Pitt’s COVID-19 vaccination data privacy, explained

When it comes to personal health information, most people want to know that their information is kept as secure and private as possible. According to Pitt, students, faculty and staff can rest assured that this is true with COVID-19 vaccination information stored by the University.

“While vaccination disclosures are not protected by the Health Insurance Portability and Accountability Act, the data is stored in a secure system that meets HIPAA’s security rule,” a University spokesperson said.

More than 90% of the campus community is currently vaccinated, according to Thursday’s update from the COVID-19 Medical Response Office, including 95% of undergraduate students, 92% of faculty and 91% of staff.

Student Affairs spokesperson Janine Fisher said all COVID-19 vaccination data — including vaccination cards submitted online by students, faculty and staff — is stored in the University Data Warehouse. She also said the Data Warehouse receives information from COVID Tracker, the University’s primary application for monitoring compliance with vaccination and testing measures.

Besides the Data Warehouse, Fisher said Pitt’s Student Health Service stores student vaccination data for COVID-19 — as well as all other student vaccination data — in Medicat, an electronic health record system designed specifically for colleges and universities. The SHS maintains medical records for seven years.

“A small number of individuals in the [COVID-19] Medical Response Office, Student Health Service and [Environmental] Health & Safety have access to review the uploaded vaccination record, and those individuals have also received security training and/or training in the safe handling of personal health information,” the spokesperson said.

SHS places further restrictions on the circumstances in which SHS staff may access students’ private health records, according to Fisher. She said SHS staff may only access protected health information when it is absolutely necessary.

“Access to PHI (which includes vaccination records) in SHS is restricted to the minimum necessary to achieve the intended purpose of the use or disclosure of PHI related to treatment, associated payments, or any other routine healthcare operation related to the patient care,” Fisher said.

Fisher added that SHS strictly monitors requests for personal health information from other health care agencies, health plans or clearinghouses and will only release the minimum amount of PHI that is necessary or required in individual cases — and only with patient permission.

“The SHS has very detailed policies and procedures to preserve the confidentiality and security of PHI created, received, obtained, maintained, used or transmitted by the SHS and to protect this information from unauthorized access or disclosure,” Fisher said. “Release is only permitted with the written authorization of the patient.”

Pitt chose not to mandate vaccination against COVID-19 this year, but only allows building access to those who are vaccinated or complete weekly testing. Unvaccinated community members who do not comply with testing requirements are banned from campus buildings.

The University enforces this policy by requiring students to swipe or tap their Panther cards at building entrances. Catherine Resetar, a senior accounting major who works for the building safety concierge program, said an alarm will sound if a noncompliant student tries to swipe in.

Resetar has worked for the building safety program since last fall. She said her job is to make sure students are wearing masks properly, swiping their IDs at the door and staying out of campus buildings if they are noncompliant with Pitt’s COVID-19 guidelines.

Resetar said all people who enter Pitt buildings need to be marked as compliant by the University with no exceptions — even those who can prove their vaccination status on the spot.

“If the alarm goes off, they can’t show us a picture [of their vaccine card] or something,” Resetar said. “Sometimes they’re vaccinated, it just hasn’t gone through the system yet, but we can’t.” 

Students described this struggle earlier in the semester on social media, reporting that they were not able to attend class — despite being vaccinated — because their records had not been verified by SHS. According to Fisher, these issues have largely been resolved by this point in the semester.

“For the most part, the records are up to date and any data missing is due to records not being uploaded,” Fisher said. “The delay in verification of records was due in part to records not being complete, dates missing, illegible vaccination cards and the large number of reviews required.”

Resetar said when a student enters a building without swiping their Panther card, she can only ask them to come back and do it, and may not stop people from entering a building if they don’t swipe their card.

“People will just walk in really fast,” Resetar said. “We’re not supposed to chase after them or anything, so if they keep walking, there’s nothing we can do.”

Despite this challenge, Resetar said most students are receptive when asked to swipe their card or adjust their mask. She said she felt confident in the security and effectiveness of Pitt’s COVID-19 protocols.

“For the most part, it’s working,” Resetar said. “Most people follow the rules, no problem.”