Decentralized Open Platform for Vaccination—A German Example: COVID-19-Vacc

The COVID-19 pandemic has massively impacted the health of many people worldwide and poses significant challenges for our social, economic, and political life. Global vaccination should help the world overcome the pandemic and return to a “normal” life. In Germany, the Federal Ministry of Health presented its “National Vaccination Strategy COVID-19”, which describes the primary actors, elements, and activities required for the immunization of the German population. However, the implementation is challenging due to the federal organization of the German state in sixteen federal states. While essential processes such as vaccination rate monitoring and surveillance are planned centrally, the sixteen federal states are responsible for implementing the vaccination strategy in a decentralized manner. Furthermore, the European General Data Protection Regulation (EU-GDPR) imposes strict rules for processing and exchanging personal data. However, Germany is only a case in point. Governmental decisions always need to be implemented by regional and/or local actors, the number of which varies greatly depending on the country. This work addresses these challenges by proposing the COVID-19-Vacc Platform—an open and decentralized digital platform focused on vaccinations as a matter of example. The proposed platform model connects various actors and enables them to involve, conduct, and track the vaccination process while meeting all necessary data protection and security requirements defined by EU-GDPR. Using the DMS Reference Model as the theoretical framework, the blueprint of the COVID-19-Vacc Platform is developed, outlining the platform’s ecosystem structure, its interactions process model, and the service stack, defining how the proposed platform works on the operational level. Our COVID-19-Vacc Platform may help facilitate a fast and EU-GDPR compliant implementation of COVID-19 vaccination strategies. Beyond that, the proposed open and decentralized platform model might facilitate international interconnectivity and therefore the management of emerging global pandemics or other global health-related crisis.


Introduction
The COVID-19 pandemic caused by SARS-CoV-2 has massively impacted the health of many people worldwide since 2019, and still poses significant challenges for social, economic, and political life-in Germany, Europe, and worldwide. Different states use different strategies to tackle the COVID-19 pandemic and return to a "normal" life. In doing so, they are often pairing measures including temporary lockdowns, massive testing, and vaccines to reach a certain percentage of population immunization [1].
In Germany, the vaccination strategy is formulated in the "National Vaccination Strategy COVID-19" document [2], and legally stipulated by the Infection Protection Act [3]. Accordingly, immunization (i.e., the vaccination process to fight the SARS-COVID-19 virus) must be defined and planed on the national level. However, based on the Infection Protection Act and the inherently federal organization of the German state, the activities of the vaccination process have to be implemented decentrally by the sixteen federal states. This also applies to the surveillance and monitoring of vaccination rates, activities where various parties need to be involved and engaged in coordinating their activities and sharing data that goes beyond the vaccination process. In addition, all activities must comply with the national data protection legislation and the European General Data Protection Regulation (EU-GDPR) [4]. This ensures that the law is applied, as data monitoring and evaluation over the years or even decades goes hand in hand with corresponding long-term data storage.
However, Germany is only a case in point. Governmental decisions always need to be implemented by regional and/or local actors, the number of which varies greatly depending on the country. In addition to the fragmented landscape of actors involved at the national and federal levels, like in Germany, the complexity of the vaccination process imposes additional challenges on the organizational models and underlying information systems needed for implementation. When centrally made governmental decisions need to be implemented by regional and/or local actors, these actors often find themselves in a situation where they need to create either new solutions to implement these decisions, or use existing applications of their choice that they modify for this purpose. The result is a myriad of different solutions. Relevant German solutions either take into account the spread of infections, but do not support activities of the vaccination process, e.g., DEMIS [5] and SOMAS [6], In parallel to that, or cover only some aspects, like tracing infected people, e.g., CORONA Warn-App [7], luca-app [8], and digital vaccine certificates, e.g., Digital Green Certificate (DGC) [9], or they concentrate on providing physical infrastructure for the exchange of infection-related data, e.g., eDMP [10].
Therefore, there are calls from academia, healthcare professionals, politics, and ultimately the World Health Organization (WHO (https://www.who.int, accessed on 9 August 2021)) for integrated solutions that bring all the essential parties together and enable them to achieve the common goal of sustainable pandemic control [11]. To this effect, one approach uses digital platforms as technology-based organizational models to cope with the fragmented and complex healthcare scenarios [12,13]. Some examples are the platforming of healthcare in China that is built upon Tencent's network of healthcare players [12], and the UniPlat initiative [14]-a program aiming at digitally transforming all healthcarerelated services in the Kingdom of Saudi Arabia. However, these are centrally managed and orchestrated platforms that are also less suitable to meet the EU-GDPR and related restrictions, especially when management and storage of personal data are considered.
The main goal of this work is, therefore, to propose an open and decentralized platform model that is suitable to cope with all aspects of the National Vaccination Strategy COVID-19 and facilitate its implementation as per the Infection Protection Act. This open and decentralized COVID-19-Vacc Platform, which is focused on vaccinations as a starting point, connects various actors and enables them to involve, conduct, and track the vaccination process while meeting all necessary data protection and security requirements. For the modeling of our COVID-19-Vacc Platform, we leveraged the Reference Model for Distributed Market Spaces (Reference DMS) [15], using it as a theoretical framework for designing and blueprinting an open decentralized platform.
The main contribution of this is work is a blueprinted COVID-19-Vacc Platform represented by its: • Ecosystem model-that defines how the COVID-19-Vacc Platform works on the organization level; • Interactions model-that defines how the COVID-19-Vacc Platform works on the level of processes; • Service Stack-that defines how the COVID-19-Vacc Platform works on the operational level, thus facilitates the above-mentioned ecosystem and interactions model.
We consider the benefit of this work to be two-fold: firstly, the COVID-19-Vacc Platform model can serve as guidance (i.e., an outline) for the realization of vaccination strategies and thus facilitates a faster implementation of the overall COVID-19 vaccination strategy in Germany and other countries. Secondly, it can be used as a vehicle for analysis and modeling future healthcare scenarios. When immunization needs to be implemented in a decentralized manner or even more generic scenarios to be supported, an ecosystem of independent actors respecting data privacy stipulations is required. These ecosystems might even be connected internationally to facilitate the platform-based management of emerging global pandemics or other health-related crises. Since our platform model is open by nature, it can also be supplemented by other entities to enable more collaborative and engaging health scenarios with a wider variety of participants and stakeholders, and thus support open innovation going beyond the boundaries of individual states.
This work is structured as follows: Section 2 provides the theoretical background presenting the main aspects of the German COVID-19 vaccination strategy and platform modeling in general. Next, Section 3 examines the related work and explains the modeling approach we used to develop this work, followed by Section 4, which presents the overall objectives and design goals. Section 5 introduces our proposed COVID-19-Vacc Platform outlining its ecosystem model (Section 5.1), interactions model (Section 5.2), and the Service Stack (Section 5.3). Afterward, Section 6 discusses these outcomes in the light of identified objectives, and Section 7 closes this work with a summary and outlook of the future work.

