Vaccine access hinged on open appointments nobody could see

The week

The week of January 18, 2021 opened with a new administration. President Biden was inaugurated on January 20. On January 21 the White House published a national strategy for the COVID-19 response, with goals for vaccination, federal support for vaccination sites and better data.

The same day, the President signed a set of executive orders on the pandemic. One directed agencies to improve how COVID-19 data was collected, shared and used. Another, Executive Order 13995, set up a COVID-19 Health Equity Task Force to advise on reaching the groups the pandemic had hit hardest. Data and equity were named as federal priorities in the same week that both were failing at the point of booking.

For millions of American families, though, the week is remembered less for politics than for a laptop open late at night, a browser refreshing over and over, and an elderly parent waiting by the phone. On the ground, the defining experience was the scramble for appointments.

The scramble had a clear origin. On January 12, the outgoing HHS leadership had urged states to open vaccination to people 65 and older and to younger people with certain conditions. Federal officials also said they would stop holding back second doses, because production was now predictable enough to supply them. Future allocations, they said, would reflect how quickly each state was giving shots and how many older residents it had.

Many states expanded eligibility around that time while supply remained tight. Then, on January 15, Oregon’s governor said the head of Operation Warp Speed had told her there was no federal reserve of doses to release, and that the larger shipments states expected would not arrive. Reporting at the time said the held-back doses had already been shipping since late December. Other governors gave similar accounts. Suddenly, far more people were allowed to get a vaccine than there were doses to give them.

What followed was a test of public services that few had planned for. Residents across the country reported scheduling websites that slowed or failed, phone lines they could not get through to, and appointments that vanished within minutes of being posted. For many people, getting a shot came down to persistence, luck and who had time to keep trying.

The tools varied widely. In Florida, several county health departments booked residents 65 and older through Eventbrite, a commercial ticketing site, and slots filled within minutes. Collier County warned residents about fake listings on the same platform and pointed them to its official link. Underneath, the CDC had offered states a free scheduling tool, the Vaccine Administration Management System. By the end of the month, reporting described cancelled appointments and staff lockouts, and said only a handful of states were using it.

Into the gap stepped ordinary citizens. In California, a volunteer project called VaccinateCA went live on January 14. Its volunteers phoned hospitals and pharmacies every day to ask who had doses, who qualified and how to book, and posted the answers. Similar efforts appeared in other states. Their work was a sign of both civic generosity and a missing piece of public infrastructure.

The following week, on January 26, the new administration said weekly supply to states would rise to about 10 million doses for the next three weeks. It also said states would get a three-week forecast of supply instead of one week. That detail mattered as much as the volume. A state cannot promise appointments it cannot see coming.

The obvious explanation at the time was that government websites simply buckled under the traffic. That was part of the story. The deeper reasons had less to do with servers than with who owned which pieces of information, and they apply to any organization that has to share something scarce with the public.

The easy reading of January 2021 is that government websites could not handle the load. Some could not. A site that stays up still fails a resident, though, if it cannot say truthfully where a dose is and whether that resident may have it. Supply was the binding constraint, and no software could have created doses. What software and governance could do was distribute scarce appointments clearly and fairly.

That depended on three layers, usually owned by different people: eligibility, inventory and channel. Eligibility is who is allowed. Inventory is what is available, and where. Channel is how a person reaches it: a website, a phone line, a community worker. Each failed in its own way, and fixing one did little for the others.

The pattern reaches beyond public health. Any organization that allocates something scarce through partners, whether hospital beds, disaster relief grants, school places or a popular product launch, faces the same three layers. The vaccine rollout simply made them visible under extreme pressure.

The analysis runs in seven parts. It starts with the systems underneath, which most residents never saw. It then takes the three layers in turn: eligibility, inventory and channel. After that comes how the layers could have been set up in advance. Then come the same pattern in clinics, relief programs and claims, and what separates programs that share scarce supply well from those that falter. A short set of questions closes.

Registries, ledgers and feeds

Most of the systems involved were invisible to the public. Each was built for a different question, on a different clock, and usually by a different owner.

Four kinds of system

An immunization registry is a state database that records vaccinations given. It is a record of what has already happened: who received which vaccine, when and where. It is useful for public health tracking but says nothing about tomorrow’s open appointments.

