The Legality of Vaccine Passports
April 2021 | Sydney Szostek, Staff Writer/Editor
After COVID-19 put the world on pause over the past year, vaccines have felt like the light at the end of the tunnel. With increasing vaccination availability to all members of the public 16 and older in the United States, the idea of “vaccine passports'' has been introduced by numerous states. It is proposed that proof of both doses should become a passport of sorts, used as a way to shop at individual businesses, book a flight, or be admitted at border patrol. Although the intention is to promote safety amongst Americans, there is still the issue of whether these deemed “vaccine passports” violate the law. The legality of vaccine passports has been a contentious topic in regard to HIPAA laws, third-party regulation issues, and precedent rulings.
The Health Insurance Portability and Accountability Act, better known as HIPAA, is one law put in place to protect the privacy and security of the health of American citizens. Established in 1996, it has been at the center of conversations regarding the legality of vaccination passports. Within HIPAA, the U.S. Department of Health and Human Services created a set of national standards regarding the disclosure of health information. Generally speaking, the health information of an individual cannot be disclosed to any public health authority without the individual’s permission for any public health purpose. However, there are two exceptions: if it is required by law or if the public health authority seeking the information is “authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to, the reporting of disease, injury, vital events,…and the conduct of public health surveillance,...investigations, and...interventions”.[1] Thus, as long as the authority in question is allowed under the law to gain access to this health information for purposes such as preventing the spread of a disease (i.e. COVID-19), it is legal for them to obtain such knowledge. As for what defines a public health authority, the Centers for Disease Control and Prevention provides that it is “an agency…of the United States…or a person or entity acting under a grant of authority from or contract with such public agency…that is responsible for public health matters as part of its official mandates.”[2] Therefore, anyone who is employed by an authority that is allowed discretion on these health matters is permitted to receive health information such as vaccination records. Further, vaccinations do not provide any additional health information about an individual. In fact, in order to receive a vaccination, one is not required to have proof of medical insurance. There is nothing revealing or private about vaccinations, and for this reason, vaccine passports are not in violation of HIPAA laws.
While vaccine passports may not violate HIPAA, plausible concerns about the logistics of the passports remain. One such concern is the issue of vaccine passport distribution. Individual states have proposed a plethora of ideas regarding how these passports will be regulated. New York is one of the first states that began looking into third-party systems to verify an individual’s vaccination records. New York Governor Andrew Cuomo launched the Excelsior Pass,[3] an app where residents can securely provide proof of their vaccination status in order to gain access to their preferred shops and restaurants. As part of the New York State Department of Health guidelines, this is a way to help bring society into a sense of normalcy, easily integrating people back into their daily routines. The app creates a unique QR code that can be scanned by any business that chooses to participate. Vaccine record verification (VRV) systems such as Excelsior Pass can help globalize vaccination records because users will not have to visit their health care provider for permission, keep a document on hand, or wait in line at a government institution to obtain an official record. Although VRV systems utilize current technologies, they have actually been around since 1959 when the World Health Organization established the International Certification of Vaccination which “logged an individual’s vaccination history to meet countries’ exit and entry requirements”.[4] With nearly everyone having access to a smartphone, the power of a VRV system today would be extremely helpful in rolling out these vaccine passports.
According to the Brookings Institution, third-party systems may be an accurate verification of vaccine status, but they also bring about issues of hacking, falsified records, and difficulty distinguishing between having COVID antibodies versus receiving the vaccine.[5] The problem of security and hacking will be worked out as soon as third-party systems acquire new safety measures. Moreover, public health officials are working with scientists to gather more information about the situation between antibodies and vaccinations. For individuals with antibodies as opposed to the vaccine, the difference in immunity may even create a two-tiered society where those with vaccinations have more freedom in entering businesses whereas someone carrying the antibodies may not.[6] Despite these potential drawbacks, there are possible solutions that will be in the works over the next few months, and the pros of having these third-party systems that regulate vaccination records far outweigh the cons.
One might think that the debate over vaccinations is relevant only to current times, but this is not the case. During the smallpox epidemic in 1905, Jacobson v. Massachusetts “challenged the state’s authority to impose mandatory restrictions on personal liberty for public health purposes”.[7] The state of Massachusetts required vaccinations for smallpox because it was necessary for the health of the public, but Jacobson refused because he had prior allergic reactions to vaccinations. Massachusetts refuted that although they used the word ‘required’, it was not in any context to mean ‘forced’, and that Jacobson may refuse with a payment of five dollars.[8] Jacobson appealed to the Supreme Court, where the Court upheld the state’s decision and that “the Constitution confirmed that states retained all the sovereign authority they had…states had authority to legislate with respect to all matters within their geographic boundaries”.[9]
Further, Jacobson never argued whether or not it was legal for the government to mandate a vaccination in the first place, which is also why the Supreme Court ruled in favor of Massachusetts. Jacobson, instead, looked towards the 14th Amendment's Due Process Clause pertaining to personal liberty, since he felt he had the right to refuse the vaccination. Justice Harlan commented that although every individual is protected under the 14th Amendment when it comes to individual liberty, “it is equally true that in every well-ordered society charged with the duty of conserving the safety of its members, the rights of the individual in respect of his liberty may at times, under the pressure of great dangers, be subjected to such restraint, to be enforced by reasonable regulations, as the safety of the general public may demand”.[10] This exact wording can be transported into today's argument about vaccination passports. To protect the greater public, it is imperative that each individual lose a small portion of their liberty. Similar to mask mandates, each person’s actions can affect the health of society as a whole. Private entities such as businesses have the right to mandate masks, and therefore, will have the right to use a third-party system to check their customers' vaccination status. In the future, there may be more court cases regarding the legality of vaccine passports, but for now, they are legally permissible.
As more vaccines are administered by the day, vaccine passports are becoming the main topic of discussion for individual states. HIPAA and precedent case law have no reason to restrict the use of third-party systems in allowing for individuals to provide their vaccination data to an authority such as a business. Privatization of health information is important; however, vaccinations reveal little to nothing about an individual, so there is no reason to keep it confidential. Ultimately, vaccine passports may be the difference between a nationwide lockdown and an open world. Thus, it is essential to see the bigger picture: a small limitation of personal liberty will preserve the nation’s overall freedom.
Sources
“HIPAA Overview and Vaccine Administration.” (U.S. Department of Health & Human Services, 2016).
Ibid.
“Excelsior Pass.” (New York: New York State, 2021).
Baobao Zhang et al. “Building Robust and Ethical Vaccination Verification Systems.”(The Brookings Institution, 2021).
Ibid.
Ibid.
Wendy K. Mariner, George J. Annas, and Leonard H. Glantz. “Jacobson v Massachusetts: It's Not Your Great-Great-Grandfather's Public Health Law.” (Bethesda: American Journal of Public Health, 2005).
Ibid.
Ibid.
Ibid.