Vaccination Frustration: Interview with Signetic Co-Founder Chris Sprague (part 2)

REGISTRATION BOTTLENECKS, PREPARING FOR A SMOOTH VACCINATION EFFORT, HIPAA, AND VACCINATION EQUITY

‍

• The following is part two of a two-part series. It’s been edited and condensed for clarity. See part one here. •

What is Signetic doing specifically to open up those potential bottlenecks that people have been experiencing across the country?

When you're preparing for any kind of scalability and availability issues, the best way to identify the bottlenecks is to model out exactly those scenarios that you expect.

What’s the average number of people that you expect could be coming to the site at the same time to register for a limited number of appointments? And what if the demand is an order of magnitude greater than that? You need to plan for that kind of average expected case, but then also that worst case, and model it out and try it.

There's a number of software tools today that allow you to simulate exactly those scenarios. So you simulate, say, 40,000 people or 400,000 people trying to sign up for 3500 appointments.

Is your software going to be able to handle that?

One way to make sure is to have 400,000 bots trying to schedule the 3500 appointments in your system and seeing what happens, because even with the best conceptually designed architecture, you just don't know until you try.

So we're trying ahead of time to identify the potential bottlenecks and test for them—just proving to ourselves that this is going to stand up to both the average and the worst case scenarios.  And then once you've identified what those bottlenecks could be, it's just about instrumenting the right solution for that bottleneck.

What can organizations and municipalities do to best prepare for a smooth vaccination effort?

I would say it depends on what data you’re going to be feeding into the system, and how. So if you're thinking of adopting a management solution, one of the first things you think about is okay, well, I've been vaccinating people for one- to three-months now.

How do I get those people into the system? How do I get the people that have appointments for their first dose into the system? How do I get people that have already had their first dose into the system so that way they can use it to schedule their second dose?

Because if I uptake this new way of doing and tracking things, I want to use it for everything, right? Because I can't track anything unless I have this centralized, holistic, single source of truth. And so I would say, just make sure you're tracking the things that you need to operate today, even if that's a manual spreadsheet.

And that's what a lot of people are doing with their pen and paper when they're administering vaccines, and then their spreadsheets to keep track of who's had the vaccine, who they need to call to remind to schedule a vaccine or who still needs to come in for a second appointment.

Also, who do they need to report to the state immunization registries? Because there's now compliance regulations. So just make sure you're tracking all of those things, because any end-to-end software system that you adopt is going to need those things from you.

There are something like 1400 different different practice management systems in the US, the providers use for their back end and their calendars and their scheduling. And many of them are notoriously hard to integrate with. What can organizations and municipalities do to determine which vaccination management systems work best with their back end?

I would say that first they need to decide if that's a goal right now. For many clinics it won’t be.

Do you want to treat mass scheduling of appointments in different types of facilities and different staff and protocols and compliance as the same thing, as normally scheduled appointments with well understood expectations and battle tested flow management?

Even in the best understood scheduling scenarios within a health system, how many times do people still need to wait an extra 30 to 90 minutes on their scheduled appointment? And I would argue that what is more needed right now is a system and workflow that is meant for or adaptable to how COVID-19 vaccines need to be scheduled and administered.

Now, how you find out which those are, I think, is by talking to people. If you're in one county, talk to the other county about what they're using. If you’re an independent pharmacy, talk to other independent pharmacies.

A lot of times the department's of health are surveying the vaccine registration and management systems out there and making their own recommendations, and they're doing that on the behalf of people that don't have that expertise to make that determination. And right now, a lot of people are making a lot of promises, with the best of intentions, and coming up with innovative approaches to all of these problems.

But the truth is—that everyone who's building these things and actually administering vaccines knows—is that we don't know what the right approach is. And the right approach can be completely different for different localities and populations and phases of the vaccination, or who you have on your staff, volunteers, and what type of skills they have.

So my recommendation would be to talk to people, talk to people about their experiences and what they had to work with, and if it's working for them. And if they tell you that they have an awesome working solution, and your profile is a lot like theirs, then that's a huge signal that you should uptake that solution.

And if all else fails, I would err on the side of something that has evolved for this particular case, not shoehorned into it. Look for something that's flexible and adaptable, because almost certainly the strategies are going to change over time.

We've heard about the relaxing of some of the HIPAA rules. Can you talk about that a little?

The Office of Civil Rights did put out some new guidance, where some of those HIPAA rules have been relaxed for the vaccine distribution, and in particular registration, part of that process.

Now, they've been relaxed, not because privacy and security aren't important for COVID-19, but rather, because security and privacy in any software system are always at odds with other things like usability, convenience, accessibility.

And it's all about trade-offs right now, of which things are a higher priority right now.

What OCR is given, is that leeway to make the decision, on which is right for you to strike that balance, and get as many people vaccinated as possible, while respecting privacy and security as much as possible.

So one example is email and or SMS digital communication. In a very strictly HIPAA-compliant environment, none of those messages should contain personal information or personal health information. That's all stuff that you should not be sending digitally, in general, for HIPAA compliance, and I think for good reason.

But we're dealing with this unique scenario where people absolutely need and want to know and be assured when and where their COVID appointment is, and you want these people to show up, because these vaccines have an expiration date.

And so you just have to assess where you want to fall on that spectrum.

Is it: ‘Hey, I want these older populations that aren't used to using, let's say, mobile phones at all to have everything laid out for them in a very easy-to-read message without logging in to some other software system or having incomplete information or vague information.’

A lot of people are erring on that side, the side of clarity.

Another is things like user accounts and authentication. Traditionally, to schedule most services, you need to log in, you need to create a username and a password. And that's the only way you'll be able to do things like register an appointment, get a reminder, see the confirmation, change the appointment.

But right now when the goal is getting people vaccinated as easily as possible and reducing the friction of doing that as much as possible, people have to question ‘Are there creative approaches to verifying that a particular patient or user is who they are, without having the need to, let's say, create and maintain yet another username and password that they may forget? Or not having clarity of communication on where their appointment is?’

I think what the latest guidance has been is really some minimum set of guidelines that you should follow for the purpose of security and privacy. But then it's allowing the spectrum of people to make where they want to fall within that, a local decision based on the founding principles of privacy, but also acknowledging that the goal of this is to get people vaccinated. And yes, it is a very private matter. But it is also a shared responsibility to do so.

Lastly, to touch on fraud and equity, we've heard the story about the young ladies dressing up as grannies. We’ve all seen links shared on social media that we know we can use to sign up before we’re eligible. What can vaccine management solutions do to combat that kind of fraud and cutting in line?

One is building features into the system that don't allow people who don't qualify to schedule an appointment in the first place.

So for example, if you’re starting with people who are 65, or, say, with various roles and responsibilities, like essential workers, frontline workers, build it in so that people can't actually click the schedule buttons unless they filled out those types of eligibility criteria, and that they are eligible.

But then the other part of this is, again, that balance of friction versus absolute verification of facts.

And so what many systems do is ask people to attest that these things are true. But it's still very much an honor system. No one is checking when someone marks the 60-year-old or 65 box, are they really? Okay, then ‘What's their birthday? What's their driver's license number? Let me verify that.’

But because I think again, the goal of all this is to get as many people vaccinated as possible. And so, yes, you want to use heuristics and techniques to make it hard to game the system, but if you absolutely stop all of that, or prevent that all, you're also potentially introducing enough friction that you're going to move much more slowly vaccinating people, and you're going to prevent people from getting access to the vaccine.

But I think as far as people showing up to don't qualify, or, or dressed up that that's a policy decision. For each individual is a local individual provider, it's a local decision.