The COVID Vaccine Distribution Quagmire: What Employers, Public Entities and Others Need to Know

Distributing the COVID-19 vaccine requires collaboration from multiple stakeholders, opening organizations up to cyber and other risks in the process.
By: | April 2, 2021

For Lisa Mayers, it was the lines that got to her. On the news, she’d watch as hundreds of people waited in line for hours to get their COVID-19 vaccine. They’d line up outside of schools, community centers, stadiums.

“We all saw TV pictures where there were people in line for hours and hours, trying to get a vaccine, getting into the door and then nothing was available,” Mayers said.

As a deputy chief of the Anne Arundel County Fire Department, Mayers knew that she didn’t want people to have to wait for ages to get their shot at the clinics held by her department.

“We took it to heart, and said, ‘We definitely do not want that to be the experience of people coming to the clinic put on by the Anne Arundel County Fire Department,’ ” Mayers continued.

A Deeper Look: Johnson & Johnson’s Vaccine Supply Chain Pitfall: Where Was the Risk Management?

Ever since the first vaccines were authorized for emergency use in December, distribution has created a number of different logistical challenges. Those charged with distributing the vaccine have to figure out how to store the vaccines at the proper temperature, track who has received first and second doses, and figure out the best ways to communicate with the public about vaccine safety, efficacy and availability.

Now that the Biden administration has directed states to open COVID vaccination to all eligible adults by May 1, vaccine distribution efforts will likely ramp up in the coming weeks.

As vaccine rollout continues, the challenges of managing different types of shots, documenting inoculation status and communicating jurisdictional rules will come to the fore. Luckily, technologies like blockchain are stepping up to manage some of the hurdles.

But if confusion escalates to chaos, cyber criminals may try to take advantage of the process by looking for weak spots in the system.

Communication Hurdles 

Vaccine distribution brings with it a myriad of logistical challenges. Distribution sites have to keep track of ever-changing state and municipal guidelines on shot eligibility, and they have to communicate those changes to the public so that people are notified when they’re able to receive the vaccine.

Lisa Mayers, deputy chief, Anne Arundel County Fire Department

“There’s a lot of communication that happens,” said Trisha Wolford, the chief of the fire department for  Anne Arundel County.

For the general public, shifting eligibility, multiple vaccine doses and concern over how and when they’ll be notified of inoculation eligibility can cause anxiety. Many people just want to get the shot in their arms and go back to normal without managing all of these different logistical hurdles.

“There’s a tremendous amount of anxiety about when things are going to happen — When am I going to get notified? How am I going to get notified? — So part of that preparation phase is really communicating almost when you have nothing to say, but just trying to lower that level of anxiety. We started communicating weeks before we had our doses,” Wolford continued

On the employer end, shifts in eligibility can mean they’re working to communicate with their employees about who’s able to get the shot and when.

Employers that are in multiple jurisdictions, or even countries, face the added pressure of having to keep track of many different sets of guidelines if they want to notify their employees of eligibility.

“We have one client who’s in 85 countries,” said Nancy Green, executive vice president at Aon. Green serves as the leader of the company’s COVID-19 task force.

“Depending on the country and jurisdiction, they may have a different playbook that they’re following and a different definition of the essential workers and the classifications and the progression where they are in the vaccination progress in order to align with local guidelines.”

Nancy Green, executive vice president, Aon

Employers will face the added challenge of managing employees with different vaccination statuses in the workplace.

OSHA has said that employers cannot segregate vaccinated and unvaccinated workers. So, social distancing guidelines and mask-wearing will likely remain in place even after employees have gotten the shot, especially since immunity takes a few weeks to develop post-vaccination.

“It’s really the characteristics of the unvaccinated that drive the determinants and how they can gather, and where, and what the distancing and hygiene measures are,” Neal Mills, chief medical officer at Aon, said.

“You have to make sure you’ve addressed the magical thinking around the vaccine that as soon as you get the vaccine, you don’t have immediate immunity.”

From Deep Freeze to Bicep 

Shifting eligibility and public communication is just one challenge of vaccine distribution.

In the U.S., many distribution sites are managing two or three different vaccines, all with different storage requirements. Pfizer’s vaccine needs to be stored in an ultra-cold freezer, while the Johnson & Johnson and Moderna vaccines can be stored in a regular refrigerator or freezer.

“It’ll be three different vaccines, and they’re very different. Pfizer, Moderna and Johnson & Johnson are very different. They have very different needs,” Wolford said.

“We definitely had to consider the vaccine acquisition, storage and preparation. As Chief Wolford said, depending on the type of vaccine, if you’re storing Pfizer long-term, it has to be in a more controlled environment,” Mayer added.

