Who may see the vaccination record: the negotiation behind the rollout

The week

On November 9, 2020, Pfizer and BioNTech announced an interim analysis of their Phase 3 trial, the large final stage of testing in people. It showed their COVID-19 vaccine to be more than 90 percent effective. Moderna reported strong interim results for its own vaccine a week later. After months of uncertainty, two vaccines looked set to arrive.

Events moved quickly from there. On November 16 Moderna reported an efficacy estimate of 94.5 percent from its own interim analysis, for a vaccine that could be stored at ordinary freezer temperatures. On November 18 Pfizer and BioNTech reported a final efficacy analysis of 95 percent, and on November 20 they asked the Food and Drug Administration for emergency use authorization. The same week as the first announcement, the incoming administration named a COVID-19 advisory board, adding a presidential transition to the planning picture.

For most of 2020, the question had been whether a vaccine would work at all. Almost overnight a new one took its place: how to get hundreds of millions of doses to the right people, and keep track of who had had one.

The announcements turned attention to distribution. The Pfizer vaccine required ultra-cold storage, around minus 70 degrees Celsius, far below ordinary freezer temperatures. That meant special freezers, dry ice and careful handling at every step from factory to clinic. Pictures of those freezers quickly became the visual shorthand for the challenge ahead.

Behind the scenes, a less photogenic effort was already under way. Through the federal program known as Operation Warp Speed, the Department of Health and Human Services and the Centers for Disease Control and Prevention were preparing systems. Those systems would decide how doses were allocated and track them once given.

The groundwork had been laid in the weeks before. In mid-September CDC had published an interim playbook for the jurisdictions that would run vaccination, asking each to submit a draft plan by mid-October, and it updated the playbook at the end of October. Those jurisdictions numbered 64: the states, several large cities with their own health departments, and the territories and freely associated states. In October federal officials had also announced a partnership with large pharmacy chains to vaccinate residents and staff of long-term care facilities.

The plans described a chain of systems. Jurisdictions would order doses through CDC’s existing vaccine ordering system. Providers would sign a federal agreement that, among other things, required them to report each dose to their jurisdiction promptly. Federal tools were on offer to fill gaps: an HHS platform for allocation planning, known as Tiberius, and a CDC-sponsored system for scheduling and recording vaccinations at clinics without their own software, the Vaccine Administration Management System.

That tracking depended on records held by the jurisdictions, which run their own immunization registries. A registry is a database of who has received which vaccine, when and where. CDC was asking those jurisdictions to sign data use agreements covering vaccination records. A data use agreement is a contract that sets out what data will be shared, for what purposes, who may see it and how it must be protected.

Those agreements quickly became contentious. The data CDC sought included names, birth dates, addresses, race and ethnicity of people vaccinated. In the weeks that followed, some states, including New York and Minnesota, publicly questioned how much identifiable information, meaning details that could point to a specific person, they should send to the federal government.

The objections came from different angles. New York’s governor argued the requirement could deter undocumented immigrants from getting vaccinated. Minnesota said it would send only de-identified data on doses given, without names, addresses, race or ethnicity. Federal officials said the information would not be shared with other agencies, and that it was needed to track second doses, monitor safety and measure how well the vaccines worked across populations. HHS also said the collection was consistent with HIPAA, which permits providers to disclose health information to public health authorities for disease control.

It was an early sign that the hardest part of the rollout might be the information chain that ran alongside the cold chain.

Freezers drew the headlines in November 2020. Ultra-cold storage was a real constraint, but one with known solutions and a supply market: you could buy, rent or borrow the equipment, and logistics companies knew how to move cold goods.

The constraint that proved harder for public agencies was data: who has been vaccinated, who needs a second dose, whether supply is reaching the places it is needed, and who is allowed to know each of those things. The data problem divides into three parts that any multi-party program faces: matching people across systems, agreeing the terms of sharing, and onboarding the sources that feed the record. All three matter well beyond public health.

