A club I attend is now proposing proof of vaccination for continued membership. I tried to inform them of a KISS one time paper proof of vaccination to registry that other businesses I visit practice instead of on prem or 3rd party service scanning of our vaccination cards which contains PII of Real Name, DOB and for some, Medical Record Number, MRN They were too spooked by the need for health safety ("We must have a safe place!") to grasp the implications of building a honeypot ready for exploit or sell off. So now they have name, address, DOB, MRN, CC, what else is missing? I think the other data brokers will fill the gaps. This a business relationship, not an employer. I fear more businesses will go unchallenged with this convenience route.

https://abc7news.com/vaccine-cards-security-covid-19-coronav...

https://www.eff.org/deeplinks/2021/04/no-digital-vaccine-bou...

Now let's see where that MRN is embedded... http://dicom.nema.org/medical/Dicom/2016c/output/chtml/part0... http://www.j4jayant.com/2013/02/hl7-identifiers-person-patie...