How the US plans to track Covid-19 vaccine doses

A database of databases.
A database of databases.
We may earn a commission from links on this page.

On Dec. 11, the US Food and Drug Administration issued its first emergency use authorization for a Covid-19 vaccine, shortly after the UK and Canada. The Pfizer/BioNTech mRNA vaccine will be the first available for mass distribution in the country, with the first doses available within days.

Healthcare workers and long-term care facility residents will be the first to receive vaccines, getting two jabs weeks apart to provide full protection. But that task presents enormous logistical challenges. To pull off vaccine deployment, the US is planning on connecting old, federalized systems of immune registries with a new program called IZ Gateway—a first-of-its kind system for the US that could go on to track all future immunizations across the country.

At its core, IZ Gateway is a message router, says Mary Beth Kurilo, the senior director of health informatics at the American Immunization Registry Association (AIRA). A project of the US Centers for Disease Control and Prevention (CDC) and the US Department of Health and Human Services’ office of the chief technology officer, its job is to connect immunization records from cities and states to one another so that providers in one area can look up vaccination records across jurisdictions.

Since the 1990s, most states and some larger cities like New York and Philadelphia have had their own immunization records, called immunization information systems or immunization registries. (The only exception is New Hampshire, which will come online with its registry later this month.) “Their goal is to track every immunization given within their area,” says Kurilo.

At a population level, these records can show state health officials how many people have been vaccinated, which may inform policy decisions. On an individual level, it’s a convenient way for healthcare providers to keep track of which vaccinations their patients may need. About 75% of these registries also allow a healthcare provider in one facility, like an emergency room, to look up whether their patient has previously gotten vaccines somewhere else, like at their primary care provider’s office or their local pharmacy.

The good news is that tracking two doses of a vaccine isn’t a new challenge for these systems. “Most immunizations are a series,” says Kurilo, and states’ individual immunization information systems have helped coordinate them. The problem with the current systems is that they’re all disjointed. Providers in one city or state can’t look up their patient’s vaccines if they got them in another.

That’s where IZ Gateway comes in. It’ll be a secure router, hosted on Amazon Web Services through the Association of Public Health Laboratories, that allows interstate searches and entries. Another aspect of the system would connect records from larger healthcare systems like veteran’s affairs hospitals or prisons.

Such a comprehensive registry comes with privacy concerns. In order to track immunizations, patients will have to give their names, addresses, phone numbers, and more recently email to prove their identities. On the vaccination side, providers will have to input the vaccine manufacturer, batch number, and date in case of recalls or other health concerns. Only healthcare providers will be able to access them with appropriate password protections in accordance with the Health Insurance Portability and Accountability Act (HIPAA).

Some people may be excluded from this kind of system. “I don’t know how you’d communicate that with more vulnerable population groups—what about undocumented immigrants?” says Diane Korngiebel, a bioethicist and research scholar at the Hastings Center, a think tank based in New York. These individuals may not want to participate for fear of being caught; people experiencing homelessness who don’t have a permanent address may also avoid the system.

These populations have historically had inadequate access to healthcare. “Regardless of how well IZ Gateway works as an exchange medium, it’s not going to solve any of the underlying healthcare disparities that we already have,” says Korngiebel. The CDC didn’t return Quartz’s request for comment.

The US federal government has been trying to piece together its jigsaw of state-wide vaccine registries since before Covid-19; the pandemic has lit a fire under its feet. In 2019, it awarded Audacious Inquiry, a Maryland-based software company, a contract for $3 million over three years to provide product management and integration support for IZ Gateway. This October, the CDC awarded the company a nearly $12 million expansion contract to get the system off the ground over the next 11 months.

Meanwhile, Kurilo’s group at AIRA has been working to get states and other jurisdictions onboard; in the end, 61 immunization registries will participate. “We’re working on setting up solutions on the policy end and the technical end,” she says. They’re making sure that state’s policies legally allow them to share vaccination records through the gateway—there’s a lot of paperwork required—and that they have the correct protections and infrastructure to get all of them securely connected.

On the policy side, “33 jurisdictions have signed on, with more every week,” she says. But getting everyone’s infrastructure up-to-date will require funding that some states don’t have handy. If we had been able to see Covid-19 coming, we would have pushed to get it going sooner, Kurilo says.

Correction (Dec. 14): An earlier version of this story said that Audacious Inquiry was building IZ Gateway; it is providing project management and integration support.