Got a strange text about your COVID vaccine? Here’s what it could be.

At 9:38 p.m. on a Monday evening, I received what seemed like a pretty important text from a sender I did not know. 

“View a digital record of your vaccination,” it read.

The text also congratulated me on having received my second dose, and reminded me to wait one to two weeks for full protection. Immediately, my alarms bells went off, and I wondered: “Is this a scam?” 

For one, I’d gotten my second dose weeks ago. So why was I getting this text now? Additionally, the sender said it was a company called Healthvana, claiming to be an “LA County Vaccinations partner.”

I’d never heard of them.

Most suspicious of all, the text was directing me to a link where I would undoubtedly be asked to enter personal information. This is exactly the tactic of a typical phishing scam text or email. 

To my surprise, it actually turned out to be legit. This was the key to my digital vaccine record — the proof, or “vaccine passport,” I’d need to participate in the world’s reopening. I even had the option to put the record in my Apple Wallet!

In COVID testing, contact tracing, and vaccination efforts, public health departments have been using private companies to interface with citizens. For example, the City of Los Angeles has tapped startup Carbon Health to run vaccine appointments from nose to tail, while Chicago is working with ZocDoc on a scheduling portal. 

Policy under health data portability and privacy law HIPAA allows health care providers to share patient information with “business associates” as long as those companies securely store data. But that arrangement means people may be receiving communications about their vaccines — sensitive health information — from entities they might not have heard of before.

At the same time, the FDA, the FTC, and the FCC have all issued guidance for consumers to be aware of COVID vaccine-related scams that aim to sell bogus or harmful products, or steal private information. In my experience, rarely has a week gone by since the vaccine rollout began when I haven’t received a scam email or text inviting me to sign up for a vaccine. 

So if you, too, get a text or email about the vaccine, it’s important to take a beat and consider the options of what it could be.

A scam phishing attempt

Multiple public health agencies have issued official warnings to citizens to be wary of scams relating to COVID. From a black market of counterfeit goods to prompts to fill out “surveys” about the vaccine, bad actors are exploiting eagerness and fear about COVID to make money and steal information.

Even outside of this environment, getting a message from an unknown sender with a prompt to click a link and enter personal information should always make you wary. That’s why it’s important to be extra vigilant when you get digital communications about COVID. However, don’t just ignore these messages, either.

A logistical message from the government

Text confirmations have played a central role in public health vaccination efforts. Search “vaccine notification” on Twitter and you’ll see scores of tweets from people celebrating a notification from their government or hospital saying it’s their turn to get vaccinated, or reminding them to schedule their second dose appointment. 

These are usually pretty easy to discern because they identify themselves outright, and often contain links to public health or hospital portals. Make sure to read email addresses and links carefully, as bad actors will often change one letter or otherwise slightly alter names and URLs to appear reputable.

A legitimate way to unlock your vaccine records from a third-party company

The White House announced Tuesday that it would not institute a federal vaccine passport system; it’s up to local governments, instead. That has led states and counties to partner with different health companies to manage the massive logistical challenge of getting their populations vaccinated.

When citizens sign up to receive a COVID vaccination through their county, they might check a box agreeing to let the provider share their data with business partners who help manage the vaccine rollout (a practice that’s allowed under the health privacy and portability law, HIPAA). Some private companies might even manage the process from beginning to end. Some might just help with scheduling at the beginning, while others could take over with record keeping at the end.

The latter was the case with the company that sent a link to my vaccine digital records, Healthvana. It turns out that Healthvana has partnered with multiple states and counties to deliver COVID test results and contact tracing, and has an expanded contract with Los Angeles County to provide digital records of vaccinations. 

The only mention of Healthvana I personally saw before receiving that late Monday night text (and email) was a small line near the bottom of an email confirming a vaccine appointment, alerting me to the potential for a digital vaccine record. Searching “Healthvana” in my email, and finding this note, was one of the reasons I felt comfortable clicking the link. 

In an interview with Mashable, Healthvana CEO Ramin Bastani said the company worked with the county to get the word out. The company pasted posters at vaccine sites, handed out 3×5 cards at Dodger Stadium, and even bought billboards across Los Angeles. 

“We did as much as we could — at least that we thought we could do at that time — while delivering the information,” Bastani said.

Don’t let unfamiliarity with a company, or odd timing, dissuade you from taking a vaccine-related communication seriously. Bastani said the text delay I experienced was because the county is processing literal millions of records, while dealing with data entry problems like common names, messy handwriting, incorrect birthdays, and more. In retrospect, as a resident of the country’s largest county, a month-long delay from the time of my second shot to receiving my vaccine record is not too shabby. 

So just because you might not have heard of the company sending you a vaccine message, or if it comes at an odd time, don’t discount it entirely. Be on the lookout for scams, but also use your common sense. Do your homework to make sure there is evidence of an official partnership between the company and your local public health agency. And if all goes well, that text might just be your passport to the world’s vaccinated future.