Providers in the federal program signed an agreement with the CDC. Among other things, it required them to report each dose to the state, local or territorial public health authority within 24 hours of giving it. Even under that rule, the registry ran a day behind the booking calendar, and booking ran in seconds.

An allocation system tracks how many doses are planned for and shipped to which sites. At the federal level, HHS used a platform called Tiberius, built by Palantir, to work out each jurisdiction’s share. States placed orders through the CDC’s VTrckS ordering system and divided their share among enrolled providers. An allocation system tells the state that a pharmacy received a shipment, but not how many of those doses are already promised to people with appointments.

A scheduling system is the booking tool a site uses: the calendar that shows open slots and lets a resident claim one. Hospitals, pharmacy chains, county health departments and community health centers each had their own, often from different vendors. Some states used commercial clinic tools. Hospitals often used the scheduling module of their electronic health record. Pharmacy chains used their own retail systems. Some counties improvised with event-ticketing sites.

A call center platform is the fourth system, and the most often forgotten. It holds the scripts agents read, the queue callers wait in and, ideally, a screen where an agent can book. In early 2021 many of these were stood up in days, sometimes by contractors, and often had no booking screen of their own.

Three terms that matter

Machine-readable data is information published in a predictable format that other computer systems can read automatically, rather than as a web page meant only for human eyes. A train timetable printed on a poster is human-readable; the same timetable published as a data feed, which a maps app can pull in, is machine-readable.

A data feed is a regular, automatic publication of that kind of data, refreshed often.

Self-attestation means asking people to confirm for themselves that they qualify, rather than requiring documents. It is how most online forms work when checking would be impractical.

Why the systems could not answer the public’s question

A resident asked one question: where can I get a shot this week. Answering it needed a join across all four systems. Eligibility came from the state’s rules. Doses on hand came from allocation. Open slots came from dozens of scheduling tools. Help for those who could not book online came from the call center.

No system held the join. The registry was authoritative about the past, the allocation system about shipments, each scheduler about its own calendar. Each owner could truthfully say its system worked, and the resident still had no answer. Most of what follows is about who should have owned that join and what it would have taken.

The clocks made it worse. Allocation moved weekly, and until late January states saw only one week ahead. Registries moved daily. Booking moved by the second. A state that tried to infer open capacity from shipments and administered doses was always working from stale numbers, and second-dose bookings it could not see distorted the estimate further.

Eligibility: rules changed faster than systems

Eligibility rules in early 2021 were set by states, sometimes refined by counties, and changed often. Age thresholds dropped, occupational groups were added, and qualifying conditions were defined and redefined. Each change had to reach every scheduling system, every provider and every call center script.

Most systems relied on self-attestation, which was sensible given the alternatives. Asking every resident to upload proof of a medical condition would have slowed the process, excluded people without easy access to records and burdened providers. But rules differed between neighboring jurisdictions, and changes reached channels at different times. A resident could be told one thing by a county website, another by a pharmacy site and a third by a call center agent reading last week’s script. Providers were left to decide at the door whether to turn people away.

Take a 66-year-old resident of a typical county. On Monday the state announces that people 65 and older are eligible. The county website still lists the old threshold until Wednesday. A pharmacy chain updates its booking site on Tuesday. The state hotline script is revised on Thursday. For three days, the answer to “Can I get a vaccine?” depends on which door she knocks on. Nothing about the policy was unclear. The problem was that the policy existed in many copies, each updated separately by hand.

Why the copies drifted

Each copy had its own owner and its own release process. A county web team published on its own schedule. A pharmacy chain changed its booking logic through a national IT release, often for many states at once. A call center contractor revised scripts after a supervisor approved them. A hospital changed its patient portal questionnaire through its electronic health record team.

These owners were not careless. Each simply learned about the change from a press conference or a press release, then interpreted it. Interpretation is where drift begins. “Adults with high-risk conditions” has to become a list of conditions. Someone must decide whether a condition in remission counts and whether a caregiver qualifies with the patient. Without one published answer, each owner wrote its own.

Rules as data, in operation

Eligibility rules are policy expressed as data. Treating them that way means three practices:

• One authoritative version. A single published table of eligible groups, with an effective date and time for each change.
• Simultaneous publication. Websites, call scripts, provider guidance and partner systems all take changes from that table, so they change together.
• Plain-language text generated from the same source, so the explanation a resident reads cannot drift from the rule a provider applies.

