In May 2021, California Governor Gavin Newsom announced a “Vax for the Win” sweepstakes that will give away $116.5 million, with large cash prizes awarded in random drawings to dozens of lucky winners. Everyone who received a COVID vaccine was automatically enrolled.
“We have your information in our system,” Newsom said. The Mercury News reported that he was “referring to the millions of vaccination records in the California Public Health Department’s confidential, digital immunization information system.”
The state “maintains a confidential registry of all vaccine recipients,” CalMatters reports, noting the governor’s assurance that the names of the winners would be kept confidential unless the individuals volunteered to release their information.
But the confidentiality of the information in the state’s vaccine registry has a huge loophole through which the confidential data flows to a political consulting firm called Street Level Strategy, LLC.
“I’m being stalked by the state of California,” one Los Angeles resident told me recently. “I just got a call from a guy who told me he had my file and he saw I got the Pfizer vaccine but not a booster.” The caller identified himself as a “Street Level Campaigns” and said they had a contract with “public health” to help people make appointments to get boosters.
Here’s how Street Level Campaigns describes itself on its website: “Street Level Campaigns, LLC (SLC) is a grassroots consulting firm specializing in community organizing, voter contact and coalition building. Our clients include candidates, ballots, outreach campaigns, non-profit organizations and trade associations. SLC is an affiliate of our sister organization Street Level Strategy, LLC, a national public affairs consulting firm.
That description appears on a page opening a job for “Directors to lead teams of community organizers for political and public affairs campaigns.”
In response to questions about the contract, the California Department of Public Health (CDPH) said in an email: “MyTurn, the state’s vaccine appointment program launched by CDPH, shares a list of California -residents eligible for a booster with Street Level Strategy, LLC that includes names, age, gender, ethnicity, contact information and vaccination history to prioritize equity, with a focus on reaching communities disproportionately affected by the COVID-19 affected by the pandemic.”
However, the person who contacted me about the phone call from Street Level Campaigns did not make an appointment through MyTurn, but instead chose to go to a vaccination site. The next day, the person received a text from the California Department of Public Health. “Hello, congratulations on receiving your first dose of the COVID-19 vaccine,” it began, then listed the type of vaccine, the lot number, and the date and time it was received.
MyTurn, in other words, collected data from people who did not visit the MyTurn site and provided it voluntarily. Instead, the staff operating the vaccination site reported the data to the state. And now the state is “sharing” that data with Street Level Strategy, LLC.
In its emailed responses to questions, CDPH said the contract “includes terms and conditions that outline information privacy and security requirements,” and “provisions that limit the use and retention of individuals’ confidential information,” and “specific information security control Street Level Strategy must be in place to maintain and protect the security of the data.”
Let’s hope it’s enough, because the state of California has given this political consulting shop $12.7 million in contracts and access to a confidential digital registry of every California resident who has received a COVID vaccine. The contract was awarded without competitive bidding pursuant to the authority of the governor’s emergency declaration of March 4, 2020, even though work under this contract did not begin until July 16, 2021.
Who is Street Level Strategy, LLC?
The president and founder of Street Level Strategy is Pat Dennis. His profile on the company website says that before founding the firm, he “led grassroots operations for labor and independent expenditure committees in more than 50 congressional races across the country and worked as an organizer for the Service Employees International Union (SEIU) .”
Others on the team have resumes that include organizing and advocacy work for progressive groups and unions. The company markets the service to “build authentic, engaged and active grassroots coalitions of everyday people” to “shape policy outcomes at the local, state and national levels.”
CDPH said the contract’s “Exhibit F,” titled the “HIPAA Business Associate Addendum,” contains “multiple provisions limiting and restricting the retention or use of data provided to Street Level Strategy.” But shouldn’t this contract have gone to a company in the healthcare industry, one with experience handling confidential medical data?
In a June 2021 story headlined, “California vaccination records raise data privacy concerns,” the Mercury News reported that some experts had “fresh concerns about the privacy of California’s health data” as the state 50 exceeded million vaccine doses.
Lee Tien, a senior staff attorney at the Electronic Freedom Foundation, noted that the California Information Practices Act and HIPAA, the federal Health Insurance Portability and Accountability Act, impose confidentiality obligations on health care providers and state agencies, such as the California Department of Public Health, but he was concerned about the data security of local health agencies, where he said these laws do not apply.
Pam Dixon, executive director of the Oregon-based World Privacy Forum, told the Mercury News that the US Department of Health and Human Services has issued some emergency waivers from HIPAA penalties to allow telehealth and other services using Zoom, Skype and various enabling cloud-based services. solutions, and Becca Cramer-Mowder, legislative coordinator for the American Civil Liberties Union, agreed with Dixon that the federal waivers could make it easier for patient information to seep into the hands of data brokers.
“Other legal experts, however, are less concerned,” the Mercury News reported, citing Stanford Law School professor Michelle Mello, who said California “will have no direct involvement in providing companies with medical data.”
But the California Department of Public Health confirmed that the state collects the confidential health data, contact information and demographic characteristics of everyone who has received a vaccine and “shares” that data with a political consulting firm that happens to be contacting Californians. to organize and mobilize coalitions to “shape policy outcomes” for the firm’s paying clients.
Did you know that? Now you do.
Write Susan@SusanShelley.com and follow her on Twitter @Susan_Shelley