Background
COVID-19 has quickly developed into a global pandemic and poses significant challenges for health, social and economic life. Although hundreds of clinical trials have been registered intending to discover effective treatments, there are currently no approved treatments or preventive therapies [16].
Therefore, different countries around the world were pursuing different strategies to tackle the COVID-19 pandemic. These strategies mostly combine temporary lockdowns of public life, including social distancing, wearing facemasks, additional hygiene measures, and massive tests. With the development and availability of multiple effective vaccines, states are turning towards vaccination as an essential measure to COVID-19 pandemic control [17]. Whereby the primary goal of the different vaccination strategies is to immunize a certain percentage of the population in order to reach the so-called "hardness immunity" [1]. However, the effects of different national strategies cannot be assessed yet. Still, it can be observed that a global COVID-19 strategy goes toward "vaccinating as many people as fast as possible" to achieve the hardness immunity and thus bring the COVID-19 pandemic under control.
In the following, this section provides the theoretical backgrounds of this work. It first gives an overview of the German COVID-19 vaccination strategy, which needs to be supported by the proposed platform model and describes the phases of the underlying vaccination process and related activities. Afterward, it discusses the term "platform" as an organizational model and reviews different approaches to platform modeling.

COVID-19 Vaccination Strategy in Germany
The COVID-19 vaccination strategy in Germany is defined by the Federal Ministry of Health (BMG (http://www.bundesgesundheitsministerium.de, accessed on 9 August 2021)) and published as the "National Vaccination Strategy COVID-19" [2]. It defines all the essential components, elements, and activities required for the immunization of the German population against the SARS-CoV-2 virus, the objective being that the application of global standards and a timely evaluation of the vaccines in the course of their propagation and use are guaranteed.
For the implementation of the "National Vaccination Strategy COVID-19", three aspects are considered essential [2]: firstly, the decentralized implementation that is triggered by the federal organization of the German state. According to the Infection Protection Act [3], its sixteen states are responsible for implementing the vaccination strategy. The second important aspect is implementation of the surveillance and monitoring of the vaccination rate-two essential processes that are planned centrally, but must be implemented in a decentralized manner. The third aspect is national and European data protection legislation, ensuring that all activities of the vaccination process are implemented accordingly [18].

Decentralized Implementation Caused by the Federal Organization of the German State
Depending on the sufficient availability of vaccines, the national vaccination strategy defines possible stages to the immunization of the German population as illustrated in Figure 1.  In stage I (A + B) "Targeted, centrally orchestrated immunization"-when little vaccine is available, and minimal experience with vaccines exists-COVID-19 vaccinations are carried out via vaccination hubs in a targeted and centralized matter. "Targeted" addresses the need to prioritize initially limited vaccine doses and the expected availability of different vaccines, and the centralized manner addresses the need for increased oversight by the BMG, including a centrally orchestrated supply and data-supported monitoring of vaccinations. However, due to the federal organization of the German state, the sixteen states are responsible for organizing the vaccination centers. These local vaccination centers are accountable for the vaccination process and the proper vaccination of the individuals who are to be vaccinated on site. The prioritization of groups of individuals, however, is determined by the Standing Committee on Vaccination (STIKO (https://www.rki.de/EN/Content/ infections/Vaccination/recommandations/recommendations_content.html, accessed on 9 August 2021)), which is organized on the national level by the Robert Koch Institute (RKI (https://www.rki.de, accessed on 9 August 2021)), the government's central scientific institution in the field of biomedicine. Furthermore, the vaccination process is conducted with the involvement of local actors such as the Public Health Service (https://www.bvoegd.de, accessed on 9 August), National Association of Statutory Health Insurance Physicians (KBV (https://www.kbv.de/html/, accessed on 9 August 2021)) and their associated federal states, healthcare professionals, or medical staff from local hospitals.

Stage I A
In stage II, "Broad, decentralized routine immunization"-when vaccines are widely available and ample experience with vaccines exists-COVID-19 vaccinations are to be made in a fully decentralized manner. Thereby, "decentralized" refers not to a higher level of decentralization between federal states, rather than to a decentralized standard supply system among federal states. In phase II, other external actors such as aid organizations (e.g., German Red Cross (https://www.drk.de, accessed on 9 August 2021), the German Armed Forces (https://www.bundeswehr.de, accessed on 9 August 2021)), or other authorized actors can carry out the preparation and implementation of the vaccination process.

Vaccination Rate Monitoring and Surveillance
Vaccination rate monitoring is necessary for the control and adaptation of the vaccination strategy. It requires valid and timely data on the uptake of the vaccinations (vaccination quotas), which are the basis for analyzing vaccination behavior and the success of the accompanying information campaign. If, for example, there are particularly low vaccination rates in certain population groups or there are large regional differences between federal states, the information campaign needs to be adapted. The vaccination rates also serve as a "denominator" for classifying efficacy and safety (differentiation between individual cases and representative based on the total number of all vaccinated individuals). The information necessary for vaccination rate monitoring is information on the individuals being vaccinated (i.e., age, sex, place of residence (rural or urban district)), information on vaccination (i.e., place of immunization, vaccination date, vaccine product (name and batch number)), as well as the vaccination dose administered (i.e., first vaccination or, if applicable, follow-up vaccination). Furthermore, this information must be submitted to the RKI as far as possible to guarantee a timely analysis and transparency about the implementation of the COVID-19 strategy. These results also need to be available to other actors (e.g., BMG and Paul Ehrlich Institute (https://www.pei.de/DE/home/home-node.html, accessed on 9 August 2021), the federal institute for vaccines and biomedicines) in an aggregated manner.
In addition to monitoring the vaccination rate, active monitoring of the effectiveness and safety of the vaccine products is absolutely essential. The focus of active monitoring, or so-called surveillance, is on worldwide extensive clinical studies, in which clinical efficacy and safety of the vaccines are permanently evaluated for approval because only vaccines with evidence of a positive benefit-risk balance can be included in the supply. Due to the accelerated development and the limited observation period in the studies, continuous monitoring and collection of further data in the broad application context is necessary to identify additional potential risks as soon as possible. The benefit and risk assessment of vaccines is a continuous process that ranges from vaccine development and the implementation of clinical trials before approval to post-marketing surveillance. While pre-market clinical trials provide important information about the safety and efficacy of vaccines, post-market studies are essential to provide detailed information on the vaccine's safety (e.g., the occurrence of rare adverse effects) in more extensive and more homogeneous populations. The monitoring of the effectiveness, safety, and duration of protection of vaccines (after they have been injected) ensures that the favorable risk-benefit profile can be continuously checked and used to adapt the vaccination recommendations as new findings are available.

Data Protection
The implementation of the "National Vaccination Strategy COVID-19" requires collecting, processing, and storing personal data for different purposes [18]. Among other data, these are personal data related to: • Scheduling vaccination appointments (e.g., time and location of an appointment as well as person's name, address, date of birth, and contact data); • Documenting vaccinations and statistical data (e.g., consent for vaccination, date of administration, vaccine manufacturer, vaccine lot number, pre-existing conditions, person's ethnicity and sex); • Billing insurance companies; • Providing and managing access to adverse reactions.
The European General Data Protection Regulation (EU-GDPR) and other data protection laws in Germany recognize a litany of privacy rights aimed at giving individuals more control over personal data. These rights are, e.g., the right to be informed, the right of access, the right to rectification, the right to restrict processing, and the right to data portability [4]. Although the collection and processing of the above-mentioned data as part of the vaccination process is allowed by different laws and a treatment contract in Germany [18], privacy rights-according to the EU-GDPR-must be ensured. Moreover, information security must be given, and only legitimate participants of the vaccination process may access necessary personal data.