The sections below first describe how the record was assembled, then take the three parts in order. They then follow the problem into a county operations room and into banking and benefits programs. The last two sections describe the practices that held up and the tests any program built on other people’s records should pass.

Millions of small records, one national picture

Every dose given in a campaign creates a small record: who received it, which product, which dose in the series, where, when and by whom. On its own, each record is simple. The value comes from joining millions of them together. A health department can then answer questions such as how many people in a county are fully vaccinated, who is overdue for a second dose, and whether some neighborhoods are being missed.

Those records were created in many places by many organizations, each using its own software. They then flowed to state and local immunization registries, the long-standing public health databases that track vaccinations, and from there, in some form, to federal agencies.

What each record held

CDC specified a common set of data elements for vaccination reporting. They fell into three groups. The first described the person: name, date of birth, sex, address, race and ethnicity. The second described the dose: the product, the manufacturer’s lot number, the dose number in the series and the date given. The third described where it happened: the administering provider, the site and the type of location, such as a pharmacy or a mass clinic.

Each group served a different purpose. The person fields made matching and equity analysis possible. The dose fields supported second-dose tracking and safety monitoring, since a lot number lets investigators trace a cluster of adverse events back to a batch. The site fields showed where supply was going and how fast it was used. A record missing any group weakened one of those purposes, even if the dose itself was counted.

The path a record took

A typical dose record passed through several hands. A clinic or pharmacy recorded the vaccination in its own system, using standard codes for the vaccine product and the manufacturer’s lot number. The system sent an electronic message to the jurisdiction’s registry, usually in an established health data messaging format that registries had used for childhood vaccines for years. The registry checked and stored the record, then sent a version onward to CDC.

Not every record followed that route. Large pharmacy partners often reported through their own national connections. Federal entities, such as the military health system and the Veterans Health Administration, reported to CDC directly. Clinics using the federal scheduling tool sent records through that tool. CDC’s national picture was therefore assembled from several streams that did not always line up.

The records had to pass cleanly from clinic to registry to federal level, without being dropped, duplicated or mislabeled, at a pace no one had attempted before. Each handoff is a place where things can go wrong, and each depends on the three capabilities below.

Registries built for children

Immunization registries were designed mainly around childhood vaccination, where a pediatric practice reports routine shots over years and the registry helps schools and parents check records. Adult coverage was thinner. State laws on registries also varied, including on whether adults had to consent before their records were kept. A system designed for steady pediatric reporting was suddenly asked to take in adult records at mass-campaign speed.

Matching people across systems

A two-dose vaccine creates a simple-sounding requirement: link the second dose to the first. People received doses at different sites, sometimes in different counties or states. Names, dates of birth and addresses were recorded inconsistently, by staff working fast at mass clinics.

Take a woman who receives her first dose at a county fairground. A volunteer types only the first half of her hyphenated surname and enters her date of birth with the day and month reversed. Three weeks later she gets her second dose at a pharmacy near her office, which records her full surname and her work address. To a computer, these may look like two different people, each with one dose. She is fully vaccinated. The registry may say otherwise, and she may receive a reminder she does not need, while the county’s coverage figures undercount without anyone noticing.

State immunization registries had long handled duplicate and fragmented records for childhood vaccines, on a timeline where errors could be cleaned up over months. A mass adult campaign compressed that to weeks. Matching errors meant reminders not sent, people shown as partly vaccinated when they were not, and allocation decisions based on undercounts.

Why there is no shared identifier

The root cause is structural. The United States has no national patient identifier, a single number that follows each person across every health system. HIPAA in 1996 called for a unique health identifier, but Congress has since used annual spending bills to bar HHS from adopting one, citing privacy concerns. So every registry relies on probabilistic matching of demographic fields: software compares names, dates of birth, addresses and other details, and scores how likely two records are to belong to the same person. A high score is treated as a match, a low score as different people, and the scores in between need a human to decide.