Behind those three practices sit a few operational details. Each eligible group needs a stable identifier, so a partner system can refer to “group 4b” rather than parsing a sentence. Each change needs a version number and a change log. Partners should acknowledge each new version, so the program knows who has applied it and who has not.

The most useful single measure is the lag between an announcement and the moment every channel applies the new rule. In January 2021 that lag was often several days and nobody measured it. A program that tracks it can see which partner is late and fix the cause.

The fix needs no advanced technology, only someone who owns the rule as data, and a habit of announcing changes with a lead time partners can meet. That second habit is political as much as technical. Elected officials want to announce expansions immediately. A two-day lead time can look like delay. Defending it requires showing that the alternative is three days of contradictory answers.

The cost of self-attestation, and the alternative

Self-attestation had a cost. Some people booked who did not yet qualify, and reports of out-of-area residents taking slots in other counties circulated widely. Providers at the door faced a choice between checking documents and turning away people who were probably honest, or waving everyone through.

The alternative, verification, has its own cost, and it falls on the people the program most wants to reach. Older adults, people without a regular doctor and people with limited English are the least likely to have documents ready. A program can reduce leakage without heavy verification. It can tie set-aside slots to registration lists rather than open links. It can check identity once at the door, without asking for medical proof. It can also publish the rule clearly enough that honest people do not book by mistake.

Simplicity as a design choice

The strongest counter-argument to all of this is that the rules themselves were too complicated. Some public health experts argued at the time for age-only eligibility, which is easy to state and easy to check at the door. That view has merit. Every extra category multiplies the copies that can drift and the judgments a provider must make.

The rules-as-data approach does not settle that debate, but it makes the trade-off visible. When each new category has a measurable cost in lag, partner effort and confusion, policy makers can weigh it against the benefit of more precise targeting. In January 2021 those costs were real but invisible to the people setting the rules.

Inventory: appointments lived in other people’s systems

Doses went to hospitals, pharmacies, health departments and community health centers. Each scheduled appointments in its own tool. A resident looking for an appointment had to search many of them, often repeatedly, because there was no shared, current view of open slots.

This was the core failure, and it was structural. State health agencies knew where doses had been shipped, through allocation systems and immunization registries. They did not know which appointments were open at any moment. That information lived in scheduling systems the state did not control and had not required partners to share.

The state was like an airline that knows how many planes it has sent to each airport. It cannot see which seats are still for sale, because each airport runs its own booking desk. Residents, like the traveler in that case, had to call every airport.

Volunteer aggregators filled the gap by checking provider sites one by one, or by phoning them. Their popularity showed how much demand there was for a unified view. Their methods also showed its cost: hundreds of volunteers doing by hand, every day, what a reporting obligation could have done automatically.

Why shipments were the wrong measure

Reporting doses received is not enough, because it says nothing about whether a resident can book. A site with doses on its shelf may have already promised every one of them. A site with no doses this week may be booking next week against an expected delivery.

Doses administered is no better as a signal of access. It measures throughput, which is what states were being ranked on publicly in January 2021. A state could raise throughput by serving whoever could book fastest. That reward structure pushed in the opposite direction from equity, and it was built into the allocation formula announced on January 12.

What a capacity feed contains

The fix is contractual as much as technical. A program that distributes a scarce resource through partners can make capacity reporting a condition of participation. Partners publish open slots in a standard machine-readable form, refreshed often. The state then builds a single locator, or lets others build on the feed.

A workable feed is small. For each location it needs an identifier, an address and the hours. For each slot or block of slots it needs a date and time, the product offered and whether it is a first or second dose. It also needs any eligibility restriction and a link straight to booking. Every record needs a timestamp, so a consumer can tell fresh data from stale.

An open format for exactly this, SMART Scheduling Links, was published in 2021 by health IT standards developers. It used the FHIR standard and was later taken up by HL7. Epic documented support for it that year. Uptake among providers was patchy, and many aggregators kept relying on scraping and provider-specific connections. A standard alone does not create a feed. An obligation does.

