0.0 Context Setting

(This episode was supposed to be sent yesterday.)

It’s Wednesday, 13 July, 2022 in Portland, Oregon and it’s only going to hit a balmy 80f / 28c today. These introductions are starting to feel like the DJs on Groundhog Day.

1.0 Some Things That Caught My Attention

There Was No User Need

Here’s an example where a failure of policy combined with what looks, on the outside, to be a sclerotic delivery process and potentially some questionable choices ends up with maybe not the best outcome. Whew, what a sentence.

Okay, so last year in June, 2021, the State of California launched their Digital Vaccine record portal(sic) that was a super easy way for you to get a SMART Health Card vaccine record, which meant that it was super standards compliant and, in the spirit of sharing, the whole thing is available on Github¹. It was so good that Jamie Zawinski, who runs a bar, was impressed².

Nearly a year after after California launched their digital vaccine record website, the State of Oregon, where I live, launched theirs in April 2022. The Oregonian news-thing helpfully noted at the time as:

Oregon launches digital vaccine card; unclear how many people will use it³

and then today with an updated story, which even more helpfully is noted as:

Oregon spent $2.4 million on a COVID-19 vaccine app few are using⁴

The latter story is especially exciting because it leads with how much the app cost, which is on the one hand helpful but on the other hand, really not. Apparently QR codes have only been downloaded 51,000 times since late April, “costing about $48 per use”, which is technically true if you can do maths⁵.

Some more details pulled from the first article:

• Oregon Health Authority (or whomever) had been working on the vaccine portal since at least November 2021
• Oregon “worked closely with Washington and California in developing its app”, which strongly implies Oregon used the same framework that California made public September 2021

People really love the $2.4 million number! It’s certainly a number, and it’s certainly a relatively large number for a state like Oregon. But because the article is behind a paywall and I don’t subscribe to the Oregonian, I don’t know how the number was computed. There are definitely lots of ways to compute that number. The Oregon Health Authority has a 2021-2023 budget of about $30 billion, but that covers a lot.

So many thoughts!

First: it’s not an app, it’s a website. You go to the website, you plug in your name and your date of birth, provide a PIN, they try to match the record with the Oregon Health Authority, and then if it matches, you get a text or email, you enter the PIN, and then you get your SMART Health Card record as a e.g. an Apple Wallet pass, or QR code as an image or PDF you can also have emailed to you. All fine, all good. This is the tiniest nit to pick, and only kind of matters in a framing sense in the “what the public expects an app to cost”, which differs wildly but normally can start from “about $50”, but also to “what the public expects a website to cost”, which also normally starts at “around $50” thanks to the behavior of some august institutions like the nation’s ostensible paper of record.

But that’s by-the-by. The main criticism is the intersection of “this is how much the app cost” combined with “this is how many people are using it”, yielding your “$48 per use”.

Here’s the opinions:

• Nobody’s using it because nobody needs to use it. California kind of had this problem because even when their vaccine passport portal rolled out, the state had walked back any hard requirement for vaccination proof. You didn’t really have to use it to get in anywhere, it was up to the controlling entity of the physical location or whoever was putting on the event.
• In other words, if you flipped this around to ask the question “what is the user need satisfied by a vaccine portal app”, then the question might be “as a user, I need to prove that I have been vaccinated, so that”
• The biggest requirement that would’ve created the largest absolute number for users who might have the need “I need to prove that I have been vaccinated” would have been a government/state policy requirement under, I don’t know, emergency public health powers. But that was never coming from a Federal perspective, and so it was left up to the states. California tried this, but blinked.
• You’ve just massively cut down the number of people to whom you’re forcing the need to prove vaccination status.
• This is completely ignoring issues of equity, where not everyone has access to a mobile device or the method through which to get a vaccine passport QR code… but that’s a side issue, because anyone who’s been vaccinated has proof of vaccination in the form of an easily faked but still existing bit of paper that shows their CDC vaccination status and is written in by whomever administered the vaccine.
• There are other problems that a verifiable vaccine passport QR code might solve, like the fact that they’re verified against state public health information, the vaccinations have been reported and then QR code/pass is cryptographically signed so it can’t be faked and any old bar owner can check to see that this QR code is actual proof. But you go down that route, you also want, I don’t know, a picture of the person, or to check it with another form of ID that has their name.
• The QR code then is more secure than the piece of paper because it’s harder to fake and more verifiable, but that’s an orthogonal issue.
• There are other users, of course. You may be a humble bar owner battling against licensing issues so you can stay in business, and you may also be so self-interested that you want to check vaccine status and you’d quite like to be reasonably sure that people aren’t showing you bits of faked-up paper. That would’ve been a different political issue where, say, associations of bar owners might have gotten together and demanded that local government mandate proof of vaccine status in order to keep their workers safe. Ha!
• So far, we’re only at “what do people actually need the passport for”!