Vaccination Process
The vaccination process for the immunization against SARS-CoV-2 virus follows the standardized method of the vaccination journey [19]. The vaccination journey includes activities required to administer a vaccine under the consideration of necessary medical and administrative standards and norms.
As illustrated in Figure 2, the vaccination process spans three main phases that encompass activities from the Pre-Vaccination and the Vaccination to the Post-Vaccination phase: • Pre-Vaccination phase-includes activities in which the knowledge about available vaccines is acquired, the availability of a certain number of vaccines ensured, and patients (i.e., individuals to be vaccinated) are selected in terms of scheduling a vaccination appointment. • Vaccination phase-includes activities in which the patient is prepared for vaccination, informed about potential side effects and adverse events, and the vaccination process, including injection, is executed. • Post-Vaccination phase-includes activities in which post-injection monitoring is conducted, and post-procedure administrative tasks are completed. This involves recording vaccination-related data and any side effects that have been occurred during the vaccination procedure, issuing vaccination certificates and other administrative tasks like billing or data transmission.
Vaccination process

Post-injection monitoring
Post-procedure administrative tasks Figure 2. Phases of the vaccination process and related activities (based on [19]).
As such, the vaccination process encompasses activities necessary to ensure compliance with globally uniform standards. But to include a timely evaluation and active monitoring-as required by the COVID-19 vaccination strategy-the vaccination process needs to be extended. As to considerations in Section 2.1, the extended vaccination process should include active data-based monitoring and surveillance as an instrument for ensuring that the vaccine's risk-benefit profile can be continuously checked and modified in the form of recommendations, as new findings become available.
As depicted in Figure 3, the extended vaccination process includes the additional phase Surveillance, which encompasses activities related to monitoring and tasks relevant for permanent risk assessments and knowledge dissemination regarding clinical studies and statistics on adverse events and side effects.

Platforms and Platform Modeling
The term "platform" has evolved over the years and is currently used to describe different things in many contexts. Platforms generally connect people and organizations for a common purpose or share of a common resource [20][21][22]. In this work, we follow an extended definition proposed by Cusumo et al. [23], defining a platform "as a technologybased organization model that brings together individuals and organizations so they can interact and innovate in ways not otherwise possible, with the potential for nonlinear increases in utility and value".  Depending on their primary function, existing platform models can be divided into two basic types: innovation and transaction platforms [20,23]. Innovation platforms usually consist of technological building blocks shared and used to create new complementary products or services (e.g., Apple iOS or Amazon AWS). Diversely, transaction platforms are mainly large intermediaries that enable people and organizations to exchange information (e.g., Facebook, Twitter) or to buy, sell, or access various goods and services (e.g., Amazon and Uber).

Pre-Vaccination
In the context of the COVID-19 vaccination strategy, the transaction-oriented model is considered suitable. On the one hand, because the primary purpose of a platform required to support COVID-19 vaccination strategy is to connect relevant parties such as individuals (e.g., persons to be vaccinated), institutions (e.g., healthcare professionals, vaccination hubs), organizations (e.g., vaccine manufacturers, suppliers), as well as thirdparties like researchers and members of the broader medical community, like the World Health Organization (WHO). And on the other hand, because it needs to enable all relevant parties to collaborate and accomplish necessary activities, thus providing services that support the vaccination strategy as a transaction process among involved parties.
The literature on the modeling of transaction-oriented platforms suggest that there are two main approaches. The first modeling approach, which uses practitioner models, is based on observing many instances available in practice, extracting common elements, and modeling them considering the requirements of the application context (e.g., [21,24,25]). This approach is suitable when a sufficient number of relevant instances for the particular application domain is available. The second modeling approach addresses the opposite case when the application domain, such as implementing a vaccination strategy, is not researched enough, but can still draw similarities to other platform models. It is based on leveraging and adjusting existing conceptual frameworks, i.e., reference models, to analyze and design a transaction platform's elements regarding the underlying domain and its contextual requirements. These reference models are more abstract than the practitioner models, but contain multi-views that facilitate a differentiated modeling process by separating concerns. Frameworks by [26,27] and the well-known St. Gallen Media Reference Model [28,29], as well as newer follower models addressing especially decentralized models (e.g., DMS Reference Model [15]) are representatives of this modeling approach. The DMS Reference Model (see Figure 4) is a multi-view and multi-dimensional framework that describes how a decentralized transaction-based platform model (i.e., a reference DMS) works on the strategic and operational levels, and how its instances unfold during different life stages.
The view dimension describes a reference DMS that considers four different points of view. The ecosystem view maps the organizational structure and outlines actors, roles, and activities that need to align for the ecosystem's value proposition to materialize, the interaction view specifies the core interactions among actors taking different roles, the service view defines services that a reference DMS must provide to its actors to facilitate the interactions within the ecosystem, and the infrastructure view describes the technical infrastructure as the groundwork for realizing the required service stack. The phases dimension defines a reference DMS as a transaction-oriented environment. It comprises five phases of knowledge, intention, contract, settlement, and follow-up, which are essential to define, describing how to initiate, arrange, and settle contractual agreements for market transactions in the most efficient manner. The stages dimension comprises life stages a reference DMS might undergo during its design, development, and growth. These are the design, ignition, and maturity stage. While each of them focuses on different concerns, the modeling activities mostly concentrate on the design stage.