Freshness and phantom slots

A feed that is minutes old can still show slots that have just gone. In early 2021, residents often clicked through to a provider only to find nothing left. Two design choices reduce this. The feed should refresh often enough to match the speed of booking. The locator should show how old each record is, and drop records past a threshold.

There is also the opposite problem: capacity that exists but is never shown. Doses left over at closing time from an opened vial went to whoever was nearby. Programs that kept a standby list could fill those slots. Those that did not left them to chance.

Second doses

Second doses complicated the picture. Both vaccines then available needed a second dose weeks later, and those appointments drew on the same future supply. Systems that booked the second dose at the first visit protected people already in the queue, but made open capacity for newcomers harder to estimate. A shared inventory view needs to show both. That means separate counts for first-dose and second-dose capacity, and a forecast of second-dose demand built from first doses already given.

The January episode over held-back doses showed why this matters. Officials and governors disagreed in public about whether a reserve existed. Neither side could point to a shared ledger of promised second doses. A capacity feed that separates first and second doses does that job as a side effect.

Partners and the cost of reporting

The trade-offs are real. Partners resist new reporting duties during a crisis, and smaller sites may lack the systems to comply. A program can offer a simple shared scheduling tool to sites without their own, and accept a manual feed from those that cannot integrate. Imperfect coverage still beats a resident checking twenty sites at midnight.

Partners differ in what they can do. A national pharmacy chain has an engineering team and can publish a feed from its booking system, but it will want one format for every state. A hospital can usually publish through its electronic health record vendor if the vendor supports the format. A federally qualified health center may have neither the staff nor the budget, and needs the shared tool. A rural county health department may be running clinics from a spreadsheet.

The design that works for all of them has one format, several ways to comply, and a clear minimum. It also has a named owner at the state who chases missing feeds. The program has a lever too. A program that controls allocation can make the next shipment depend on reporting. In January 2021 few states tied the two together.

The CDC’s own scheduling tool showed the limits of the other route, which is a single mandated system. Many states judged it a poor fit for their workflows and kept their own tools. A shared format with many compliant tools is easier to adopt than one tool for everyone.

Channel: the people most at risk were least online

The first broad eligibility group was older adults. They were also the group least likely to refresh a website at midnight or work through several provider portals. Phone lines were overwhelmed. Appointments went disproportionately to people with fast internet, flexible time and help from digitally capable relatives.

That outcome was not anyone’s intention. It was the natural result of a design in which the website was the main door and everything else was a side entrance. When appointments are released online and claimed in seconds, the fastest people win, whether or not they are the most at risk.

Many jurisdictions responded with call centers, outreach through community organizations and faith groups, set-aside appointments for specific neighborhoods and walk-up clinics. These worked, but most were added after the online channel had already shaped who got early access.

What a call center needs

A digital-first channel is fair only if assisted channels are designed with it and draw from the same inventory. A call center agent who sees only the same failing website as the caller adds little. Agents need their own booking access to the shared inventory, protected capacity, and authority to book on a resident’s behalf. Designs that allocate a share of each day’s appointments to phone and community channels before they open online stop the fastest connections from taking everything.

The rest of the call center is ordinary operations, done deliberately. Scripts come from the rules table, so agents and the website say the same thing. A callback queue replaces the busy signal, so a caller who cannot get through is called back rather than giving up. Language lines and a TTY service are there from the first day. Staffing is planned against expected call volume for each eligibility change, with surge capacity agreed in the contract.

The measures are just as ordinary: abandoned calls, time to a booked appointment, and the share of bookings made by phone. The share of each age group that booked through each channel is the most revealing. If people over 75 are booking mostly through relatives online, the phone channel is not doing its job.

Booking on someone else’s behalf

Much of the online booking for older adults was done by children, grandchildren and neighbors. That was a lifeline, and an unmanaged one. Booking forms asked for the patient’s details but rarely recorded who was booking. Confirmation messages went to the helper’s email or phone, not the patient’s. Changes and cancellations then depended on the helper.

Programs that expect proxy booking can design for it. They can record a contact for the patient as well as the helper, send confirmations to both, and give call center agents the same proxy powers. Health systems already manage proxy access to patient portals under their privacy policies. A public program can borrow the pattern without building a full identity system.

From speed to priority

The mechanism matters as much as the channel. First-come booking rewards speed. A registration list that offers appointments in order of priority, by text or phone, shifts the work from the resident to the system. Several jurisdictions moved to that model as the rollout matured.

