yet to be seen, in his view, exactly what information is going to be tracked by federal officials and how.

“I have an obligation to my patients to explain that,” he said. “The federal ban prohibits HHS, or any federal agency, or anything at all, from adoption of a national patient identifier.”

A former senior official in the Department of Health and Human Services who was deeply involved in the effort to improve hospital reporting during the pandemic is glad the administration is standing up a federal source of data. The official, who asked to remain anonymous to discuss internal government work, said HHS personnel had pushed Operation Warp Speed officials for such an initiative since the beginning of the summer.

Introducing the effort earlier would have given states and hospitals more time to adjust to the new and potentially burdensome reporting requirements, this person said.

“Hospitals are getting crushed right now,” the official said in a phone interview. “Now you’re asking the hospitals to receive the vaccine, register people to get the vaccine through their systems, which requires some level of help-desk support, and then coordinate who comes, create some identifier so they can come back in and get the same vaccine again — but they’re completely overwhelmed with the response itself.”