Related Work and Approach
This section first overviews the related work, the existing solutions and concepts regarding pandemic management, and then it introduces the methodological approach we used to develop this work.
DEMIS [5] and SOMAS [6] are two prominent solutions purposely developed to support the German pandemic management and control. DEMIS, standing for "Deutsches Elektronisches Melde-und Informationssystem für den Infektionsschutz", is an information system aiming to enable the reporting of positive SARS-CoV-2 tests according to the Infection Protection Act. It covers the process where laboratories send the reports to DEMIS. These reports can be called up by the health authorities from DEMIS, depending on their responsibility as to the Infection Protection Act. The DEMIS infrastructure currently consists of centralized and decentralized components and services. Whereby messaging and delivery services are centralized, reporting services are decentralized (e.g., DEMIS-Adapter as an application interface for laboratories, DEMIS-Importer for the connection of health authorities involved in tracking infections, DEMIS-Analysis Tools for the pseudonymization and analysis of infection-related data). While DEMIS is focused on infection reporting and analysis, SOMAS ("Surveillance Outbreak Response Management and Analysis System") is a mobile digital business management system for epidemic control. It is currently in use by a few German federal states, in particular a specialized version for contact person management supporting public health authorities in identifying and monitoring contact persons (i.e., SOMAS-ÖGD). SOMAS-ÖGD is running on virtual servers, whereby only employees of the respective health authority have access to the data; the health authority is the sole owner of the data. Both DEMIS and SOMAS operate within the legal requirements of the Infection Protection Act and fulfill the European General Data Protection Regulation (EU-GDPR). Still, they are focused only on infection spreading and the health authorities as primary actors. They are falling short of integrating various actors necessary to support the activities going beyond the infection spreading as defined by the National Vaccination Strategy. In addition, eDMP [10] ("Elektronischer Datenaustausch im Disease-Management") was introduced to provide XML interfaces for the electronic mapping of DMP sheets. These interfaces are created and maintained based on an agreement with the central associations of the health insurance companies and health authorities. As a technological infrastructure, eDMP has vast potential to integrate further necessary actors, but it requires each actor to build upon it, which are time and cost-consuming tasks.
In parallel to that, there are mobile applications (i.e., apps), partly covering the same aspects as DEMIS and SOMAS but addressing different user groups like tracing infected people, e.g., CORONA Warn-App [7], luca-app [8], and digital vaccine certificates, e.g., Digital Green Certificate (DGC) [9]. CORONA Warn-App is an open-source project based on technologies with a decentralized approach. It notifies users if they have been exposed to the SARS-CoV-2 virus. In case of a positive test result, users are asked to voluntarily upload their temporary keys of up to the last 14 days to the server. If confirmed, the server adds the user's keys to the SARS-CoV-2 approved list, which is regularly broadcasted to all apps, whereby health authorities are not included, only the app users. luca-app resolves this by offering a complete contact tracing in exchange with the health authorities and/or other interested parties like restaurants, cultural and sports organizations. In addition, some apps address the vaccination process by supporting a fast check of tested and vaccinated persons, e.g., CovPassApp [30] or IATA Travel Pass [31]. They allow individuals to store and manage certifications for COVID-19 tests or vaccines and share them with, for example, border authorities requiring testing or proof of vaccination as a condition of travel during and after the COVID-19 pandemic. Even though some of the apps mentioned above consolidate certain functions that naturally belong together, e.g., CORONA Warn-App also supports vaccination certificates, these apps are fragmented and only partly contribute to the pandemic management and control.
Furthermore, the literature on digital platforms suggests that there are initiatives to use platforms as technology-based organizational models to cope with the fragmented and complex healthcare scenarios [12,13]. As mentioned above, some examples are the Chinese healthcare platform built upon Tencent's network of healthcare players [12], and the UniPlat initiative [14]. UniPlat is a mega platform aiming at digitally transforming all healthcare-related services in the Kingdom of Saudi Arabia. However, these are centrally managed and orchestrated platforms that are also less suitable to meet the EU-GDPR and related restrictions, especially when management and storage of personal data are considered. In addition, other platform solutions have been proposed. SARS-CoV-2 RapidPlex [32] is one example of a technology-platform, designed to support testing and ensuring reliable results. Another example of a platform solution used in the context of COVID-19 vaccination is the global database of COVID-19 vaccinations by [17]. It is a data-based platform widely used by journalists, researchers, and the public. As a global dataset, it aims to track the scale and rate of vaccination worldwide. Still, as with the apps mentioned above, such platform solutions address only a fragment or a set of activities of a complex health case scenario such as pandemic management and control. Neither of them does recognize the necessity of supporting a pandemic scenario as a whole and integrating a wider variety of actors typically involved in such complex scenarios.
In conclusion, to our best knowledge, there are no existing solutions that cover the objectives of the National Vaccination strategy in a decentralized but integrative way. Consequently, we argue that a new organizational model is necessary-a platform model that recognizes the importance of an open and decentralized organizational model to support different actors to engage in activities required to carry out the vaccination process considering globally uniform standards and EU-GDPR.
For the modeling of our COVID-19-Vacc Platform, we used and adjusted the DMS Reference Model described (see Figure 5). Due to its structured modeling guidance, it considers decentralization an integrated aspect of the modeling process. The adjustment addresses the specificities of the extended vaccination process (cf. Section 2.2), and thus encompasses the Pre-Vaccination, Vaccination, Post-Vaccination, and Surveillance phases. These are highlighted in Figure 5a. Step 1 Step 2 Step 3 Step 4  The modeling steps and related activities we conducted follow the recommendations of the design stage of the adjusted DMS Reference Model. As shown in Figure 5b it includes the four steps in which an instance of a COVID-19-Vacc Platform is blueprinted; that is, when its core entities and aspects are modeled (i.e., Ecosystem Model, Interactions Model, Service Stack, and Technical Infrastructure). These are: • Step 1-to define main objectives of a COVID-19-Vacc Platform, and based on that, to outline the COVID-19-Vacc Platform:Ecosystem structure that embraces actors, roles, and core activity flows they need to align with; • Step 2-to define COVID-19-Vacc Platform:Interactions, core processes necessary to enable the interactions among actors within the ecosystem; • Step 3-to define COVID-19-Vacc Platform:Services required to support the identified interactions on the operational level; • Step 4-to design and deploy COVID-19-Vacc Platform:Infrastructure required to realize the platform's services on the software and hardware level.
In this work, however, we concentrate on the activities of the first three steps. Concerning the infrastructure of a COVID-19-Vacc Platform (i.e., its architectural and technologyrelated aspects) we refer to our earlier work. In [33,34] we introduced and prototypically implemented a strictly decentralized and highly scalable software-system architecture, which can be used as a starting point for Step 4 while considering the concrete realization and deployment of a COVID-19-Vacc Platform.

Overall Objectives
The objectives identified as primary design goals that a platform as an organizational model needs to meet in order to comply with the German "National Vaccination Strategy COVID-19" (cf. Section 2.1) are the following.
Objective 1-Facilitating decentralization and openness. Due to the federal setup of the German state as an underlying organizational structure, a COVID-19-Vacc Platform needs to follow the principles of decentralized implementation. Such a platform model needs to recognize and cope with local diversity and differences among different federal states without a central instance of control-as all states are equal in their rights and responsibilities. At the same time, it needs to provide a basic organizing structure or a minimum viable formation each federal state can join and become a member of at its own pace. Furthermore, such a platform model has to be open to new actors that might want to join further down the road in implementing the vaccination strategy.
Objective 2-Enabling the vaccination process. On the operational level, a COVID-19-Vacc Platform needs to provide for the critical functions required for enabling activities related to the four phases of the vaccination process, i.e., the pre-vaccination, vaccination, post-vaccination, and surveillance phase (cf. Section 2.2).
Objective 3-Ensuring information security and data protection during all phases of the vaccination process. All information stored and manipulated by a COVID-19-Vacc Platform and its underlying information systems needs to be aligned with regulations defined by the European General Data Protection Regulation (EU-GDPR) and other data protection laws (cf. Section 2.1.3). Consequently, privacy rights must be ensured and all personal data need to be anonymized, and as such to be used as metadata for statistics and surveillance. In the surveillance phase, personal data should only cease to be anonymous if the person to whom the data belongs experiences side or long-term effects. In practice, this may be an Healthcare Professional (HCP) who may look at the patient's disease symptoms that occurred long after the vaccination. If these symptoms are directly or indirectly linked to the vaccination, it must be possible to trace them back to the vaccination dates.
Objective 4-Simplicity of use, integration, and management. For a COVID-19-Vacc Platform, existing technologies need to be utilized in a way to implement services that are simple to use, easy to integrate and manage. Therefore, a higher level of automatization has to be reached by providing tools and services that support the vaccination process, but also each of the actors involved. For example, these can be well-defined, context-aware service interfaces for scheduling, identifying vaccinated persons (e.g., vaccine certificate), statistics, and dynamic service composition and analytics possibilities.
Objective 5-Easy to set up, robust, scalable, and modifiable. A COVID-19-Vacc Platform and its underlying software systems and well as its technical infrastructure need to be easy to set up on the deployment level and be robust regardless of its decentralization. Besides, it must be scalable vertically but also horizontally. Vertically in the sense of being able to integrate all sixteen federal states regardless of their intensity of use, without provoking failures, and horizontally to incorporate a broader range and variety of involved actors, which might take different roles within the platform's organizational structure. Moreover, a COVID-19-Vacc Platform must be modifiable in its structure and evolve in its mode of operation to cope with possible changes made to the vaccination strategy as a result of changes in infection numbers.

Blueprinting of COVID-19-Vacc Platform
This section presents the blueprint of the proposed COVID-19-Vacc Platform aiming at meeting the afore-described overall objectives. While this work focuses on the vaccination process as a matter of example, vaccinations are to be seen as a starting point, from which this proposed platform model can be expanded as needed in the management of global pandemics or health-related crises. As to Figure 6, the blueprint summarizes the primary outcomes of each of the modeling steps and related activities (cf. Figure 5b), providing an overview of the main findings as explained in the following.   Figure 5b).