Return to the 66-year-old. Under first-come booking, she or a relative has to be online at the moment slots appear, every day, until they succeed. Under a registration list, she signs up once, by phone or online, and waits to be contacted with an appointment when her turn comes. The scarcity is identical. The burden, and the fairness, are very different.

Registration lists have costs of their own. People sign up on several lists and accept the first offer, leaving others to chase no-shows. Offers sent by text can go unanswered. A list needs a time limit on each offer, a rule for people on multiple lists, and a fallback for those who do not respond. Even with those costs, the work of finding an appointment moves from the resident to the program.

Set-asides and their leaks

Set-aside appointments for specific neighborhoods were among the most effective equity tools, and among the easiest to misuse. When a reserved booking link or code was shared beyond its intended community, the people it was meant for lost their slots to faster outsiders. Tying set-asides to a list, a community partner who books on residents’ behalf, or an address check at booking keeps them where they were meant to go.

Setting up the three layers in advance

Suppose a state had set up the three layers before a scarce resource was released. Nothing here depends on new inventions; each step uses ordinary tools.

The rules table. A small policy team in the state health agency owns a single table. Each row is an eligible group: “adults 65 and older,” “teachers and school staff,” “adults with listed conditions.” Each row has an effective date and time. When the governor announces a change, the team adds a row with a start time two days ahead. The state website, the hotline script, the provider guidance and the partner booking systems all read from the table. The plain-language explanation on the website is produced from the same row, so the words a resident reads match the rule a pharmacist applies.

The capacity feed. Every site that receives doses signs an agreement that includes a simple obligation: publish open appointment slots, by location and date, in a standard format, refreshed at least every few minutes. Large pharmacy chains connect their booking systems directly. A rural clinic without its own scheduling tool uses a free shared tool the state provides, which publishes to the feed automatically. A handful of very small sites email a spreadsheet twice a day, which staff load by hand. The coverage is not perfect, and the state says so on its locator.

The locator. The state builds one public page that shows open slots near a resident’s address. Because the feed is open, volunteer groups, local news sites and community organizations can build their own versions too, reaching people where they already are.

The assisted channels. Each morning, before slots open online, a share of the day’s capacity is set aside for the hotline and for community partners such as senior centers and faith groups. Hotline agents use a booking screen that draws on the same feed, and can book on a caller’s behalf. A resident who signs up on the registration list by phone is contacted when an appointment matching her eligibility opens.

The test. Before launch, the team runs a rehearsal: simulated demand on the website, a surge of calls to the hotline, and a rule change pushed through the table, to check that every channel updates together.

Owners and sequence

Each layer needs one accountable owner. The rules table belongs with the policy team, not the web team, because it is policy. The capacity feed belongs with whoever manages provider agreements, because compliance is enforced through those agreements. The locator and the call center belong with the team responsible for the public experience, which in many states is a digital service team or the communications office.

The sequence matters. The rules table and the feed format come first, because partners need weeks to build to them. Provider agreements come next, with the reporting duty written in. The shared scheduling tool for small sites follows, then the locator, then the call center build and training. The rehearsal comes last, with enough time to fix what it finds.

What it costs and what it breaks

The cost is mostly staff time and contract changes, not technology. A rules table can be a spreadsheet with discipline around it. A feed format can be adopted rather than invented. The shared scheduling tool is the largest purchase, and many states already had one through their immunization program or could license one.

Open feeds have a known downside. Bots can watch them and alert their users the moment slots appear, which again rewards the fastest. Alerts are mostly helpful, because they spread information. Automated booking is the risk. A program can keep the feed open while protecting the booking step with rate limits and a short delay. It can also check that one person is not booking many slots.

Differences by level of government

The design shifts with the structure of public health in each state. In states where the state health department runs local public health directly, one agency can own all three layers. In states with strong county health departments, the state owns the rules table and the feed format, and counties run their own clinics, locators and phone lines. That works if counties consume the same table and publish to the same feed. Large cities often run their own programs alongside the state, and need the same agreement.

Tribal nations could receive vaccine through their state or through the Indian Health Service, and many ran their own rollouts. A state locator that leaves them out gives an incomplete picture. Including them means agreement with each nation, on its terms.