How matching works, step by step

A registry typically follows four steps when a new record arrives.

1. Standardize. The software cleans the incoming record: converting names to a consistent format, splitting addresses into street, city and postal code, and checking that the date of birth is a real date.
2. Find candidates. It searches for existing records that might be the same person, usually by looking for shared details such as the same birth date and a similar surname.
3. Score. For each candidate, it adds up the evidence. A matching date of birth counts for a lot; a matching common surname counts for less; a different phone number counts against.
4. Decide. Above one threshold the records are merged automatically. Below another they are kept separate. In between, the pair goes to a queue for a person to review.

Every threshold is a trade-off. Set it too loose and two different people with similar details get merged, which is a privacy problem as well as a data problem. Set it too strict and one person stays split across several records. During a mass campaign, the review queue grows faster than staff can clear it unless someone has planned and paid for the people to work it.

Errors in both directions

Matching failures can overcount as well as undercount. A person split across two records can be counted as two people with first doses, inflating the number who have started vaccination. Later, when boosters arrived, a booster recorded as a first dose produced the same effect. Over-merging hides people instead. Twins with similar names, or a parent and child sharing a name and address, can be collapsed into one record, so one of them appears unvaccinated.

Crossing jurisdiction lines added another layer. A resident of one state vaccinated in a neighboring state appears first in the other state’s registry. Registries built connections to exchange such records, but matching across registries repeats every problem above with less shared context. Large metropolitan areas that span state lines saw this most.

Staffing the review queue

Manual review is skilled work. A reviewer looks at two records, weighs the evidence and decides whether to merge, often with limited information and no way to contact the person. A wrong merge is hard to undo, because later records attach to the merged identity. Registries that coped best trained temporary staff on clear written rules, kept a senior reviewer for hard cases, and logged every decision so it could be reversed if needed. Those that did not let the queue grow until the uncertain records simply stayed split.

Fixing it at intake

The problem is solvable with good matching logic, data quality rules at intake and staff to resolve uncertain matches. Most jurisdictions had not funded any of the three at the scale the campaign required.

Intake design decides how much matching work follows. A scheduling form that validates dates of birth, standardizes addresses and asks for a phone number produces records that match cleanly. A paper form at a parking lot clinic produces records someone must reconcile later. Each choice made at the front line shows up months later in coverage dashboards.

Offering people a way to see their own record helps too. When a resident can look up their vaccination history and report an error, each correction improves the match for everyone who relies on the registry. That feedback loop costs little once the portal exists, and it moves part of the quality work to the person who knows the facts best.

Agreeing the terms of sharing

Federal planners wanted record-level data, meaning one row per vaccination rather than totals, to monitor coverage, safety and equity. States and localities held the data and the legal relationship with residents. The data use agreements CDC asked jurisdictions to sign became a point of negotiation, because they touched how identifiable the shared records would be and what federal agencies could do with them. Some states publicly questioned sending identifiable information at all.

Two legitimate interests

Both sides had legitimate interests. National visibility matters when a scarce resource is being allocated. So does public trust, especially among communities with historical reasons to distrust government health programs. If people fear that getting vaccinated puts their name in a federal database that could be used for other purposes, some will stay away, and the program fails on its own terms.

The legal question was narrower than the political one. HIPAA permits covered providers to disclose health information to public health authorities for disease prevention and control, and HHS said the collection was consistent with it. State laws on registry confidentiality, and state officials’ own judgment about their residents, were the real constraints. Legality settled whether data could flow; it did not settle how much should.

Options between all and nothing

Some jurisdictions de-identified or tokenized records before sharing. De-identification removes or masks the details that point to a specific person, such as name and street address. Tokenization replaces identifying details with a scrambled code, so that records belonging to the same person can still be linked without revealing who that person is. A coat check attendant works the same way, matching your coat to your ticket without ever knowing your name. Other jurisdictions shared more fully. The national picture was assembled from inconsistent inputs, and analysts had to account for that in every comparison across states.

