Understanding the challenges of vaccine passports

With various provinces and territories rolling out vaccine passports, many employers are now considering the option for employees entering their places of work. But it’s not an easy prospect, judging by a recent panel hosted by AI tech company Eaigle.

For one, many employers lack the information and expertise to roll out a digital pass, says Amir Hoss, CEO of Eaigle in Markham, Ont.

“All of these organizations are struggling to navigate this fragmented vaccine pass, mandates and initiatives that governments are mandating across the U.S., across Canada... Because there is no unified approach and policy here and mandate from the government, we are seeing that large enterprises are now struggling to adapt to the new process.”

Exposing health data

One of the biggest challenges concerns the personal health data, and how that should be collected, stored or disseminated.

“Legally, there are regulations that every company, it doesn't matter how big or small, needs to fall under,” says Glenn Gale, director of IBM Watson Health for Canada and the Caribbean.

There are also questions about how much information needs to be exposed to allow someone to safely pass into an organization or event, he says.

“That's really the crux of it… What we need to be very careful of are things that are personally traceable to the individual and personally traceable to their health status. So, we don't need to have all of the information that's in the vaccination passport, per se, to allow people to move freely amongst venues.”

However, the government does need some sort of standard that encompasses all of those things, such as lot numbers for vaccinations, the types of vaccinations, the person’s date of birth, and the date of their last vaccination, says Gale.

“Then the question becomes, legally, how much of that needs to be exposed to allow someone to say, ‘Yes, you’re certifiable or verified to go into a facility’?”

But it's not necessarily an electronic health record that is being collected, he says.

“There's really no medical history, per se, that someone could [use to] make a judgment on your fitness or your wellness, other than the fact that you're vaccinated against COVID-19.”

For that reason, it could be beneficial to explain to people what’s behind that QR code, says Gale.

“The sensitivity and the lack of awareness of what's actually in there is really what drives the fear. And we need to do a better job of educating our employees. And also making the general public aware that what's there is only to give a checkmark so you can go into a venue or a facility. It's not to collect data.”

Personal information for HR

There is some resistance from people about getting that information from a vaccine card, even though employees provide certain personal information to HR when they are hired, says Hoss.

“Enterprises need to know at least which employees are vaxxed and the expiry date. And the reason they keep the expiry date is that they don't know if the second booster shot is going to be required and if it is required, is it going to be mandatory.”

There’s also a precedent for this in that employees attest to being smokers or non-smokers when they fill out insurance forms or health benefits documentation, says Susan Woodbridge, executive director of TELUS global health.

“This isn't new, it's just we're looking at it through the lens of vaccination today instead of another health driver or condition.”

But imagine if you were an insurance company, how much you would like to access that kind of information, because of the implications for an employer’s risk profile, she says.

“That changes how I might price your benefits or calculate the cost of insuring you. I think there's some information there [that] we just have to be conscious and careful of.”

Canadian HR Reporter recently spoke with an expert for answers to four legal questions about vaccine passports.

Storing private data

The question, says Woodbridge, is: Are people exposing their data as a mechanism to enter an establishment or move around freely?

“That's where we get into really difficult conversations around: Do corporations have the right, should they hold that data? How much of that is shared versus what do you consent to share on that front?”

The person at those organizations who is verifying credentials should not be storing them, she says, “so there is no breach, there is no transfer of data; there is a red or a green checkmark.”

“We need to limit the exposure for all these organizations that need to do this verification activity and not have them carry the burden of trying to secure the data that they become, perhaps, a custodian of.”

There's no reason for an employer to retain any data whatsoever, says Gale.

“All they need to know is: Is it safe for this person to come into the venue? And that's a simple check against the date of the last vaccination, and if it was the second or not.”

The way it works is the provinces make their vaccine records available to the individual, and then the individual downloads that information and shares it with whomever they deem necessary, such as the employer, he says.

In most cases, there's really no reason for an employer to hold that information because the employee or the citizen is their custodian at that point, says Gale.

“If an employer decides to pull that data, then they become a custodian of personal health information. And that goes back to all of the different regulations and the safeguards that you have to have around all of the auditability, and so on.”

Employer support for the government’s use of COVID passports differs from one situation to the next, according to a survey by the Canadian Federation of Independent Business (CFIB).

Logistical challenges

On top of all this, employers also have to contend with the logistics side of the equation. That could be a huge challenge for large employers with thousands of employees, says Hoss.

“How am I going to able to collect all these vaccine cards, create a database after that, and know whose vaccine is expiring at what time?” he says. “Are they going to scan it and send a copy, are they going to hand it over? So this whole collection is a very, very labour-intensive and time-consuming process, and very costly at a scale.”

More importantly, many employers have manufacturing and warehouse staff who lack a corporate phone or corporate email, or don't have access to an employee portal, says Hoss.

“Even when the government and that whole enterprise digitize this whole process, some [workers] are still going to come up with come with this paper-based vaccine pass and try to get into work. And so [it’s about] how to address this?”

More than two in three (69 per cent) Canadian manufacturers (69 per cent) support the use of a vaccine passport in their companies to protect employees and families, according to a report from Canadian Manufacturer & Exporters (CME).

There are two elements involved here: The proof of vaccination, presented in a paper or electronic form, and the element of identity management to make sure that the QR code lines up with the employee who’s coming in the door, says Gale.

“There has to be some mechanism for the employee to still control their vaccination data, and also give the employer what they need, which is the proof that they're safe to enter the building with the other employees.”