If a vaccine isn’t stored at the proper temperature, the dose could become unusable. Whether a vaccine has overheated or not isn’t simple to determine, however. Small changes in vaccine temperature from location to location within the supply chain can cause the drug to spoil.

Mark Treshock, global blockchain solutions leader for health care and life sciences, IBM

“The vial could have simply overheated, but what we often see happening is more subtle, where there’s a temperature excursion at one party — a minor excursion. And there’s another minor excursion at another party, maybe a third,” said Mark Treshock, global blockchain solutions leader for health care and life sciences at IBM.

“In isolation each of these minor excursions is not troublesome, but the fact that our vial of vaccine has had three minor excursions in its journey is a problem.”

Treshock and others have proposed blockchain as a potential solution to temperature monitoring and other vaccine distribution logistical quagmires. Though most commonly associated with cryptocurrency, blockchain’s ability to make data easy to verify and difficult to falsify could make it a perfect fit for vaccine distribution.

IBM and Moderna are currently collaborating on a vaccine management solution that utilizes artificial intelligence, blockchain and hybrid cloud technologies to improve supply chain visibility and enable real-time tracking.

A blockchain system could help different stakeholders — manufacturers, distributors and the doctors and nurses distributing the shots — keep track of a vaccine vial’s temperature at each point in the supply chain so that they’d be aware of any variances that could cause the drug to perish.

Additionally, the technology could help protect against falsified COVID-19 vaccines, something Treshock said is increasingly becoming an issue.

Over the last year, the black market has grown more than 400%, including growth in falsified medications, according to Forbes. Fake COVID-19 vaccines have even been reported in South Africa.

“The COVID vaccine is quickly becoming the most counterfeited or diverted drug in the market,” Treshock said

Keeping vaccines safe for usage is only part of the battle. Once people have been inoculated, airlines and other forms of mass transit may start requiring proof of vaccination before they allow people to travel.

Currently, many states are issuing paper cards as proof of vaccination, which can easily be lost or counterfeited by malicious actors.

To help address this problem Treshock and IBM have been working with the state of New York to develop a health pass using blockchain that would offer New York residents the ability to securely prove they’ve either received a negative COVID-19 test or have been fully vaccinated.

The pass would allow individuals to determine what information about their COVID-19 vaccination status they want to share and with whom. Additionally, the use of blockchain will make the pass easily adaptable so that it can work with other state systems without requiring people to download and manage multiple apps.

“You have transparency where you need transparency, and absolute privacy when you don’t,” Treshock said of blockchain’s capabilities.

Chaos Breeds Cyber Risk

Cyber criminals have repeatedly shown their willingness to take advantage of chaotic situations in order to launch more successful attacks, and the vaccine distribution process will not be an exception.

John Farley, managing director of the cyber liability practice, Gallagher

While Treshock emphasized that the blockchain technology is quite secure, other aspects from vaccine anxiety to concerns about vaccines overheating could be used to drive a cyber attack.

Hackers have already tried to disrupt the cold chain that protects vaccine temperature during distribution using a phishing campaign, IBM researchers found.

“You really have to look at everyone in the distribution chain — logistics companies, transportation companies — hackers could attack any one of those,” John Farley, managing director of the cyber liability practice at Gallagher, said.

Some of the attacks might mimic those that hackers used early on in the pandemic: A cyber criminal sends a phishing email claiming to have vaccine doses, an unwitting official clicks the click and then the attacker locks the system and demands a ransom.

Attackers may go after critical health information and threaten to leak it, exposing an organization to HIPAA violations, in order to force a ransom, while others may turn to more sinister methods, including changing the temperature on smart refrigerators that may contain vaccine doses.

“You could have ransomware attacks, you could have criminal gangs,” Farley said. “Many of our devices these days are reliant on safe and secure connection to the internet, including refrigeration.”

Others attacks, however, may be more targeted on stealing data from the pharmaceutical companies that developed the vaccines.

“First and foremost, the researchers and the pharmaceutical companies have been targeted by nation state hackers, and the primary motivation behind those attacks has been the theft of intellectual property,” Farley said. “Stealing research that costs millions of dollars.”

Farley recommends that entities involved in vaccine distribution protect themselves by using multi-factor authentication and other cyber security tools that can detect which parts of a system are vulnerable. He also recommended that those involved make sure they appraise themselves of the cyber security risks faced by the other organizations they work with.

“Understanding how cyber attacks against a vendor or someone else down the supply chain that you may not directly be contracted with may impact your organization is absolutely critical,” he said. &

Courtney DuChene is a freelance journalist based in Philadelphia. She can be reached at [email protected].

More from Risk & Insurance