The dispute was a genuine trade-off between two goods, neither a technical argument dressed up as a political one nor the reverse. More identifiable data makes national analysis easier and more accurate. Less identifiable data protects individuals and can protect participation. Techniques such as tokenization narrow the gap without closing it, and they add their own complexity: every party must use the same method for the scrambled codes to line up.

What a standing agreement should contain

Data sharing agreements are infrastructure. They take weeks or months to negotiate, and negotiating them in an emergency costs time that cannot be recovered. A standing agreement worth having in advance typically covers:

• Purpose limits: the specific uses allowed, such as coverage monitoring and safety surveillance, and an explicit bar on others, such as law enforcement or immigration enforcement.
• Onward sharing: whether and how the recipient may pass data to other agencies or contractors.
• Identifiability tiers: which fields are shared in full, which are tokenized, and which are withheld, with the method specified.
• Retention and destruction: how long data is kept and how its deletion is confirmed.
• Security and breach terms: required controls, notification duties and audit rights.
• Activation and sunset: emergency provisions that switch on under a declared public health emergency and switch off when it ends.

Publishing the main terms matters as much as signing them. A health department that can tell residents plainly what the federal government will and will not receive is better placed to answer the fears that keep people away.

Different jurisdictions, different positions

The negotiation looked different depending on who was at the table. A large state with a mature registry and its own analytics team could afford to send less to Washington, because it could answer most of its own questions. A smaller state or territory with a thin team depended more on federal analysis and support. Cities that run their own registries had to coordinate with their state as well as with CDC.

Tribal nations added a further layer. They could choose to receive vaccine through the Indian Health Service or through their state, and that choice also shaped where records went. Sovereignty over data was part of the decision, not an afterthought. Any multi-party program that includes partners with their own legal standing has to plan for several sets of terms rather than one.

The case for central collection

The strongest argument against the states’ caution deserves a fair hearing. Rare adverse events, such as the blood clotting condition later linked to one vaccine, are found by pooling large numbers of records. People cross state lines for work and care. A national picture assembled from 64 inconsistent feeds is slower and less reliable than one built from a common data set.

That argument is strong for safety monitoring and for coverage measurement. It does not require names in a federal database for every purpose. A tiered approach, with identifiable data kept locally and linkable tokens shared nationally, can serve most national analysis. The trade-off is real, and it is best settled calmly in advance.

Onboarding the sources that feed the record

Vaccinations happened at hospitals, pharmacies, state and county mass sites, community health centers and, later, physicians’ offices. Each had its own system. Records had to reach state registries, and from there, in some form, CDC. Federal tools were offered to fill gaps, including a CDC system for managing clinic workflow and an HHS platform for allocation planning.

Most jurisdictions relied mainly on their own registries and on scheduling and administration tools from commercial vendors and pharmacy chains. Connections used existing messaging standards, agreed formats that let one health system send structured information to another. But each new provider needed interface testing and onboarding before its data could be trusted. Pharmacy partners reported through their own pathways. Reporting lags and duplicate submissions were common in the early months.

What onboarding involves

Onboarding here means the work of connecting a new data source and proving it sends correct, complete records. It involves agreeing which version of the standard to use, sending test messages, checking that fields land in the right places, fixing what does not, and monitoring the first live data closely. Two organizations can both follow the same standard and still fill in the same field differently, one recording a county in the address field and another leaving it blank.

A registry onboarding team typically worked through a predictable sequence:

1. Register the provider and its software, and assign identifiers for each site.
2. Test messages in a non-production environment against the registry’s implementation guide.
3. Review a sample of real records by hand, field by field, before switching to production.
4. Monitor early production data for rejections, missing fields and duplicates, and report problems back to the provider.

Each step needs people who understand both the standard and the registry’s quirks. A small registry team might handle a few dozen new connections a year in normal times. The campaign asked for hundreds in weeks.

