The biggest issue is whether businesses can use your personal information for purposes other than checking vaccination status.

Some of the European systems I've read about seem to discourage that, and the GDPR would also seem to prohibit it. But there's no willpower for such laws in the US, so we'd inevitably end up with the synergy of government and corporate power, like everything else. For instance, half the surveillance systems I listed in my other comment rely on abusing government-mandated identifiers.