Here’s How You Can Show Proof of Vaccination in New York City

By Sharon Otterman

There are two official apps, the Excelsior Pass and NYC Covid Safe, but paper is fine too.

Some businesses in New York City already require people to prove they received a Covid vaccine, but the requirement is about to become much more widespread. 
Some businesses in New York City already require people to prove they received a Covid vaccine, but the requirement is about to become much more widespread. Credit...Victor J. Blue for The New York Times
Sharon Otterman

Mayor Bill de Blasio’s announcement on Tuesday that people participating in indoor activities at restaurants, gyms, movie theaters and performances in New York City must soon show proof of vaccination for the coronavirus brought a slew of questions from New Yorkers: How can I show vaccination status? Which vaccine app is best? What if I lost my card? What if I got vaccinated in another country?

There are a few main ways to prove you are vaccinated, Mr. de Blasio said: a new app released by the city, called NYC Covid Safe; the state’s Excelsior Pass; or by simply showing your paper vaccination card or a copy of your official vaccination record.

On Wednesday, a City Hall spokeswoman said that all vaccines approved for emergency use by the World Health Organization — including those offered by AstraZeneca, Sinopharm and Sinovac — would also be acceptable to meet the mandate. People vaccinated abroad can show or submit their vaccine record from the place where the vaccine was administered.

But that raises additional questions about how hosts or front desk staff will be able to verify the accuracy of foreign language paperwork. The city said those details remain to be worked out.

“The bottom line will be someone will have to have proof,” Mr. de Blasio said in his briefing Tuesday. “As long as that proof is accurate and real, wherever it comes from, that’s what they’ll need to show.”

Here’s what we know:

Beginning Aug. 16, indoor dining, indoor fitness and indoor entertainment venues, such as movie theaters, concert halls and night clubs, must check for vaccination status, the city announced. The requirement will apply to both customers and workers. Enforcement will not begin until Sept. 13, so businesses will have a grace period to figure out how to follow the new mandate.

Children under 12 are still not yet eligible to receive any of the vaccines. On Wednesday morning, Mr. de Blasio said that they would be allowed to enter restaurants with vaccinated adults if they are masked.

Some adults have received or are eligible for medical or religious exemptions that would allow them to not get vaccinated. The city has not yet announced whether people in this category will be allowed to participate in indoor activities at places that will require proof of vaccination.

The city’s new app, NYC Covid Safe, is very simple. It is basically a camera app that enables users to take a picture of their vaccine card and store it in the app. It does not verify whether the picture represents a real card.

The Excelsior Pass is New York State’s vaccine passport app. It debuted in March as the first government-issued vaccine passport app in the country. It verifies applications against the city and state vaccination records.

More than 2.5 million New Yorkers have downloaded or printed out an Excelsior Pass since its debut, according to the state department of health.

Both can be downloaded from both the Apple and Android app stores.

This is how Excelsior works: The app finds the official record of people who were vaccinated in New York State, and issues a pass containing a unique QR code certifying that they were vaccinated. The code is generated 15 days after the person is fully vaccinated. It can be stored on a person’s phone or printed out.

But Excelsior Pass can be finicky. In order to find a person’s vaccination record, it checks his or her name, date of birth, ZIP code and county of vaccination against the vaccine registry. If nearly all information does not match what the vaccination agency entered, even because of a typo, it will not generate the pass. Some 4 percent of users who tried to get passes in the app’s opening months were unable to, the state said.

If Excelsior can’t find your vaccination record, then you may want to use the city app if you don’t want to carry around your card.

The NYC Covid Safe app can easily be used after being downloaded. It allows people to show a photo of their vaccination card after the first dose of a two-dose vaccine, or other proof of vaccination they may have. (One dose of a two-dose vaccine is sufficient to meet the new mandate, though that only offers a fraction of the protection gained by getting both doses.)

To demonstrate potential problems with the NYC Covid Safe app, Huge Ma, a New Yorker who developed TurboVax, a widely used website that streamlined the city’s vaccine appointment system, showed on Twitter that he had uploaded a picture of a green-eyed cat to the app, instead of his vaccine card.

Albert Fox Cahn, who runs the Surveillance Technology Oversight Project, a privacy nonprofit group, uploaded a picture of Mickey Mouse to the app, instead of his card.

Both images earned a green check mark from the app.

“The New York City app is a camera app dressed up like a health tracking tool,” Mr. Cahn said. “It is not fundamentally a meaningful safeguard.”

In response, the city said that the green check mark shows that a photo has been uploaded, but is not meant to signal that the picture is verified.

“Someone checking vaccination cards at the door to a restaurant or venue would see that those examples are not proper vaccine cards and act accordingly,” said Laura Feyer, a City Hall spokeswoman.

The app can help people organize photos of their vaccine card, identification and test results in one place. It also does not pose major privacy issues, as it doesn’t communicate with government registries.

But the problem, Mr. Cahn said, is that it gives an aura of security to what is basically a self-certified screen shot of a vaccine card, which can be quite easily faked.

“When you see a paper card, you see it for what it is, because we know how easy it is to fabricate,” he said. “But because it has that green check mark, people may think this is somehow more secure, and it’s not.”

One issue with the Excelsior Pass is that a user can easily download someone else’s, if they know basic information about the person’s identity and place and date of vaccination. Venues should also check an I.D. in order to verify that the person’s identity matches the vaccination card in the app, but in practice that does not always happen.

And some people have raised other privacy concerns, despite pledges by both the state and I.B.M., which developed the Excelsior Pass, that it uses blockchain technology to protect its data and does not track a user’s location.

City officials stress that the paper card issued by the Centers for Disease Control and Prevention and used across the country works as proof. City residents who lost their card can look it up online or write to the city’s vaccination registry to ask for a paper record of their vaccination.

Several private companies are getting into the business of vaccine passports, including CLEAR, which gained fame by developing a card that allowed people to speed through security control in airports. It is unclear which of these private efforts will be accepted by city venues.

The Biden administration has said repeatedly that the federal government will not be creating a national vaccine passport because of privacy concerns. But as more places begin asking for proof, there may be a broader call for national standards.

People vaccinated in the United States can still use the city’s app, the paper card, and most likely, a photo on their smartphone of their paper card.

New Yorkers vaccinated out of state can also get an Excelsior Pass, if they ask their health care provider to upload that information to the New York vaccine registries, the state said.

City Hall said on Wednesday that foreign paperwork showing that people received any of the vaccines approved for emergency use by the World Health Organization would also be acceptable. There are now eight such vaccines: the three authorized for use in the United States, plus AstraZeneca-SK Bio, Serum Institute of India, Astra Zeneca EU, Sinopharm and Sinovac.

The city does not yet have details on how it will ensure that staff at businesses that fall under the mandate will be able to verify such paperwork, which could be in other languages.

“They are phasing it in, understanding that there are going to be some hiccups,” said Dr. Celine Gounder, an epidemiologist at N.Y.U. Grossman School of Medicine, who appeared at the mayor’s news conference announcing the new mandates.

“Each state has their own vaccination registry, and they are highly variable in terms of their quality,” she said. “What do you do about that? What do you do about people who got Novavax in clinical trials? Those are some of the gaps that will be troubleshooted.”