Contracts with platform vendors

Many jurisdictions bought scheduling and clinic management platforms quickly, under emergency procurement. Those contracts often focused on getting appointments booked. Fewer specified, in detail, how the vendor would report records to the registry, which fields were mandatory, who owned the data and how it would be returned when the contract ended.

Those terms matter long after the emergency. A health department whose vaccination records sit partly inside a vendor’s platform needs a clean way to extract them, and a vendor that controls the intake form controls data quality. Writing reporting obligations, field requirements, data ownership and exit terms into emergency contracts takes little extra time if templates exist in advance.

Capacity, not storage

The bottleneck was onboarding capacity rather than database capacity. A registry can store millions of records easily. Testing hundreds of new submitters, each with its own interpretation of the standard, takes skilled staff and time. Jurisdictions that had already modernized their registries and built relationships with major providers and pharmacies coped best.

Shared infrastructure helped where it existed. A national hub supported by CDC let registries exchange data with each other and with multi-state providers through one connection rather than many. A pharmacy chain operating in dozens of states could, in principle, connect once. Where a jurisdiction was not ready to use the hub, every multi-state provider still needed its own interface.

The fields that decide later questions

The same stage decides what questions can be answered later. Leaders wanted to know whether vaccines were reaching the communities hit hardest by the pandemic. That depended on recording race, ethnicity and location consistently at the point of vaccination, which many intake processes did not do well. Missing fields could not be filled in afterward. Questions decision-makers will ask in six months should shape what each source is required to send today.

Requiring a field is not the same as getting good data in it. A mandatory race field on a rushed intake form can fill up with a default value chosen to move the line along. Field quality depends on how the question is asked, whether staff are trained to ask it, and whether people understand why it is being collected.

Three numbers every morning

Consider the operations room at a county health department in early 2021. The director wants three numbers every morning: doses received, doses given and the share of residents over a certain age who have had at least one dose. Each depends on a different chain of data.

Doses received comes from the allocation system and shipping records, and is usually reliable. Doses given depends on every clinic, pharmacy and mobile team sending records promptly; a large pharmacy partner that reports two days late makes yesterday’s figure look low. The coverage share depends on matching, because one person recorded twice inflates the count, and one person split across two records can make a fully vaccinated resident look half-done. It also depends on the population figures used as the denominator.

Allocation follows the data

The numbers did not stay in reports. Federal allocations to jurisdictions were tied largely to population, and jurisdictions in turn allocated doses to counties and providers using their own formulas. As supply grew, many shifted toward allocating by how quickly providers were using doses. A provider whose records arrived late, or a county whose coverage was undercounted, could look slower than it was and receive less. Data quality became a question of who got vaccine next week.

Denominators and residency

The denominator carries its own uncertainty. Population estimates come from census data that may be years old in fast-changing areas. Residency is recorded by the address the person gives, which may be a work address or a relative’s. A county with many commuters, students or seasonal residents can see coverage figures that drift well above or below reality for reasons unrelated to vaccination.

The director’s data team spends its mornings explaining why the numbers moved: usually a batch of late records arrived or a duplicate-cleaning job ran overnight, rather than people stopping getting vaccinated. Meanwhile, the county board asks whether vaccination rates differ by neighborhood and by race and ethnicity, and the team has to admit that the fields needed to answer were often left blank at intake.

Publishing honest numbers

The director, in turn, has to decide how to present figures she knows are incomplete. Publishing them with a clear note on what is missing builds more trust than presenting them as precise and correcting them later. Residents, reporters and elected officials can accept uncertainty when it is explained; they are far less forgiving of numbers that change after the fact without explanation.

A short data note with each release does most of the work. It states the reporting cutoff, the share of records with missing race or ethnicity, any known reporting delays from large providers, and any cleaning jobs that changed past figures. Those notes also give the data team a record of decisions that will matter when the figures are reviewed later.