COVID-19-Vacc Platform:Ecosystem
The ecosystem model presented in Figure 7 maps the organizational structure of the proposed COVID-19-Vacc Platform as an ecosystem. It outlines actors, roles, and primary activity groups and explains how identified actors and activities need to link and align to realize the ecosystem's value proposition.

Value Proposition
The overall objectives (cf. Section 4) determine the value proposition of the COVID-19-Vacc Platform. It is set up as an open, decentralized platform that supports the German COVID-19 vaccination strategy by connecting different involved parties and enabling them to engage, conduct and trace the vaccination process while fulfilling the all-necessary data privacy and security requirements.

Activities
Activities necessary to be conducted by the COVID-19-Vacc involved parties (i.e., actors) are those defined by the extended vaccination process (see Section 2.2). They can be divided up into three main groups. As per Figure 7 (top right) these are: • Vaccination-activity flows related to the vaccination process, i.e., scheduling and recording of vaccination-related data and administrative tasks; • Surveillance-activity flows related to the monitoring, knowledge dissemination, and data management; • Ecosystem Foundation-activity flows necessary to form and run a decentralized ecosystem and to ensure that rules, norms, and standards are implemented.

Value Proposition
COVID-19-Vacc Platform that supports the German COVID-19 vaccination strategy by connecting different actors and enabling them to engage, conduct and trace the vaccination process, while fulfilling the all-necessary data privacy and security requirements.  Figure 7. Ecosystem model of the COVID-19-Vacc Platform.

Actors and Roles
The actors expected to participate and accomplish these activities in the COVID-19-Vacc ecosystem are involved parties, including individuals, organizations, institutions, and third parties. As shown in Figure 7 (bottom right) we identified (at least) nine roles actors might take on: • Individual-The individual can be a natural person or a legal entity. In our application example, the individual is a person who wants to be vaccinated as part of his or her vaccination journey, either once or several times. Thereby, it is important that the active use of the platform is optional for the individual, so that the individual can still get vaccinated without the use of a platform interface. The individual's data will be processed by the platform nevertheless. Legal entities, i.e., companies, are included here since companies as a whole may also become engaged in vaccinations in a broader version of the vaccination journey; • VH (Vaccination Hub)/HCP (Healthcare Professional)-The Vaccination Hub primarily represents the vaccinations sites needed to mass-vaccinate the population. Healthcare professionals can also be doctors' offices and hospitals. This overarching grouping of the vaccination infrastructure serves in particular to facilitate the scheduling of appointments and the supply of vaccines to the population; • HCI (Healthcare Intelligence)-In our application example, healthcare intelligence institutions are the evaluating and advisory bodies that also make recommendations for action. In the example of the Federal Republic of Germany, this can be the Robert Koch Institute (RKI), the Paul Ehrlich Institute (PEI) or others. In our application example, these institutes are sinks for information on infection figures and at the same time sources of expertise, such as recommendations for action to the federal government and subordinate agencies. The HCIs also provide forecasts and produce statistics.
They, themselves, are sources of information for the broad media and providers of information to the population; • PHS (Public Health Services)-Public health services are governmental authorities, such as the Federal Ministry of Health, where all federal decisions are made. These public services exist at the state level as a health center or state department and at the municipal level as a health department. For example, the state ministries are responsible for scheduling vaccination appointments and organizing vaccinations in nursing homes; • Service Provider-Service Providers provide all services related to the vaccination journey. Examples include vaccine manufacturers, hygiene product manufacturers, suppliers, logistics, and waste management. Service Providers are grouped into one role here, but can take on additional roles in the platform infrastructure; • Technology Provider-The technonolgy provider provides all services that ensure the technical implementation of the approach described here. The role of the technology provider is not a service role, since technology must be standardized to the extent that changes in the platform environment can be adapted quickly by all other roles. If the technology provider were part of the service providers, it would also be subject to the changes and would not be able to deliver a solution that is independent of these changes. The technology provider works closely with the Rules and Standards Agency (RUSTA); • Rules and Standards Agency (RUSTA)-The Rules and Standards Agency represents all rules, standards and norms that apply in the platform environment. All roles, without exception, must adhere to the specifications of RUSTA. Changes to the standards are also evaluated and implemented by RUSTA. It is the regulation owner of the platform. The regulations refer in particular to the correct implementation of laws and regulations (e.g., European General Data Protection Regulation (EU-GDPR)) in the respective federal state in which the platform operates and the technological standards implemented by the technology provider; • Data Processor-The data processors are summary roles around vaccinations and the vaccination journey. These are, e.g., science, statistics, media without direct source reference, and others. From the perspective of the decentralized platform, the data processors are exclusively data sinks and do not provide any data back to the platform and its roles.

Positions
For the stated value proposition to realize, the definition of the necessary activities and the identification of actors who need to undertake these activities, as well as the assignment of roles, are required but not sufficient. The different actors in the COVID-19-Vacc ecosystem need to align around the activities and take on a dedicated position in the overall value creation in order to create value. As illustrated in Figure 7 (bottom left), positions provide an overview of where in the flow of activities the identified actors need to be located. Single roles can contribute to several activities, and specific activities might require several roles to engage. For example, to enable vaccination-related activities, individuals, VH/HCP, and service providers need to align, or to support data management, actors taking the role of a service and technology provider, RUSTA, and the data processor are considered essential.

Links
Links illustrate how the actors of the COVID-19-Vacc ecosystem need to interact, and specify their connections. Figure 7 (upper left) visualizes these connections (i.e., links) in the form of a flow diagram, which outlines the overall pattern of exchanges within the COVID-19-Vacc ecosystem. The focus lies on the vaccination process, both for individual and VH (Vaccination Hub) or HCP (Healthcare Professional), and the visualization of the most important interactions with other roles and resulting exchanges. Thereby the nodes represent actors performing a particular role, and the arrows the essential interactions indicating the "value exchanged" between these roles. Solid lines denote the so-called "tangible" exchanges, such as vaccines in the case of an individual or data in regards to a data processor, HCI (Healthcare Intelligence), and PHS (Public Health Services).
Dashed lines indicate an additional value that is considered "intangible" like feedback or information. Such additional exchanges are considered valuable as they can increase the overall value of the COVID-19-Vacc Platform for its current and future actors, and thus increase trust and ensure the success of the underlying vaccination strategy.

COVID-19-Vacc Platform:Interactions
The interaction view specifies the core interaction processes among actors taking on different roles at the operational level. In this case, it concretizes the previously described phases (Pre-Vaccination, Vaccination, Post-Vaccination, and Surveillance). From a highlevel perspective, these processes and the corresponding actors are illustrated as CMMN (https://www.omg.org/cmmn, accessed on 9 August 2021) diagram in Figure 8.  The core interaction processes can be specified and, in practice, take on many different forms. The COVID-19-Vacc Platform supports each of these processes by connecting actors and providing common resources. For example, one of many possible concretizations of the process "generate statistics" in the surveillance phase is the analysis of the effectiveness of measures against COVID-19. For instance, data available on the platform enables data scientists to analyze data about severe courses of the disease in comparison with specific areas, family backgrounds, working from home vs. coming to the office and so on. Through anonymization the platform enables such statistical evaluations and publication of data while protecting data privacy.

