Updated Jan. 10 at 8:57 p.m.
As municipalities roll out indoor vaccine requirements, Massachusetts has launched its long-awaited COVID-19 vaccine verification webapp to give residents a quick and secure way to show proof of immunization.
My Vax Records is a browser-based tool fed by records in a state-run database. Officials in Gov. Charlie Baker's administration said the system will provide verified information for any businesses that wish to check for vaccination. Boston will require that private indoor spaces check for vaccinations starting Saturday, but Baker administration officials said Monday there will not be any state-level mandate for vaccination.
Any user who completes the verification process will get a personalized QR code that is essentially a digital version of the information on their government-issued vaccination card, with their name, birthdate and details on the vaccine doses they received.
Businesses screening patrons can use a corresponding scanner app to verify that a code is legitimate. Businesses may also opt to check personal details, such as name and birthdate, against a patron's ID. Walgreens and CVS have already announced they are ready to use this new verification system.
The webapp comes after months of development in conjunction with several other states and medical data companies.
The system uses the state-run Massachusetts Immunization Information System database and developer The Commons Project's interoperable SMART Health Card system to provide the scannable code. IPhone users can transfer the code to the Apple Wallet app for quicker access. Developers recommend users of Google's Android operating system take a screenshot of the code for use.
To obtain a QR code through the system, users will have to provide their name, birthdate, gender, and either a phone number or email address given to the vaccine provider. Users will also be asked to create a four-digit PIN. A text or email with a link to the personalized QR code is then sent to the user.
Andy Ihnatko, a Massachusetts-based tech writer and blogger, said the new system released by the state is safe and secure to use. He said his confidence comes, in part, because it’s built on open standard software, which can be seen and used by the general public and isn’t owned by a private corporation.
“If they were to trust another corporation’s standard to keep this running, it probably would have been a big bag of hurt as far as privacy goes,” Ihnatko said, “But as it is, I think it works great.”
Ihnatko said at least a dozen state are using vaccine documentation systems based on the open standard software that Massachusetts’ new system is built on.
“This has been a longstanding problem of, how do we easily allow people to reveal just the amount of health information or vaccine information that's required for this one situation and not have to reveal the whole barnyard just to get into a restaurant or just get into a hotel? ” Ihnatko said. “The only thing that that person with the scanner is going to find out is your name, your date of birth and the answer to that question: Have you been vaccinated? They don't get anything else.”
Baker administration officials said the vast majority of records in the state-run database include a phone number, but that most records do not include an email address. If a user's records can't be found, the state is encouraging people to contact their vaccine provider to have them upload either a phone number or email address to the database.
This story was updated to include comment from Andy Ihnatko about the system’s safety and security.
GBH News’ Mark Herz contributed reporting.