The technology, in the usual sense, has not failed. The servers run and the software works. The weak points are agreements, intake habits and the human capacity to connect and check sources.

The same three problems in banking and benefits

Data leaders outside public health meet the same three constraints whenever a program assembles records from many independent organizations. They must match entities without a shared identifier, agree terms of sharing, and onboard many sources onto a common format. Analytics and AI cannot compensate for weakness in any of the three, because their outputs inherit the gaps in the records.

The pattern turns up in many places:

• A bank consortium pooling fraud signals across member banks has to match customers who appear differently at each bank, and agree what each member may see.
• A regional health information exchange connecting hospitals and clinics faces the same matching problem as an immunization registry.
• A state benefits program drawing data from employers, other agencies and local offices needs agreements and onboarding for each source.

How the parts show up in each

In financial services, the sharing terms carry legal weight of their own. Banks sharing information to detect fraud or money laundering rely on specific legal permissions and must limit what they disclose. A consortium that tokenizes account and identity data before pooling it is making the same trade-off as a state health department deciding what to send to CDC.

In health care, national exchange frameworks have pushed record matching and data use terms into common rules. Every participant still brings its own data quality. A health system joining an exchange inherits the matching problems of every other participant, and its clinicians see the results when a record arrives incomplete or attached to the wrong patient.

In government benefits, 2020 brought its own test. State unemployment systems faced a surge of claims and widespread fraud, and the defense depended partly on matching claimants against other records: wage data, other states’ claims, death records. Agencies with standing agreements and tested connections could check claims quickly. Those without had to negotiate access while the money was going out.

Where the analogy weakens

The comparison has limits. Banks usually have stronger identifiers than public health does, including account numbers and taxpayer identification numbers verified at onboarding. They also have commercial incentives and budgets that public health agencies lack. A bank consortium may solve matching more easily than a registry.

The other two parts transfer more directly. Sharing terms among competitors, or between a regulator and the firms it supervises, are slow to negotiate and easy to leave until a crisis. Onboarding many independent sources onto a common format is as labor-intensive in a payments network or a benefits system as it is in an immunization registry. The weakest of the three parts sets the pace.

The business consequences are familiar. Decisions get made on undercounts, and customers or citizens are contacted wrongly. Regulators and legislators ask questions the data cannot answer, and public trust is lost when people feel their information is used in ways they did not expect.

Agreements, matching and onboarding, funded in advance

The programs that cope best sign standing data sharing agreements, with clear purposes, retention limits and privacy options, before they are urgently needed. They fund matching properly: good software, quality rules at intake and people to resolve uncertain matches. They treat onboarding as a planned capacity, with staff and timelines, rather than a side task for the database team. They set required fields by the questions leaders will ask later and enforce them at the point of entry. And they measure match rates and missing-field rates and report them alongside headline figures.

Who owns each part

Each of the three parts needs an owner, and they are rarely the same person. Agreements belong with legal and program leadership, who can commit the organization and answer to the public. Matching belongs with a data quality function that owns the rules, the thresholds and the review queue. Onboarding belongs with an integration team that can test interfaces and work with outside partners. A program that leaves any one of these to whoever has spare time will find out which one in the next surge.

Paying for readiness between emergencies

Public health funding has long followed a pattern of surges during emergencies and declines afterward. Emergency money buys equipment and short-term staff; it rarely funds the permanent integration and data quality teams that make the next response faster. When the surge ends, the people who learned how the connections work often leave with it.

The trade-off is hard for any budget holder. Readiness spending competes with current services and produces no visible result in a year without an emergency. The most defensible case ties standing capabilities to routine work: the same matching, onboarding and agreements that serve an emergency also improve everyday reporting. Funding them as operations, rather than as emergency projects, keeps them alive between crises.

Measures worth reporting

A small set of measures shows whether the foundation is sound:

• The share of incoming records matched automatically, sent to review and left unresolved.
• The age of the oldest item in the manual review queue.
• The share of records missing each required field, by source.
• The median delay between an event and its arrival in the central record, by source.
• The number of sources onboarded per month and the average time to bring one live.