Post-Vaccination
Another example of a concretized core interaction process is illustrated as BPMN (https://www.omg.org/spec/BPMN/2.0/About-BPMN/, accessed on 9 August 2021) diagram in Figure 9. The figure illustrates an example of the "prepare patient" process, which is part of the vaccination phase and comprises activities, such as measuring the individual's body temperature and checking the ID before he or she gets inoculated. The process is shown from a VH (Vaccination Hub) perspective, which means that only activities assigned to participant roles on the side of the VH, in this case a receptionist and a vaccinator, are modeled. Two more process participants, namely the individual and the COVID-19-Vacc Platform, are graphically connected to the activities where they are involved. The modeled process starts when an individual shows up at the VH and ends when the individual is prepared for vaccination. However, exceptional situations, for example when the individual has a raised temperature, can lead to the process being terminated, with the individual not being allowed to get inoculated or the vaccination being called off in the end. The COVID-19-Vacc Platform is involved throughout the process, for example by providing information about existing appointments and by allowing to document identity checks, the information about possible side effects, allergies, and so on.  Figure 9. Exemplary patient preparation process from a vaccination hub (VH) perspective.

COVID-19-Vacc Platform:Services
The COVID-19-Vacc Platform must provide three kinds of services: Foundational Services and Governance Services, which form the basis of the platform and are the same as in other decentralized platforms [15], as well as Specialized Services, which make the above-mentioned interactions possible. All services together build a Service Stack that is shown in Figure 10. The concrete services are explained below.

Foundational Services
The Foundational Services allow the participants of the platform to communicate directly with each other. Therefore typical peer-to-peer services like the discovery of another participant and the transfer of data are required [35]. Additionally, services for the secure operation of the platform are necessary. Thus, the following services need to be implemented [15].

•
Discovery allows peers to find other peers on the platform; • Messaging enables direct communication of two participants; • Locating and Routing helps to find the optimal path from one participant to another for a message; • Security ensures that only authorized peers can participate and have access to shared data; • Reliability service ensures the operational safety and trustworthiness of the platform.

Governance Services
Governance Services form the intermediate layer between Foundational Services and Specialized Services, and provide general governing functions. Basic Governance Services are [15]: • Membership, service that allows for the registration of participants and offers additional functions that are related to membership, like changing the attributes of a participant or deleting an account; • Monitoring constantly monitors compliance with the rules that are defined by RUSTA; • Institutional History logs all events happening on the platform and thus contributes to the transparency and trust of all platform members; • Anonymization: Because of the handling of health data, which is a special category of personal data and whose handling is therefore prohibited in principle (Art. 9 EU-GDPR), anonymization is essential for the platform. This service allows the anonymization (or pseudonymization) of data, that can be used, for example, for statistics.

Specialized Services
Specialized services are located above the service stack. They define all functions that are not generally required for the operation of a platform, but form the main functionality of the COVID-19-Vacc Platform. While the foundational and governance services are relevant in all phases of the vaccination process (c.f. Section 2.2), most of the specialized services are only needed in one phase. Therefore, the following description is grouped by the phases of the vaccination process.

Pre-Vaccination •
Resource management is the main administrative service. It combines warehouse management and personnel management depending on scheduled appointments; • Market overview especially on the vaccines, is necessary for effective resource allocation; • Procurement is responsible for ordering and delivering the vaccine and all kinds of consumables like masks, syringes, etc.; • Scheduling is a service that allows individuals to make appointments at VHs or HCPs (Vaccination Hubs or Healthcare Professionals). Data transmission passes all relevant data and statistics to authorized participants.

Surveillance
• Data Science, a service which transforms the plain data to knowledge, which can be used by other services in the surveillance phase; • Reporting is a service that generates regular reports that will be sent to subscribers; • Publishing of work results in scientific publications, press releases, or leaflets for public information.
Additional to the services above, there are specialized services that can not be assigned to one phase: • Billing is a service that allows the billing of different kinds of goods and services among the different participants: A Service Provider (i.e., the manufacturer) charges the VH (Vaccination Hub) for the delivery of vaccination doses and consumables. The VH charges another Service Provider (i.e., a health insurance company) for vaccinating one of their customers. A HCI (Healthcare Intelligence Institution) charges PHS (Public Health Services) for their work, etc.; • Accounting allows the general bookkeeping of all participants.
While the foundational and governance services are more or less relevant for every participant of the ecosystem, most of the specialized services are only valid for a subset of those participants, therefore, the relevant participants are listed in Table 1. In the pre-vaccination phase, resource management is the key for VHs or HCPs (Vaccination Hubs or Healthcare Professionals), because they need to keep track of their warehouses and other resources, like personnel. In addition, suppliers, which are one kind of special providers, need the service to assign their limited goods to their customers. Different service providers can potentially participate in this service, if one of the VHs/HCPs decides to outsource their resource management. The market overview and procurement services are used by the same participants. The scheduling service is always used by the combination of an individual and a VH or HCP, respectively. However, it can also include a service provider that takes care of the scheduling.
All services in the vaccination phase naturally involve the individual to be inoculated, and a VH/HCP.
The services in the post-vaccination phase involve different actors: The side effects service involves a vaccinated individual who reports a side effect to a VH or HCP. The statistics service receives information from the VHS, HCPs, and service providers. Thereafter, HCI (Healthcare Intelligence) institutions, PHS (Public Health Services), and other data processors use this data for statistics. However, VHs and HCPs may also create their own statistics. Finally, VHs and data processors use the data transmission service to send their data to HCI.
In the surveillance phase, only data processors and HCI are involved in all services. Across all phases, actors need a billing service, as described above. The accounting service is also necessary for most of the participants, but not for the individual, because unlike the others, it has no obligation to do accounting. Specialized services may vary as the objectives of the COVID-19-Vacc Platform unfold.

Discussion
So far, we have introduced the blueprint of the COVID-19-Vacc Platform as a solution to support the "National Vaccination Strategy COVID-19". The COVID-19-Vacc Platform is an open and decentralized platform model, which connects various actors and enables them to involve, conduct, and track the vaccination process. The blueprint comprises the ecosystem structure, defining how the platform works on the organization level, the interactions model defining how the platform works on the level of processes, and the service stack defining how the platform works on the operational level. This section discusses the main outcomes in light of the overall objectives described in Section 4.

Facilitating Decentralization and Openness (Objective 1)
The proposed COVID-19-Vacc Platform model facilitates decentralization on the level of the organizational model, i.e., the ecosystem model (cf. Section 5.1), by the decentralized governance underpinned by the governance services (cf. Section 5.3.2). Membership, institutional history, and rules and norms services enable the ecosystem's roles, such as RUSTA (Rules and Standards Agency), ensuring that all activities in the ecosystem must adhere to defined specifications. Thus, all ecosystem members (which might perform different roles) must follow the same rules without central control, as with centralized platform solutions. Beyond that, such a decentralized ecosystem model facilitates openness. It allows new members to join at their own pace as long as they followed the joining procedure and required setup established by the foundational services (cf. Section 5.3.1). Such openness of the COVID-19-Vacc Platform enables many different actors to join down the road and, by doing so, encourages the organic growth of the ecosystem and its robustness in a relatively short period. As such, the proposed platform model follows the paradigm of open innovation. Or, to put it into definition by Chesbrough [36], our platform model uses "purposive inflows and outflows" of data (i.e., knowledge) of various participants of the vaccination process to "accelerate internal innovation and expand the ecosystem for external use of innovation". For example, external use of vaccination data for further medical research (e.g., for treatment and vaccines development). Or companies, as third parties, might leverage specific data to develop new products and services for pandemic management and control and thus facilitate open innovation going beyond the vaccination process.
On the other hand, as with all open and decentralized systems, the COVID-19-Vacc Platform as an organizing model has potential downsides, which must be balanced during its implementation. If the platform is available for everyone who wants to contribute, it risks being too big to accomplish the goal effectively it was created for. If the system is strictly decentralized, this may cause longer response times (i.e., this leads to the problem known as flooding the underlying peer-to-peer network), making the decentralized platform inefficient and ultimately operational unreliable. Therefore, openness and decentralization of the COVID-19-Vacc Platform need to balance in order to reach an optimal ecosystem's growth and thus have to be considered when developing and deploying the underlying infrastructure necessary to realize the COVID-19-Vacc Platform.

