Who may see the vaccination record: the negotiation behind the rollout

The week

On November 9, 2020, Pfizer and BioNTech announced that an interim analysis of their Phase 3 trial showed their COVID-19 vaccine to be more than 90 percent effective. Moderna reported strong interim results a week later. The announcements turned attention to distribution. The Pfizer vaccine required ultra-cold storage, far below ordinary freezer temperatures. Through the federal program known as Operation Warp Speed, HHS and CDC were already preparing allocation and tracking systems, and CDC had asked states and other jurisdictions to sign data use agreements covering vaccination records. In that period, some states publicly questioned how much identifiable information they should send to the federal government.

Freezers drew the headlines in November 2020. Ultra-cold storage was a real constraint, but one with known solutions and a supply market. The constraint that proved harder for public agencies was data. Who has been vaccinated, who needs a second dose, whether supply is reaching the places it is needed, and who is allowed to know each of those things. The data problem divides into three parts that any multi-party program faces: matching people across systems, agreeing the terms of sharing, and onboarding the sources that feed the record.

Matching people across systems

A two-dose vaccine creates a simple-sounding requirement: link the second dose to the first. In practice, people received doses at different sites, sometimes in different counties or states. Names, dates of birth and addresses were recorded inconsistently, by staff working fast at mass clinics.

State immunization registries had long handled duplicate and fragmented records for childhood vaccines, on a timeline where errors could be cleaned up over months. A mass adult campaign compressed that to weeks. Matching errors meant reminders not sent, people shown as partly vaccinated when they were not, and allocation decisions based on undercounts.

The root cause is structural. The United States has no national patient identifier, so every registry relies on probabilistic matching of demographic fields. That is a solvable problem with good matching logic, data quality rules at intake and staff to resolve uncertain matches. Most jurisdictions had not funded any of the three at the scale the campaign required.

Intake design decides how much matching work follows. A scheduling form that validates dates of birth, standardizes addresses and asks for a phone number produces records that match cleanly. A paper form at a parking lot clinic produces records someone must reconcile later. Each choice made at the front line shows up months later in coverage dashboards.

Agreeing the terms of sharing

Federal planners wanted record-level data to monitor coverage, safety and equity. States and localities held the data and the legal relationship with residents. The data use agreements CDC asked jurisdictions to sign became a point of negotiation, because they touched how identifiable the shared records would be and what federal agencies could do with them. Some states publicly questioned sending identifiable information at all.

Both sides had legitimate interests. National visibility matters when a scarce resource is being allocated. So does public trust, especially among communities with historical reasons to distrust government health programs. Some jurisdictions de-identified or tokenized records before sharing. Others shared more fully. The national picture was assembled from inconsistent inputs, and analysts had to account for that in every comparison across states.

Data sharing agreements are infrastructure. They take weeks or months to negotiate, and negotiating them in an emergency costs time that cannot be recovered. Standing agreements with defined purposes, retention limits and de-identification options are far cheaper to put in place when nothing is urgent. They can include emergency provisions that activate under a declared public health emergency, so the hard conversations happen in advance.

Onboarding the sources that feed the record

Vaccinations happened at hospitals, pharmacies, state and county mass sites, community health centers and, later, physicians’ offices. Each had its own system. Records had to reach state registries, and from there, in some form, CDC. Federal tools were offered to fill gaps, including a CDC system for managing clinic workflow and an HHS platform for allocation planning.

Most jurisdictions relied mainly on their own registries and on scheduling and administration tools from commercial vendors and pharmacy chains. Connections used existing messaging standards, but each new provider needed interface testing and onboarding before its data could be trusted. Pharmacy partners reported through their own pathways. Reporting lags and duplicate submissions were common in the early months.

Onboarding capacity, not database capacity, was the bottleneck. A registry can store millions of records easily. Testing hundreds of new submitters, each with its own interpretation of the standard, takes skilled staff and time. Jurisdictions that had already modernized their registries and built relationships with major providers and pharmacies coped best.

The same stage decides what questions can be answered later. Leaders wanted to know whether vaccines were reaching the communities hit hardest by the pandemic. That depended on recording race, ethnicity and location consistently at the point of vaccination, which many intake processes did not do well. Missing fields could not be filled in afterward. Questions decision-makers will ask in six months should shape what each source is required to send today.

Data leaders outside public health meet the same three constraints whenever a program assembles records from many independent organizations. They must match entities without a shared identifier, agree terms of sharing, and onboard many sources onto a common format. Analytics and AI cannot compensate for weakness in any of the three, because their outputs inherit the gaps in the records.

With hindsight

The rollout that began in December 2020 delivered hundreds of millions of doses, and the data systems held together well enough to support it. The period also exposed the fragility of public health data infrastructure. Federally offered administration tools saw limited use compared with state systems and commercial platforms, and coverage data remained inconsistent across jurisdictions for months.

CDC’s Data Modernization Initiative, which predated the pandemic, received substantial new funding, and CDC later set out a public health data strategy aimed at faster, more automated reporting from health care to public health. Progress was real but uneven. By this point in 2026 the debate over how much federal public health data infrastructure should be centralized continues. Data agreements and matching capability have to be built before an emergency, because neither can be rushed during one.