The programs that struggle tend to invest in databases while underinvesting in the people who connect and check sources. They leave data sharing terms until the moment they are needed, when time is shortest. They present coverage or performance figures without saying how many records failed to match or arrived incomplete. And they design intake for speed alone, then discover months later that key fields were never captured.

Tests for a program built on other people’s records

• Which of our programs depend on records from organizations we do not control, and how many sources feed each one?
• How do we match people or entities across those sources, what share of records cannot be matched with confidence, and who resolves the uncertain ones?
• Which data sharing agreements would we need in an emergency, and are they already signed, with privacy options and emergency provisions?
• How long does it take to connect and validate a new data source today, and how many could we onboard in a month?
• When we report a headline number, do we also report how complete and well-matched the underlying records are?

A public health department, a bank fraud consortium and a state benefits agency will answer these differently, but the gaps they reveal tend to be the same. Each answer that begins with “we would set that up when needed” marks a cost the organization has chosen to pay later, at a worse time.

With hindsight

The rollout that began in December 2020 delivered hundreds of millions of doses, and the data systems held together well enough to support it. That deserves recognition. Under enormous pressure, registries, health departments, pharmacies and providers connected systems and kept records flowing at a scale few had planned for.

The first authorizations came in December 2020, and vaccination began within days. Pharmacies took on a growing share of doses, first through the long-term care partnership and then, from February 2021, through a federal retail pharmacy program. Each new channel brought new data sources that registries had to absorb.

The period also exposed the fragility of public health data infrastructure. Federally offered administration tools saw limited use compared with state systems and commercial platforms, and coverage data remained inconsistent across jurisdictions for months. The friction over matching, sharing terms and onboarding reflected years of limited investment in the plumbing that public health depends on, more than any passing glitch.

The demographic gap showed quickly. CDC’s own analysis of the first month of vaccination, published in February 2021, found that race and ethnicity were unknown for nearly half of the people vaccinated. Several jurisdictions did not report those fields at all, because of their own policies or laws. Questions about equity were asked from the start; the data to answer them arrived later and incomplete.

Matching problems also surfaced in national figures. As boosters were added, some first-dose coverage estimates for older adults rose implausibly high, and CDC capped its published coverage estimates at 95 percent to account for misclassified and duplicated records. The cap was a public acknowledgment of exactly the matching limits described above.

The question of who may see the record took a new form in 2021. States and private groups launched digital vaccination records that let people retrieve their own registry data and show it on a phone. New York’s pass was among the first, in March 2021, and many systems adopted a common standard for verifiable health cards. Registries that had been back-office databases became, briefly, consumer services.

When the federal public health emergency ended in May 2023, CDC said some of its authorizations to collect public health data had expired. Vaccination counts continued only for jurisdictions that kept submitting, updated monthly rather than weekly. The arrangement depended, once again, on voluntary agreements.

CDC’s Data Modernization Initiative, begun in 2020 and described by CDC as a multi-year, billion-plus dollar effort, received substantial new funding. CDC later set out a public health data strategy, first issued in 2023 and updated each year, aimed at faster, more automated reporting from health care to public health. Its 2026 update emphasizes common standards and legal agreements that make data sharing easier. Progress was real but uneven.

The debate over how much federal public health data infrastructure should be centralized continues in 2026. It echoes the November 2020 argument over how much identifiable data states should send to Washington. That tension between national visibility and local trust has not been resolved, and perhaps cannot be, but it can be negotiated calmly in advance rather than in the middle of an emergency.

Timing is the lasting lesson, in any sector. Data agreements and matching capability have to be built before an emergency, because neither can be rushed during one. The organizations that coped best in 2021 had already done unglamorous work: modernizing systems, building relationships with data sources and agreeing terms while nothing was on fire.