Enabling the Vaccination Process (Objective 2)
The proposed COVID-19-Vacc Platform model enables the vaccination process by supporting core interactions among the ecosystem. These are represented by defined processes (cf. Section 5.2), that are enabled by the specialized services on the operational level. As to the specialized services (cf. Section 5.3.3), these services allow activities related to pre-vaccination, vaccination, post-vaccination, and surveillance phases (cf. Figure 10) and, by doing so, provide a basic set of platform functionality for each of the involved actors. On the one hand, this increases the usability of the platform as the single point of entry for each actor. On the other, it leads to establishing of data management that significantly reduces transactional and coordination costs and enables real-time decision-making. Thereby transaction and coordination costs refer to any costs incurred in participating in interactions within the ecosystem [37]. A concrete example of how the COVID-19-Vacc Platform could help to reduce transaction and coordination costs is how the vaccination progress is currently tracked. Tracking and disclosure are done centrally by the RKI (Robert Koch Institute). The VHs (Vaccination Hubs) are requested to record detailed data on the vaccinations carried out daily on a dedicated web application to provide up-to-the-minute information to RKI. Also, HCPs (healthcare professionals) are requested to provide this information daily to the federal KV (Associations of Statutory Health Insurance Physicians). Due to the federal organization of the German state (cf. Section 2.1.1), each of sixteen KV has implemented its way for affiliated HCPs to submit their data. KVs are then redirecting these data to the national association (KBV), which is finally turning cumulated data to the RKI [38]. As a result, many parties are involved, and a massive amount of primarily manual work is done daily to provide up-to-the-minute information about the vaccinations. However, the proposed COVID-19-Vacc Platform enables all of these actors to participate using the platform as a single point of entry, still allowing decentralized data management and processing where necessary. Using data already available on the platform also bypasses manual daily data entries for statistical purposes, thus decreasing efforts for such tasks and making completely unnecessary individual solutions for data collection, reducing coordination costs. This also can avoid errors resulting from manual calculations and late reportings, leading to consistent and reliable data management for informed decision-making.
Yet, the processes we considered are currently high-level. They need to be modeled in a fine-grained manner and specify information objects (as the output of each activity), ensuring consistency of collected data and, thus, enabling statistics and data science services essential for managing the vaccination process.

Ensuring Information Security and Data Protection during All Phases of the Vaccination Process (Objective 3)
The implementation of the German "National Vaccination Strategy COVID-19" requires collecting, processing, and storing personal data for different purposes (cf. Section 2.1.3). Especially analyzing and preventing side effects in the surveillance phase of the vaccination process requires a data pool that offers a wide range of possibilities. The possibility of warning against a side effect in a particular population worldwide or even developing a drug against that side effect is only one of countless examples. Irrespective of the reasons mentioned above for monitoring vaccinated individuals (cf. Section 2.1.2), data protection and ensuring privacy rights must play an important role, not least in the implementation of the "National Vaccination Strategy COVID-19". It can be assumed that a large proportion of those vaccinated has no side effects or long-term effects. When data collected during the vaccination process is analyzed, these individuals must be anonymous or at least pseudonymized to such an extent that they are no longer identifiable without further information. On the other hand, accessing personal data should be possible in the case of legitimate interests. For example, if an individual reports side effects or long-term effects to a HCP (Health Care Practitioner), this is a legitimate party for accessing personal data. If the individual allows this, the HCP could then provide detailed information about the side effects and other personal data for conducting research. Whether the individual wants to provide all personal data or only some special information must then be decided on-site on a case-by-case basis. Actors who are authorized interested parties, such as the RKI, can then use the collected data to produce statistics that researchers can use to conduct further research.
The COVID-19-Vacc Platform might help to ensure compliance to data protection regulation, especially the rights of the data subject, defined in articles 12-31 of the European General Data Protection Regulation (EU-GDPR), e.g., that only legitimate members may access necessary personal data and to improve the privacy protection further. One essential aspect for the data subject to enforce his rights according to the EU-GDPR is transparency about others processing his data [39] (c.f. Art. 12 EU-GDPR "Transparent information, communication and modalities for the exercise of the rights of the data subject"). Especially in light of the decentralized and global exchange of data, processing operations are often challenging to understand for those affected [40]. Platforms can make a significant contribution in terms of transparency. For example, it is possible to set up a central "cockpit" in which users are informed about the use of their data (Art. 15 EU-GDPR "Right of access by the data subject") and can influence their use and dissemination (Art. 18 EU-GDPR "Right to restriction of processing") [41]. The cockpit shows and regulates the handling of the data for all platform's participants consistently. In the case of more complex constellations of participants, it can also be helpful for those affected to be able to understand the data processing through suitable visualizations of the processes and data flows [41]. Representations such as Figure 8 can therefore make an additional contribution to the transparency of the handling of personal data. In addition, the COVID-19-Vacc Platform model offers the potential for extensive data usage control. Introducing a privacy-by-design-compliant architectural layer in the distributed processing systems (Art. 25 EU-GDPR "Data protection by design and by default") allows recognizing any data access and checking it concerning given consents and existing authorizations. In addition, this offers means to enforce anonymization and pseudonymization where necessary. This would ensure the end-to-end enforcement of consents and authorizations during the operation of the processing systems [42]. As for the implementation, the COVID-19-Vacc Platform can offer interfaces to call up the relevant data sovereignty requirements. Otherwise, it may require the participants to offer interfaces for their part. For example, to return inquiries about the use of data to the central cockpit, to process deletion requests for personal data (based on Art. 16 EU-GDPR "Right to erasure" or Art. 21 EU-GDPR "Right to object"), and to receive and technically implement the export of personal data (Art. 20 EU-GDPR "Right to data portability") [41]. In this way, the COVID-19-Vacc Platform model offers means to enforce the data protection requirements of the EU-GDPR.
On the other hand, an open, decentralized COVID-19-Vacc Platform may as well have some limitations regarding information security. All actors participating in the COVID-19-Vacc ecosystem must take care of their system's protection and security. Decentralization multiplies the number of points that an adversary could use to launch an attack ("attack vectors"), and openness even allows adversaries to join the platform becoming corrupt insiders or "internal adversaries" [43]. These problems are inherent in an open, decentralized approach and cannot be completely alleviated. However, countermeasures such as trust establishment, abuse-prevention schemes, and security controls could be deployed in the realization of the COVID-19-Vacc Platform model, taking into account adversaries within the platform's ecosystem.

