State Public Health Officer Order 

Issued September 24, 2021

Vaccination against COVID-19 is the most effective means of preventing infection with the COVID-19 virus, subsequent transmission, and outbreaks. Vaccine verification requirements and mandates in certain public and private spaces within California (requirements that in certain settings persons be either vaccinated or have tested negative for COVID-19, and requirements that unvaccinated persons wear masks indoors) represent effective and necessary public health measures aimed at preventing the spread of COVID-19, particularly in large group and high-risk settings. Vaccination verification or negative testing is required for indoor mega events per California Department of Public Health (CDPH) requirements (August 18, 2021). Many of my recent orders have included COVID-19 vaccination and/or vaccination verification requirements for health care workers (August 5, 2021), workers in schools (August 11, 2021), state and local correctional facilities and detention centers health care workers (August 19, 2021), and visitors in acute health care and long-term care facilities (August 26, 2021). Finally, CDPH Guidance for the Use of Face Coverings (compliance with which is mandatory per my Order of June 11, 2021) applies differing masking requirements for vaccinated and unvaccinated individuals in certain settings. As such, more Californians are needing access to their COVID-19 vaccination record.

The California Department of Public Health has created a system to allow for Californians to access their Digital COVID-19 Vaccine Record (DCVR) to replace lost or otherwise unavailable paper records and provide an additional form of portable and reliable vaccine verification. The DCVR is generated using patient data from the California Immunization Registry (CAIR), which includes two regional registries: the San Diego Immunization Registry (SDIR or "CAIR San Diego") and the Healthy Futures/Regional Immunization Data Exchange (RIDE or "CAIR San Joaquin"). For the purposes of this Order, all references to "CAIR" are inclusive of SDIR and RIDE.

The DCVR system grants an individual access to their COVID-19 vaccine records using the name and date of birth, in combination with either a mobile phone number or email address.  To ensure the system remains secure, individuals are required to verify their identity when requesting access to their Digital Covid-19 Vaccine Record by selecting a link that is sent to them either by email or text message to the email address or mobile phone number provided at the time of vaccination. Once confirmed, the system then pulls the COVID-19 vaccination information necessary to generate a QR code and digital copy of the individual's COVID-19 vaccination record.

At present, not all immunization providers within California are requesting an individual's mobile phone number or email address prior to administering the COVID-19 vaccine. When health care providers report COVID-19 vaccination information to CAIR without the vaccine recipient's mobile phone number or email address, the vaccine recipient is not able to access their Digital COVID-19 Vaccine Record on a timely basis and must instead go through a time-consuming reconciliation process with the California Department of Public Health.

In addition to increasing individuals' access to their vaccine record, having contact information that ties to a single, unique individual (or their parent or guardian) provides the most effective means for tailored notification reminders to Californians about second doses needed to complete the COVID-19 vaccination series, as well as booster doses that may be recommended to boost immunity in specific populations. While many individuals within a family or living unit may share a home phone number, mobile phone numbers are more likely to be unique to an individual. Similarly, email addresses are often unique and unshared, in part because they are easy and free to acquire and maintain. Encouraging full vaccination and any recommended boosters will increase the proportion of Californians who are fully vaccinated, reduce COVID-19 transmission, and mitigate disease severity among vaccinated individuals.

All patient data collected in connection with vaccination that is reported to CAIR is subject to stringent confidentiality protections. (Health & Saf. Code, § 120440(d).) An individual's mobile phone number and email address are covered by these same confidentiality protections, which limit both who can access the information and for what purposes the information can be used. The contact information collected pursuant to this Order, as authorized by Health and Safety Code section 120440(c)(6) and (8), will be used solely to (1) verify the identity of individuals seeking to access their Digital COVID-19 Vaccine Record and (2) provide reminders and alerts to individuals, or their parent or guardian, when additional COVID-19 vaccination doses are due or recommended.

In order to facilitate Californians' access to their Digital COVID-19 Vaccine Record and to enable the California Department of Public Health to effectively contact individuals for second dose and booster dose reminders, additional public health requirements are necessary at this time.  

I, as State Public Health Officer of the State of California, order:

1. All immunization providers administering COVID-19 vaccinations within California who report immunization events to the California Immunization Registry (CAIR), including users of SDIR and RIDE, must request from the patient: (1) the patient's mobile phone number, and (2) the patient's email address.

2. If the immunization provider uses a registration form (paper or electronic), at or prior to the time of immunization, and the patient does not provide their mobile phone number and e-mail address at the time of registration, the immunization provider must verbally request the missing contact information prior to administering the COVID-19 vaccine.

3. If a patient does not provide their mobile phone number or e-mail address when verbally requested, the immunization provider must inform the individual of the following:

a.    They are not required to provide this information to receive the COVID-19 vaccination;

b.    Not providing the information may make it difficult for them to access an electronic copy of their vaccination record (i.e., their DCVR); and

c.    The DCVR can be used in the future to verify their vaccination status for convenience or to replace a lost paper vaccination card.

4. Individuals are not required to provide their mobile phone number or e-mail address when requested and should still receive the COVID-19 vaccine if they decline to provide the information.

5. If the patient provides their mobile phone number and/or e-mail address at or prior to the immunization event, the immunization provider must report that information to CAIR when reporting the vaccination event.

6. All immunization providers must maintain the confidentiality of patients' email addresses and mobile phone numbers in the same manner they are required to maintain other medical information with patient identification as required by Health and Safety Code section 120440(d)(1).

7. All individuals and entities who are authorized to access CAIR data under Health and Safety Code section 120440 must maintain the confidentiality of patients' email addresses and mobile phone numbers in the same manner they are required to maintain other medical information with patient identification as required by Health and Safety Code section 120440(d).

8. The Terms of this Order supersede any conflicting terms in any other CDPH orders, directives, or guidance.

9. Except to the extent this Order provides otherwise, all other terms in all of my other Orders remain in effect and shall continue to apply statewide.

10. This Order shall take effect on October 1, 2021, at 12:01 am. With the exception of the privacy protections restated herein, the requirements in this Order apply only to immunization events that take place after the effective date and time.

11. This Amendment is issued pursuant to Health and Safety Code sections 120125, 120140, 120175, 120195, 120440, and 131080 and other applicable law.

Tomás J. Aragón, MD, DrPH
Director and State Public Health Officer
California Department of Public Health