Each of these steps is modest. Together they turn a scramble into a queue. The difference lies less in technology budgets than in ownership decided in advance. Someone owns the rules, someone requires capacity reports, and someone protects the channels that less connected people rely on.

Clinics, relief programs and claims

In government, the rollout showed that public trust can be won or lost in the booking experience as much as in the policy. A good policy delivered through a confusing, unfair process is experienced by the public as a bad policy.

In health care and financial services, the same three layers appear whenever demand outstrips supply. A health system opening a new clinic, a bank launching a small business relief program and an insurer handling disaster claims all face the same questions. Who qualifies, what is available, and through which channels can people reach it. If the rules live in several copies, if capacity is held in partners’ systems the organization cannot see, and if phone help is an afterthought, the result looks a lot like January 2021.

Health systems

Many health systems vaccinated their own patients first and invited them through patient portals. That was efficient, because the health system already knew who was eligible from its own records. It also meant that patients without portal accounts, or without a regular doctor in the system, were reached last. The channel layer had been decided by the portal enrollment rate.

The same three layers apply to any scarce clinical capacity: a new specialty clinic, infusion chairs, a limited supply of a new drug. A health system that publishes its criteria once, can see open capacity across its sites, and gives its call center the same booking powers as its portal will allocate more fairly. An ambulatory network whose sites run different scheduling systems faces the inventory problem in miniature.

Banks and credit unions

The Paycheck Protection Program reopened in the same month. On January 11, 2021, the SBA opened its portal first to community financial institutions, such as community development financial institutions and minority depository institutions. Other lenders followed over the next few days. The SBA’s stated aim was to reach smaller and underserved borrowers before the program opened to everyone. That is a channel set-aside, applied to credit.

For a bank or credit union running a relief program, the layers translate directly. Eligibility is the program’s criteria, which change as guidance changes and must reach the online application, the branch and the contact center together. Inventory is the lender’s own capacity to process applications. Channel is the difference between a borrower with a relationship manager and one who only has the website. Lenders that served existing customers first in 2020 made a channel choice, whether or not they framed it that way.

Insurers and agencies after disasters

An insurer handling claims after a hurricane, or an agency taking disaster assistance applications, faces the same structure. Coverage rules and program criteria are the eligibility layer. Adjusters and inspection slots are inventory, often held by contracted firms whose schedules the insurer cannot see. Phone, app, agent and in-person centers are channels. Policyholders and applicants who are older, displaced or without power are least able to use the app.

The costs are concrete. Staff answer the same question many times because the official answer is inconsistent. Partners waste capacity when appointments go unfilled because nobody could find them. Regulators and legislators ask why the most vulnerable were served last. And reputations are shaped by stories of people who tried and failed to get help.

Programs that share scarce supply well

Programs that distribute something scarce well tend to share these features.

• Eligibility lives in one versioned table with effective times, and every channel reads from it.
• Partners report open capacity, as well as supply received, as a condition of taking part.
• There is one place, run by the program or built by others on its feed, where people can see what is available.
• Phone and community channels have their own booking access and capacity reserved before anything opens online.
• Where supply is very tight, people register once and are offered appointments in priority order.
• The whole resident journey is tested under load, including the phone lines, before launch.

The programs that falter do the reverse.

• Announcing eligibility changes before partners and call centers can apply them.
• Measuring success by doses shipped rather than by whether residents could book.
• Testing whether the web servers stay up but never whether a person can complete a booking.
• Treating call centers as overflow, staffed with people who can see only the public website.
• Releasing all capacity online at once and letting speed decide who gets it.

The evidence a reviewer would ask for

Inspectors general, legislative auditors and, for banks, examiners tend to ask the same things after a scarce-resource program. They want the rules in force on each date and when each channel applied them. They want proof of what partners were required to report and whether they did. They want to know who got access, broken down by the groups the program meant to reach. They also want to know what the program did when the numbers showed a gap.

A program built on the three layers produces that evidence as a by-product. The rules table holds the change log. The feed holds the capacity history. The booking records, tagged by channel, show who was served through which door. A program without them reconstructs the story from emails and press releases.