Simplicity of Use, Integration, and Management (Objective 4)
The proposed COVID-19-Vacc Platform facilitates the simplicity of use and integration by enabling actors to plugin and immediately start using the platform's functionality, hence use functions implemented by the defined service stack (cf. Section 5.3). This promotes the organic growth of the ecosystem by enabling different actors to join at their own pace and contribute to an existing ecosystem. However, it also allows learning within the ecosystem and disseminating knowledge and best practices, essential for pandemic situations and related uncertainties. As a result, the proposed COVID-19-Vacc Platform represents an "entry point" of information and reference for different actors, independent of their responsibilities or roles taken within the ecosystem. By doing so, the COVID-19-Vacc Platform integrates all involved or on vaccination process interested participants, enabling them to conduct and manage their activities efficiently and effectively. Beyond that, it serves as a "data-driven infection radar" for the particular context for which it is set up. Currently, COVID-19 Dashboard (https://www.coronavirus.jhu.edu/map.html, accessed on 9 August 2021) by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins University is in the process of fulfilling such a function, yet, without clearly traceable criteria or clarity about data sources and considered conditions. As mentioned above, the identified service stack (cf. Section 5.3) covers the primary functionality of the proposed COVID-19-Vacc Platform model. As its ecosystem evolves and grows, the service stack needs to be expanded, but first and foremost, it needs to be prototyped and assessed as the function-based vehicle that underlies the ecosystem. This should include the functions of all the different roles and their interactions (cf. Section 5.1), in order to ensure that the platform's usability and ability to integrate and manage is proven by blueprint as well as by implementation.

Easy to Set Up, Robust, Scalable, and Modifiable (Objective 5)
The proposed COVID-19-Vacc Platform model, as blueprinted in Section 5, follows the principles of decentralized development and growth. As to Section 5.1, the COVID-19-Vacc Platform's ecosystem organizes around a set of rules and norms. It is building an organizational model, which defines how actors (performing different roles) need to link and align to realize the platform's value proposition. With the required functionality to support essential activities related to the vaccination process, rules, and norms need to be realized. They need to be simple to use, integrate, and manage as the requirements change. However, they also need to be easy to set up and robust when it comes to the concrete realization and deployment by the platform's underlying infrastructure. Since this work concentrates on the modeling steps 1-3 (cf. Section 3), it did not consider designing and deploying the COVID-19-Vacc Platform infrastructure. Whereby infrastructure consists of the underlying information systems and related technical infrastructure required to realize the platform's service stack.
Still, it can be noted that an underlying information system, necessary to realize the defined service stack, needs to follow the same design principles as the proposed COVID-19-Vacc Platform model, since a system's architecture should primarily relate to its function and thus its purpose. According to this principle known as "form follows function", the requested system must employ distributed resources to perform the activities of the vaccination process in a decentralized manner. The central architecture concern for an open and decentralized infrastructure is considering actors as participants in ecosystem activities and their mechanisms. Thus, it must consider COVID-19-Vacc Platform actors as the constitutive elements of an open and decentralized ecosystem, which actively contribute to these mechanisms. By doing so, such an open and decentralized infrastructure can meet the objective of being scalable, horizontally and vertically. Horizontally as the platform's technical infrastructure might be distributed across the sixteen federal states using their existing resources (e.g., technical resources provided by eDMP [10]), and vertically, as it can integrate more roles (e.g., technology providers) who might add extra value by adding further resources, which can increase the platform's robustness and modifiability. However, further research on this matter is required, which is considered part of our future work.

Conclusions and Future Work
The COVID-19 pandemic has massively impacted our social, economic, and political life worldwide. Many countries, including Germany, face significant challenges regarding the broad COVID-19 vaccination in the year 2021. Pandemics are generally not a new phenomenon, so there are existing solutions that support their control and management. However, to our best knowledge, none of these solutions cover the entire process of sustainable pandemic control, reaching from tracing infected people over vaccinations to monitoring and surveillance in the long term. Most of them are either focusing on some aspects like tracking infections and digital vaccine certificates or providing physical infrastructure for the exchange of infection-related data. Therefore, there are calls for integrated solutions to facilitate sustainable pandemic control in Germany and worldwide. In Germany, the "National Vaccination Strategy COVID-19" is centrally planed but decentrally implemented due to the federal organization of the German state in sixteen federal states. Furthermore, the European General Data Protection Regulation (EU-GDPR) imposes strict rules for the processing and exchanging of personal data related to the activities of the vaccination process.
In this work, we presented our COVID-19-Vacc Platform as a solution to support the "National Vaccination Strategy COVID-19" and facilitate its decentral implementation and compliance with EU-GDPR. The COVID-19-Vacc Platform is an open and decentralized platform model, which connects various actors and enables them to involve, conduct, and track the vaccination process while meeting all necessary data protection regulations, especially when long-term management and storage of personal are considered.
For the modeling of the COVID-19-Vacc Platform, we leveraged the Reference Model for Distributed Market Spaces, a multi-view framework to structure modeling steps and integrate decentralization, as an integrated aspect of the design process. We first analyzed the main activities of the vaccination process organized over the phases of pre-vaccination, vaccination, post-vaccination, and surveillance (cf. Section 2.2). Based on that and on requirements deriving from the "National Vaccination Strategy COVID-19", Infection Protection Act, and data protection regulations (cf. Section 2.1), we identified the overall objectives an open and decentralized platform must meet (cf. Section 4). Following these as design goals, we then blueprinted the COVID-19-Vacc Platform model, presented by its ecosystem model, interaction model, and service stack. COVID-19-Vacc Platform:Ecosystem describes how the proposed platform works as an organization model by identifying main actors and activities and roles that those actors perform (cf. Section 5.1). It also defines how these actors must be aligned with their activities and be linked to each other for the ecosystem's value proposition to materialize. COVID-19-Vacc Platform:Interactions specify core interactions among actors the platform needs to support (cf. Section 5.2). COVID-19-Vacc Platform:Services define a service stack that encompasses the primary services necessary to enable the operational level of the platform, thus realize the interactions within the ecosystem (cf. Section 5.3).
The discussion of the proposed COVID-19-Vacc Platform model in Section 6 shows that our blueprinted platform model generally addresses the overall objectives. It integrates the aspects of centrally planned and decentrally implemented vaccination strategies by promoting decentralization and openness and enabling the activities of the vaccination process in an integrative manner. Considering information security and data protection during all phases of the vaccination process, the COVID-19-Vacc Platform model might help ensure compliance to data protection regulation (EU-GDPR) and contribute in terms of transparency and handling of personal data, and by doing so, to offer the potential for extensive data control usage. Furthermore, the COVID-19-Vacc Platform model inherently facilitates simplicity of use and integration as it enables new actors to plugin and to immediately start using the platform as an entry point of information and reference. Based on the data derived from the documentation of the vaccination process, the COVID-19-Vacc Platform model can also serve as a "data-driven infection radar" for the particular context for which it is set up.
However, we also discussed limitations and potential pitfalls to be alleviated by design and evaluated and validated by a prototypical implementation. Therefore, our future work will primarily concentrate on implementing the proposed platform model, hence on the design and implementation of an underlying infrastructure suitable to realize the COVID-19-Vacc Platform:Services in an open and decentralized manner. Besides the implementation, the described model continuously has to be compared to the actual pandemic situation and the accompanying requirements. Objectives and requirements may likely change over time, and parts of the model need to be adjusted accordingly. For example, new actors could become a part of the platform, but additional functionality could be a helpful extension of existing functionality.
The presented open and decentralized platform focuses on the current COVID-19 situation in Germany. An adaption to different countries and different pandemics is possible and desirable so that the proposed COVID-19-Vacc Platform model could be used as a vehicle for analysis and modeling of platform-based management of other pandemics or health-related scenarios.