Meanwhile, back in November 2021 (around the time the Oregon Health Authority confirmed that work had started on their vaccine passport portal), I got my digital COVID-19 record from my healthcare provider because by that time, EPIC, of the now Oracle-owned EHR juggernaut and usability nightmare, had built in support for providing SMART Health Card vaccine records, so “all” that healthcare providers using their EHR had to do was presumably the equivalent of flipping about sixteen gazillion switches to turn it on. (All in the background, of course, is all the data required to make sure you can actually look up, against the state’s public health department, vaccine records and match them)

How many times did I show my vaccine passport? Admittedly I haven’t gone out much. It’s been checked maybe three or four times in the last eight months. That’s all. I also have had the paper thing in my wallet the whole time.

So. Was it worth it? No, probably not. Was it expensive? Maybe? Not quite? $2.4 million is, in the grand scheme of things, not that expensive depending on how the number was put together. Does that $2.4 million reflect the dollar-cost per person-hour worked on the entire project from start to finish? I would expect there’d be a lot of stakeholders involved: Oregon has, for example, 36 counties, each of which would look after public health in their own way, because America loves devolving power locally and that isn’t always a bad idea. If you were asking “how much would it take Facebook to build a vaccine passport app” then I imagine the number would be way more than $2.4 million dollars, if you counted all the people and the time involved!

But you’d need to hold all of that against the factor of time. The passport portal went live in April 2022, nearly a year after California’s. All things being equal, it shouldn’t have taken as long to implement as California’s, but there’s a big asterisk there because the functioning of the portal relies a lot on having good quality data so your portal actually works and people who think they can get a passport actually get one. Who knows what their data pipes look like, whether they’re shiny and new or encrusted and gunky. (I suspect, without any value judgment as to why, that they’re probably more towards the latter, if only because in general such data quality and exchange tends to be underinvested)

At the end of it all, by April this year, people were kind of over it. People were kind of over COVID at Thanksgiving in 2021, they were definitely over it over December/January 2021/2022 because there was that godawful spike and right now, people are seriously over it because the US doesn’t even want you to test before you enter the country because really, what does it matter anymore? We’re post-COVID in that we’ve not recovered, we’re now chronic. It’s here, so life is back to normal.

So. If you add the lack of requirement for a passport, which is a policy decision, to the sheer amount of time taken to deliver the “solution” then no, it wasn’t worth it. When should it have been killed? Probably when policy decided nobody would have to prove vaccine status in a verifiable way. Would it have been worth it to spend money on some other form of public health? Probably. Would that have been worth it, given the overall political environment and engagement, especially at the Federal level? Who knows! I’m not a public health expert, I’m just a guy in a chair who’s been unadvisedly been given a keyboard and an unmoderated TCP/IP connection!

So, to recap:

1. There probably wasn’t enough user need (either externally created, or intrinsic) to justify a vaccine passport portal, given policy decisions
2. It took too long, but there’s no visibility into the capability of Oregon in delivering a solution. If you count from when California made their solution open source (September), then even from then, it took about 7 months. Which is, you know, long. Almost as if someone had decided that this thing should happen, and it limped along, because everyone knew it didn’t make any sense but nobody had the heart to kill it.
3. Depending on how you count the dollars, it might have been relatively cheap. If they paid a bunch of contractors to develop it, then… yeah, that was too expensive. Shouldn’t have cost that much.

Okay, that’s it! How are you doing? I love it when I get notes and do my best to reply to every single one, even when they are just “hi”, in which case: hi!

Best,

Dan