Two state pandemic responses, built while they were happening

Context

In the spring of 2020 Maryland needed several things at once that it had no system for. Reach every contact of every positive case. Book residents into vaccination sites that did not exist yet. Run testing across half its counties. Generate the letters people needed to show an employer. And keep the state website standing while the Governor was live on television.

The state had a Salesforce instance, a health department under extraordinary load, and a deadline set by the virus rather than by a project plan.

Delaware came later and differently. Mid-pandemic, its original prime contractor went bankrupt. The state awarded us an emergency contract directly, so contact tracing there carried on without an interruption.

What we built

Eight workstreams over three years, and one decision underneath all of them: meet residents on text message rather than asking them to come to a web form. The people who most needed an appointment were the least likely to complete one. Older residents, people without broadband, people who will not download an app for a one-time task.

So a resident texts, gets offered slots, picks one, and receives a confirmation. No account, no app, no browser. The same channel then carried everything else: contact tracing conversations, weather closures, site changes, cancellations, test results. All of it integrated with the state's Salesforce, so the health department kept working in the system it already knew.

Maryland and Delaware ran separately throughout: separate data, separate provider credentials, and separate send queues, so one state's spike could not reach the other.

The workstreams

Named individually, because the response is usually remembered as the vaccination booking and it was considerably more than that.

Contact tracing

An SMS and email system that tracked and guided patients through contact tracing and quarantine, integrated with the state's Salesforce to generate and deliver automated messages and letters. Roughly 1.5 million cases processed. Later extended to Delaware under the emergency award.

Mass vaccination scheduling

An appointment engine for the state's mass vaccination sites, bookable entirely by text. On-demand notices for weather delays and site changes, pages to manage or cancel a booking, and a Salesforce-driven appointment lifecycle.

Community testing

A portal and appointment tracking system for testing sites across half of Maryland's counties.

The Governor's website

maryland.gov moved off Windows onto Linux, hardened to CIS Level 1, load tested and tuned to 150,000 requests a minute. Four working days, ahead of a press conference, because the alternative was the site falling over live on television.

Work excuse and release letters

Millions of letters generated for patients to give their employers, plus a workflow that let an employer independently verify a letter was genuine rather than calling the health department to ask.

covidLINK

Established and maintained covidLINK.maryland.gov, the state's public COVID information surface.

Infrastructure and disaster recovery

SOC 2 compliant AWS infrastructure configured for HIPAA data, hardened to CIS Level 1, with unified security logging and single sign-on. Load balancers and auto-scaling for spike traffic, and encrypted database restores tested on a schedule rather than assumed.

Advising the state

Identified problems alongside the client, designed the fixes, and coordinated with the other contractors in the room, including Ernst & Young, Enovational and NORC. Also provided Qualtrics SMS-compliance help and Twilio expertise directly to the state's Department of Information Technology.

Why it was hard

The interesting problems were not in the scheduling logic. They were that this was health data, under HIPAA, on infrastructure that had to pass a state security review, being built at emergency speed by a team that could not use speed as an excuse for a breach.

Load was the other one. Demand arrived in spikes tied to eligibility announcements and press conferences rather than to anything predictable. The same week we were asked to make the Governor's website survive a press conference, which meant rebuilding and hardening maryland.gov to handle 150,000 requests a minute, on Linux, to CIS Level 1, in four working days.

And the failure mode was not an error page. It was a person who could not get a vaccine appointment.

What shipped

Roughly 1.5 million contact tracing cases processed. More than a million vaccination appointments scheduled, peaking around ten thousand a day. Around 750,000 people vaccinated through the system. Testing across half of Maryland's counties.

Across both states, roughly 45 million text messages sent and received, plus millions of work excuse and release letters with an employer verification workflow behind them. And a state website that held at 150,000 requests a minute.

The infrastructure was SOC 2 compliant and configured for HIPAA data, hardened to CIS Level 1, with unified security logging and single sign-on.

What we learned

Meet people on the channel they already use. Every hour spent making the SMS path work returned more than any amount of work on the web form would have, because the constraint was never the interface, it was the assumption that the resident would come to us.

The other lesson is about emergencies specifically: the compliance work is not the thing that slows you down. Skipping it is. We passed the state security review because the infrastructure was built for it from the first week, and a rebuild under those timelines would not have been survivable.