On Friday, New York became the first state to formally roll out a digital vaccination “passport” that residents can flash as proof that they’ve either gotten jabbed or tested negative for covid-19. Per a statement from Gov. Andrew Cuomo’s office, the state developed the tech, dubbed Excelsior Pass, alongside IBM as a way to fast track openings of major venues like theaters, stadiums, and—of course—wedding receptions.
The new system could be considered a prelude to the sorts of vaccine passports being trialed in other parts of the country. Back in January, a handful of health and tech heavy-hitters including Microsoft, Oracle, and the Mayo Clinic threw their weight behind the Vaccine Credential Initiative, which announced plans to roll out its own spin on the vaccine passport by this summer. There’s also the World Health Organization’s newly announced efforts to spearhead its own Smart Vaccination Certificate, not to mention the Biden administration’s own internal plans to develop its own set of universal credentials, as the Washington Post reported on Sunday.
Now that New York has opened covid-19 vaccine eligibility to anyone 30 years old and over as of March 30, with anyone 16 or older eligible as of April 6, the state’s new vaccine passport is going to be the Empire State’s new must-have digital credentials. Here’s what you need to know before snagging your ticket back to something resembling normal.
How do I qualify for one of the Excelsior Passes?
There are a few basic criteria for someone to get their hands on a pass in the first place, per the NY state’s own guidelines. First off, you need to have at least 10 days pass since your last positive covid-19 test. Aside from that, you’re either required to have a negative antigen or PCR test for the virus, or you need to be fully vaccinated with at least two weeks passing after your final vaccine dose. Both sets of tests and the vaccine need to be administered somewhere within New York state.
To check if you qualify, the state made a handy screener to check some basic details like your full name and birthday along with some information about your recent testing history. Those data points get checked against state records and—if your data shows up—you’re offered a pass brandishing your name, birthdate, pass type, and a unique QR code. Congrats, you did it!
Okay, I have a pass. Now what?
Each Excelsior Pass is kept within a digital “wallet” app that can be downloaded free of charge by anyone with an Android or iOS device.
These passes, for the most part, act a lot like a digital airplane boarding pass: you flash your unique pass at the entrance to a given venue, and someone at the door checks the authenticity of your particular pass using an app of their own. If they want to be sure your pass is legitimate, they might also ask for some sort of legal ID, so just to make sure your name and birthdate match up with what’s on the card.
If the pass comes up as invalid, NY state guidelines allow businesses to accept other proofs-of-vaccine, like one of those selfie-ready vaccination cards. And again, without some sort of proof (or some sort of valid ID), there’s a good chance you’ll be denied at the door, per these same state guidelines.
For anyone who doesn’t have a phone, you can also get a printout with your unique QR code and bring that to an event to be scanned the same way your phone’s screen can.
Per Excelsior’s FAQ’s, vaccination passes are valid for 30 days after being retrieved, after which you’ll need to grab a new pass from the Excelsior website. PCR passes are valid for three days, and antigen passes are valid for six hours, and in both cases, you’ll need to get retested to get a new pass.
So, every business in New York State is going to require these?
Not quite. When announcing Excelsior to the public, state officials made sure to stress that, as of right now, it’s only going to be trialed with specific venues that are set to reopen according to the state’s current guidelines. Right now, that means venues with at least a 10,000 person capacity. The usual guidelines will still be in place: temperature checks and mandated masks for all in attendance, alongside seating arrangements that enforce social distancing.
So, mega-venues will be the first to adopt Excelsior—locations like Madison Square Garden in Manhattan and Albany’s Times Union Center, according to Gov. Andrew Cuomo’s announcement. However, the pass will be expanding to smaller sorts of spaces—think concert venues or wedding halls—starting April 2.
If smaller businesses like restaurants, hair salons, or coffee shops want to give Excelsior a go for their own peace of mind, they’re free to download the business-facing app. As of right now, downloading the Pass is completely voluntary for these businesses, and for the general public.
Okay, okay, but what about my data?
For the most part, specifics surrounding the privacy of this particular app are pretty hard to find. We know, for example, that Excelsior’s privacy policy promises that when a business scans over your app, it doesn’t store any data about you or your test status. It also promises that “anonymous usage data and metrics related to app adoption and usage” are shared with the state, though no officials can “identify any specific user that has downloaded or deleted the app.” But as we’ve pointed out before, even so-called “anonymous signals” like the data that’s collected by this app can, in fact, be used to track and target a given user if it gets into the wrong hands. Meanwhile, it’s worth noting that health-related apps generally have full legal leeway to play fast and loose with health data. Excelsior’s own terms point out that because the tech isn’t being provided by a designated healthcare provider (like, say, a physician), HIPAA doesn’t apply.
Meanwhile, other reports have pointed out that the often-hyped blockchain tech that Cuomo is using to transfer this sensitive health data between the app and the state often isn’t all that it’s cracked up to be. For those who are curious, IBM offers a few details on its site about how its blockchain tech passes data testing labs, to your phone, to the state, and back again—though again, it’s a bit foggy on the specifics.
In short: If privacy’s a concern, but you absolutely need to download the app for any particular reason, go the printout route rather than downloading the app.
Why “Excelsior?”
It’s the state motto. Yeah, we think it’s kind of dumb too.