The case for central systems, and against

The strongest objection to this whole argument comes from the rollout itself. The CDC’s central scheduling tool was widely rejected. Massachusetts saw its own booking site fail in February when a new eligibility group opened. Central systems create single points of failure, and decentralization gave the rollout some resilience. Volunteers proved that outsiders could build useful tools on whatever data was available.

That objection is right about central software and wrong about central obligations. The case here is for one rules table, one feed format and one reporting duty, with many tools free to implement them. The volunteers’ success supports it. They built useful locators from scraped and phoned-in data. They would have built better ones, faster and with fewer people, from an official feed.

Who qualifies, what is open, how people reach it

1. When our eligibility rules change, how many places have to be updated, and how many by hand?
2. Can we see, right now, how much capacity is open across all our partners, and if not, what would it take to require it?
3. What can a call center agent see and do that a caller cannot do alone online?
4. How much capacity do we hold back for phone and community channels before anything opens online?
5. Have we tested the whole journey, including phones, under realistic demand, or only the website?

Answering them requires no technical expertise, and every one of them would have changed what residents experienced in January 2021.

Each question also has a natural owner. The first belongs to whoever writes policy. The second belongs to whoever manages partner agreements. The third and fourth belong to whoever runs the public experience. The fifth belongs to the program director, because only the director can give the rehearsal a date and hold the launch until it passes.

With hindsight

Supply rose sharply in the spring of 2021. On March 11 the President directed states to make all adults eligible by May 1, and in April he moved the date to April 19. Many of the access problems eased as scarcity ended. When there are enough doses for everyone, the questions of who is eligible, where slots are open and who gets there first lose most of their sting.

Several of the fixes described here were adopted during the rollout, under pressure. Massachusetts is the clearest case. On February 18, when residents 65 and older and people with two or more qualifying conditions became eligible, the state’s booking site went down for hours. Its scheduling vendor took responsibility. On March 12 the state launched a preregistration system for its mass vaccination sites, with other providers to follow. Residents signed up once and were contacted when an appointment was available.

The federal government added channels and a front door. The Federal Retail Pharmacy Program, which supplied pharmacies directly, began on February 11, which helped supply but added more booking systems the states did not run. On February 24 the CDC launched a COVID-19 version of VaccineFinder. On May 1 it was relaunched as vaccines.gov, with a Spanish version at vacunas.gov, a text service and a national phone hotline.

Its accuracy depended on providers reporting stock. That caveat is the inventory problem in miniature: a single front door is only as good as the data partners send to it. A locator that shows slots that are already gone can frustrate people almost as much as having no locator at all.

The volunteer aggregators wound down as scarcity ended. A national sister project of VaccinateCA, Vaccinate The States, announced it was winding down in July 2021. The CDC’s own scheduling tool never became the national system it was meant to be; most states kept their own tools. The open scheduling format published that year moved into HL7, where work began to broaden it toward general appointment scheduling. It did not become the default way providers published capacity.

The rollout became a reference case for public digital service design. The parts that held up were often improvised: community partnerships, phone banks, registration lists and the national locator. The parts that failed were the assumptions that a state website could stand alone and that eligibility could be managed as a series of web page edits.

Federal policy moved in two directions afterwards. In December 2021, Executive Order 14058 directed agencies to improve customer experience and service delivery. In September 2023, OMB memo M-23-22 set requirements for digital-first public services. Then, on January 20, 2025, the new administration rescinded Executive Order 13995, the equity order signed in the week this article covers. The same day, the US Digital Service was renamed the US DOGE Service. In May 2025 the administration terminated grants under the Digital Equity Act, which had funded state digital inclusion plans, and litigation followed.

The public health emergency ended on May 11, 2023, and COVID-19 vaccines moved to the commercial market later that year. The plumbing built for the emergency was largely retired with it.

By 2026, publishing policy as data, requiring capacity feeds from delivery partners and designing assisted channels from the start appear routinely in agency digital strategies. Whether they are funded and tested before the next surge is still a question each agency must answer. With federal support for digital inclusion reduced, more of that work now falls on states, counties and their partners. Strategy documents are a start; a rehearsal under realistic demand is the real test.

In any sector, a crisis rarely gives time to build the plumbing. The rules table, the partner capacity feed and the protected phone channel are cheap to set up in calm times and very hard to improvise when demand arrives all at once. The organizations that will look good in the next surge are the ones deciding now who owns each of those pieces.