Strange code on your COVID vaccine record doesn’t scan? California did that on purpose
QR codes on Californians’ digital vaccine records can only be scanned with a compatible device or app. It’s a security measure, officials say.
After accessing their digital COVID-19 vaccination records, some Californians have noted an apparent glitch: The state-generated reports include QR codes that, when scanned, don’t seem to retrieve any information.
But that’s a feature — not a bug — of the 11-day-old verification system, according to the California Department of Public Health.
Though the QR code included in each vaccine record looks like the familiar scannable square you’d find on a concert ticket or restaurant menu, its inclusion makes that record a Smart Health Card.
Although they provide the same information included on the wallet-sized paper card Californians should have received when they got their shots, the codes themselves can be properly scanned only by a compatible device or app.
From the state’s perspective, this provides an additional layer of security.
“By design, any QR code reader is designed to ‘read’ the code, but what they will see is not particularly useful,” Sami Gallegos, press secretary for the state’s COVID-19 Vaccine Task Force, wrote in an email. “That’s so ... the holder’s name, date of birth, vaccination info, etc. is not easily readable by anyone with a QR code reader.”
On the other hand, “if someone has a Smart Health Card-compatible reader,” Gallegos said, “they can interpret the text contained within the code — which will reveal a digitally signed block of text and a link to the state of California’s public key.”
“We are digitally signing that QR code, which can then be proved to be authentic,” Rick Klau, the state’s chief technology innovation officer, said during a briefing earlier this month.
Gallegos said a verifier app would be released in the coming weeks — not by the state but by the Commons Project Foundation, a nonprofit that has developed its own method for screening COVID-19 health status.
California unveiled its centralized digital portal on June 18, with the goal of providing an easy way for residents to access their own records and show that they’ve been inoculated.
The system, accessible through My Vaccine Record, pulls from records maintained within and accessible through the state’s immunization registry.
Officials have stressed that the digital records are not “vaccine passports” but, rather, a matter of convenience. There aren’t any settings in which the state requires someone to be vaccinated as the sole condition of entry.
For indoor events with at least 5,000 people, the state does stipulate that attendees must show they’ve either been vaccinated or recently tested negative for the coronavirus. Such proof is also recommended, though not required, for outdoor events with at least 10,000 attendees.
Individual businesses, venues or local health officers, however, have the power to impose vaccine verification in certain cases. San Francisco, for instance, will require all its city government employees to be vaccinated once the shots are formally approved by the U.S. Food and Drug Administration.
California’s digital system has not been free of hiccups since it launched. Along with questions about the QR codes, some residents have contacted The Times to say that their records are either missing or inaccurate — and to complain that the troubleshooting process, which the state acknowledges could take two to three weeks, is too slow to address their issues.
Anyone needing to correct or complete their vaccination record is asked to fill out this online form.
This story originally appeared in Los Angeles Times.