There's an app to help prove vax status, but experts say choose wisely

If you live in certain parts of the country, you're probably having to show proof of vaccination on a daily basis. Your card — or a photo of the card — will usually get you into your favorite restaurant.

But paper cards wear out and get lost, and some bigger events don't want to deal with the small print in a photo. The alternative is a proof-of-vaccination app. Still, not all apps are created equal.

Some are bare-bones — doing nothing more than displaying a photo of your CDC card, regardless of whether it's legitimate. Others, such as those offered by New York and Washington State, draw on vaccination registry databases and confirm your shots really happened.

So, which app should you choose?

"What I would say to anyone is, 'Do you trust the maker of that app, do you recognize it?' " says Dr. Brian Anderson, chief digital health physician at MITRE and a co-founder of VCI, a coalition of public and private groups that have created a voluntary standard for digital proof of vaccination.

"Sadly, we're in a situation where there's not federal regulation that protects consumers," Anderson says. "I would say that it creates the opportunity for, as an example, app makers that want to track you to be able to do that in a way that is not obvious to the consumer."

The diversity of apps is a problem for large venues

The federal government has kept its distance from the regulation of these apps, in part for fear of political blowback. "There will be no federal vaccinations database and no federal mandate requiring everyone to obtain a single vaccination credential," White House press secretary Jen Psaki said in April.

But the sheer diversity of apps is a problem for large venues, such as sports arenas, as they try to get thousands of people through the gates quickly. Many have embraced the CLEAR Health Pass, offered by the same company that sells shortcuts through airport security. It combines proof of vaccine and photo ID on one color-coded screen, designed to be checked at a glance.

"It works fantastic," says Eric Schossow, standing in line to get into a Seattle Kraken hockey game last Saturday night. "Generally speaking, it takes 20 seconds to get through the door."

"I don't think there's enough protection in the United States regarding facial recognition"

But others are taken aback by the fact that the app requires users to upload their photo IDs, and then pose for a facial-recognition selfie.

"I'm all for proving that you're vaccinated to get in," says John Howie, another fan waiting to get into the arena. He happens to work in the field of internet security. "[But] using an app where you have to upload very personal and sensitive information is a bit concerning to me. Using biometrics, especially, because I don't think there's enough protection in the United States regarding facial recognition."

Company-owned biometric databases are controversial, because of their potential to quickly and efficiently attach names to faces, online or on the street. Facebook — now Meta — recently announced it would delete the estimated billion or so faceprints that it's accumulated over the years.

CLEAR says it holds on to the data gathered from people who use their free app to get into events. The company hopes those people will stay on as customers, and buy its other identity-verification services. But it also says users can ask the company to delete their data, and it also promises not to sell or rent the data to other entities, though it reserves the right to share data with "service providers."

"Core to CLEAR'S values, as a company, are honoring member privacy," says senior vice president Rich Tucker. "We do that by empowering members, by giving them control over their information and by being transparent with how we use them."

No one should feel forced to use CLEAR

Alessandro Acquisti, a professor of information technology and public policy at Carnegie Mellon University, says people should ask themselves if giving up other personal data is a necessary part of proving vaccination.

"At least from a technological perspective, the answer is no," Acquisti says. "We know how to do that. We have nowadays protocols, which allow for certain data to be verified, and used, without compromising individual's identity."

State-sponsored apps such as California's ask for just enough information to find a user's vaccination record — name and date of birth, but no selfies or photo ID. The resulting QR code is little more than a digitally-verified, scannable version of the limited information on your paper vaccination card.

But to prove that card is really yours, you may also have to show a photo ID at the gate, which is why big events like CLEAR's all-in-one approach.

That convenience aside, no one should feel forced to use CLEAR, Tucker says.

"CLEAR is never mandatory, in any experience or opportunity. No one has to become a clear member. That would be completely contrary to our identity as a company that's entirely opt-in," Tucker says.

Most of the sports teams and events that partner with CLEAR say they encourage people to use the app, but they'll also allow other forms of proof. But occasionally, CLEAR is presented as a requirement.

"We just need to make sure every consumer can can get what they need"

In Seattle, some hockey fans complained they'd felt obligated to use CLEAR. After NPR made inquiries with county public health officials, they spoke to the team, which then stated more prominently on its website that other forms of proof were also acceptable. At the most recent game, gate attendants waved in people even if they showed just a photo of their CDC cards.

"We're still at a point where we need to be open and flexible about what we accept as proof of vaccination," says Mary Beth Kurilo, senior director of Health Informatics for the American Immunization Registry Association. She would like to see more of a federal effort to promote reliability and consistency among these apps.

But until that happens, she says flexibility is important.

"I think that does tie in with equity and access — fair access. We just need to make sure every consumer can can get what they need and that we're not cutting off services because someone doesn't have a mobile device or because they choose not to enter their information into an app."

As imperfect as paper vaccination cards are — easy as they are to reprint or modify — she says it's important to let people keep using them, at least for now.