COVID-19 immunization cards are distributed to vaccine recipients following their vaccination. (Macy Hinds/U.S. Navy)
As vaccine mandates become the norm for workers to return to offices, a complicated challenge is emerging for employers: how best to verify vaccination records.
A growing number of companies, from Facebook to Google and Salesforce, have implemented employee vaccine mandates for the office amid the spread of the delta variant in recent weeks. Vaccine mandates aren't solely hitting office workers. Meat processor Tyson Foods, United Airlines, and state governments including New York and California are all requiring their workers to get inoculated.
Some companies are relying on apps that store health records but require humans to verify the details. Others are turning to software tools that provide other offerings, such as image recognition, contact tracing and the management of employee health records. Some tech companies are still simply asking employees to provide accurate information rather than wrestling with the messy world of disjointed health records and privacy laws.
"Frankly, it's a mess," said Margaret Rimmler, vice president of marketing at ReturnSafe, an Austin-based start-up that helps businesses manage their office safety protocols. "Everyone got their shot in a different place."
Google, which employs more than 144,000 people, has turned to membership-based health-care provider One Medical as one of the services it uses to verify the U.S. vaccination records of its contract workers and employees, according to an internal email obtained by The Washington Post. Workers are being asked to send proof of vaccination to One Medical via its app or web portal. Starting Aug. 9, Google began conducting "spot checks" to ensure that only vaccinated workers are on-site at Bay Area facilities — a policy expected to expand to other areas.
One Medical uses a team of human reviewers to manually review each vaccination card. The company said it has digitally integrated with "several" state vaccine databases, from which it can pull patient records.
Software tools offer companies various vaccine passports and verifier services to aid with verification. Some, like Excelsior Pass, which was developed by IBM and implemented in New York state, are public-private partnerships, while others are owned and run by private companies.
San Francisco-based start-up Superhuman recently paid for ReturnSafe to help verify the vaccination status of its workforce, which totals about 100 employees. After an employee uploads a vaccination card to the app, a human at ReturnSafe checks to make sure the record matches the employee, that the person had two doses of an approved vaccine, and that at least two weeks has passed since the last vaccination. The app notifies an employee's status within 24 hours to Superhuman's HR team.
"Having a fully vaccinated office is the safest way to have an open office," said Kristen Hayward, head of people at Superhuman.
ReturnSafe, which has about 70 clients including the NBA's San Antonio Spurs and the Telluride Ski Resort in Colorado, said demand has soared in the past couple of months as more companies seek one or several of the start-up's offerings. In addition to reviewing uploaded Centers for Disease Control and Prevention cards, ReturnSafe also offers self-attestation tools and has the ability to link to select health systems. It can also track coronavirus test results, contact-trace with devices or through employee testimony, and control badge access based on whether an employee meets all health requirements.
"Now CEOs of Fortune 500s are drawing a line in the sand and saying, 'This is our protocol,'" Jason Story, ReturnSafe's co-founder, said about vaccine mandates and testing. "It starts to get complex and unwieldy for HR to run the business."
Superhuman implemented its vaccine mandate for all of its employees who work from the office in June. Hayward said the company turned to ReturnSafe to help collect the sensitive data.
"It's best practice to separate employee health data from any of our other system of records to ensure it's stored securely and access is on a need-to-know basis," she said.
The Commons Project Foundation developed its own digital vaccine verification app, called the SMART Health Card Verifier. The app allows businesses to scan vaccine provider-issued QR codes and verifies that the dates are valid and the issuer is from a trusted provider. JP Pollak, co-founder and chief architect of the foundation, said that overall, verifying vaccinations is a complex process.
"Our health system is really fragmented," he said. "Pharmacies have their own systems, health systems, primary health-care providers — they all have their own systems."
Last year, Clear — known for its program that grants travelers expedited airport entry — debuted Health Pass, a mobile app that helps employers verify the vaccination status of their employees. The software can read and verify QR codes, double-check records from big vaccine providers like Walgreens or the Atlantic Health System, and uses image-recognition technology to validate uploaded pictures of CDC cards. The process is somewhat "imperfect," as a person could find a blank CDC card and claim it, said Catesby Perrin, Clear's executive vice president of growth. But Health Pass is expected to help mitigate any obvious forms of fraud, he added.
Perrin said interest in Health Pass has been rapidly growing in recent weeks, but declined to disclose details. More than 60 entities currently use Health Pass, including New York-based Union Square Hospitality Group and the state of Hawaii.
"The realization with the acceleration of the delta variant is that ... this complication isn't going away," Perrin said. COVID "is a true corporate risk."
Aiming to capitalize on privacy concerns, digital ID service Proxy created Proxy Health. The software gives employees a mobile digital health pass, which companies can scan with a tablet at a building's entrance. Companies can then deny access to employees who lack proof of vaccination or a negative coronavirus test. Because the app stores employees' health information on their respective phones, Proxy Health keeps the data out of the hands of employers. Simon Ratner, Proxy's co-founder and chief technology officer, said that what he hears the most from employers trying to figure out their return-to-work plans is confusion.
"They have to figure it out on their own," he said. "Most are not professionals in this field and ... most of them are honestly lost."
Some tech companies, such as Twitter, Pinterest and Lyft, are opting to trust the honor system, placing the onus on their workforce to provide valid vaccination records. If employees share either a QR code or a CDC card, they are being held accountable that the information provided is indeed theirs and that it's accurate.
Lyft said a dedicated team member will verify employees' name, type of vaccine, that they received the correct number of doses and dates. It does not plan to use any verification software.
"Since there's no standardized way to prove or disprove the validity of vaccination cards ... we're relying on the trust we have in our team members," said Ashley Adams, a spokeswoman for Lyft.
AT&T, which announced its mandate on Aug. 12, is requiring employees upload a copy of their vaccination card to enter one of its offices. The company said it will not review employees' cards "unless there is a concern" that the code of conduct has been violated.
New York-based Gather, which provides consulting services, said the company is requiring workers who want to go to the office to show their vaccine status via the New York state app Excelsior Pass or by providing their CDC card. Citing Gather's culture that is based on trust, Justin Tobin, founder and president, said the company doesn't plan to verify the validity of those records.
"Am I going to say [a fake] is impossible?" he said. "Of course not. Am I worried about it? No."
The honor system is tricky to manage. CNN recently fired three employees for turning up to the office unvaccinated. The policy also has implications for whether employees feel safe at work.
Though verification software may add another layer of reassurance for companies and their workers, it may not solve all of the problems associated with companies' return-to-work plans. The coronavirus has created a multitude of hurdles that may require companies to completely rethink how they manage information and health concerns.
For example, at Google, some workers are worried that they may not know if others in their proximity were exempt from getting vaccinated, said a member of Alphabet Workers Union, who spoke on the condition of anonymity. On top of that, Google hasn't been clear about what counts as an exemption, said the union member. Google declined to comment on the matter.
"If I had to choose between my loved ones and Google, that's an easy choice," said the union member, who has some personal health risks as well as at-risk family members. "Google will never be the one I pick."
