
(Credit: © M.Rode-Foto - stock.adobe.com)
In a Nutshell
- Government scientists were warned by early 2021 that the main computer system for catching COVID vaccine safety problems was mathematically broken and rarely flagged anything.
- An FDA doctor who tried to fix the problem and offered a better method was told by her superiors to stop sending her analyses.
- When a backup safety check was finally run years later, it flagged safety signals for heart inflammation and other conditions in every single report during a key stretch in 2022, something the main system never did.
For 13 straight weeks in 2022, a backup safety check run by the CDC flagged heart inflammation, facial paralysis, and ringing in the ears as vaccine safety signals every time it ran. The main tool the FDA relied on, and publicly vouched for, did not flag any of those conditions during that same stretch.
A new investigation from The BMJ, based on internal government emails obtained through public records requests and Senate investigators, reveals that FDA officials were warned as early as 2021 that the main tool they were relying on could miss safety signals, and that CDC staff were told of the problem during the rollout. Rather than repair it or switch to a better method, agency leaders kept relying on the flawed system and cited the absence of signals while assuring clinicians and the public that the vaccines were safe.
At the center of the story is Ana Szarfman, a career FDA medical officer who spent years helping the agency detect dangerous drug reactions. When she and a longtime statistician spotted the flaw and pushed for a fix, agency officials told her directly to back off. The BMJ’s reporting suggests that decision may have delayed warnings to doctors and patients about real risks, including heart inflammation in young people.
How the COVID Vaccine Safety System Was Supposed to Work
Before the first COVID shots went into arms in December 2020, the CDC promised doctors and the public it would watch closely for harmful reactions. The plan relied on a database called the Vaccine Adverse Event Reporting System, or VAERS, where people can report health problems that occur after vaccination. Officials used computer programs to sift through those reports looking for patterns, sometimes called “signals,” that might point to a real safety issue needing a closer look.
Two different scanning methods were supposed to work together. One, run by the CDC, compared how often certain health problems were reported after one vaccine versus another. The other, run by the FDA, used a mathematical formula that CDC director Rochelle Walensky later described as “a more robust technique.” Agencies planned to share results and rely on both.
That plan quickly fell apart. Government records show the CDC did not actually run its comparison analyses for safety signals until 2022, more than a year after vaccination began, despite the CDC’s own Immunization Safety Office deputy director, Tom Shimabukuro, publicly stating in October 2020 that VAERS was “the nation’s frontline system for monitoring vaccine safety.” Instead, officials leaned almost entirely on the FDA’s method, which had a serious flaw.
Why the COVID Vaccine Safety Checks Failed
More than 90 percent of the 1.1 million reports flowing into VAERS during the vaccine rollout were for the two mRNA vaccines from Pfizer and Moderna. That created a mathematical trap. To spot a problem with one mRNA vaccine, the system needed to compare it against other vaccines, but those comparisons were now dominated by the other nearly identical mRNA shot. If both vaccines carried a similar risk for something like heart inflammation, the system would see no difference and stay silent, a blind spot researchers call “masking.”
FDA managers were warned about this internally in early 2021. Szarfman, working with statistician William DuMouchel, presented evidence in early 2021 showing the difference in stark visual terms: a chart comparing the two methods lit up bright red with warning signals under one approach, while the FDA’s preferred method stayed almost entirely green, meaning it detected no signals. Szarfman had offered an updated version of the formula, one DuMouchel had published years earlier, that could catch signals the old version missed.
Real-world warnings were already surfacing. In February 2021, Israeli health officials alerted their American counterparts to a wave of heart inflammation reports, mostly in young people, following vaccination. The Pentagon’s health agency soon reported a cluster of similar cases among young military men. Yet the FDA’s own system, the one American officials were relying on, stayed quiet. CDC’s Tom Shimabukuro wrote to a colleague that June, “I’m perplexed that myocarditis isn’t alerting for either of the mRNA vaccines.” The next day, the CDC publicly called the condition an “extremely rare side effect.”
The FDA Told Its Own Doctor to Stand Down
By May 2021, Szarfman was asked in writing to stop. Craig Zinderman, an FDA associate director, emailed her asking that she “please hold off on creating and sending data mining reports and analyses using covid-19 vaccine” data, arguing that other safety systems already had matters “under close observation” and that changing methods mid-rollout could cause “confusion” and affect “vaccine confidence.” Szarfman agreed to comply but kept raising concerns internally, including a warning that summer about a possible signal for death following vaccination, which FDA colleagues quickly dismissed as likely a false alarm.
By September 2021, Peter Marks, then the FDA’s top vaccine regulator, wrote to a colleague complaining that Szarfman had “decided on her own” to keep running vaccine analyses and said she had “been asked to cease and desist,” warning that her work “could create erroneous conflicts that feed into anti-vaccination rhetoric.”
When the CDC finally ran its comparison analyses, examined directly by The BMJ, the results told a different story than what officials had been telling the public. Across 13 consecutive weekly reports between May and July 2022, that method flagged myocarditis (heart inflammation), pericarditis (swelling around the heart), Bell’s palsy (facial paralysis), and tinnitus (ringing in the ears) as safety signals every single time. The FDA’s formula, the one officials had relied on and publicly defended, did not flag any of those conditions during that same stretch.
That gap surfaced again when CDC and FDA scientists tried to publish a paper on vaccine safety monitoring. Peer reviewers at the journal questioned why the flawed formula was included as valid, and they later removed the disputed analysis from the published paper. The two FDA officials involved withdrew as authors entirely, since that analysis had been their only contribution.
DuMouchel, reflecting on the episode, said he could not explain officials’ resistance to switching methods. “It’s really hard to know what they really had in their mind,” he said. “Or whether to believe or to accept their excuses for not wanting to switch to a new method… I think that they were wrong.” He added that if officials “had paid attention to Ana, they would have done better.” Szarfman told The BMJ she never intended to undermine public confidence in the vaccines, saying simply, “Very few people understand the statistics. That’s the problem.”
Public trust in vaccine safety depends on regulators actually watching for trouble, not just saying they are. Records show officials kept relying on a method they had been warned could miss signals, even as an FDA scientist pressed for a better one. A scientist flagged a broken alarm before it mattered most, was told to stay quiet, and the public kept hearing that the warning signs weren’t there. That is not a small technical detail. It is a failure of the basic promise made to every person who rolled up a sleeve.
Disclaimer: This article describes “safety signals” identified through the Vaccine Adverse Event Reporting System (VAERS). A safety signal indicates a reporting pattern that warrants further investigation. It does not, by itself, establish that a vaccine caused a condition or measure how often that condition occurs. The BMJ investigation documents flaws in government safety monitoring and does not provide independent clinical proof of a causal link between COVID-19 vaccines and the conditions discussed.
Paper Notes
Limitations
The BMJ’s account is based on internal government emails released through Freedom of Information Act requests and in response to US Senate investigators, along with interviews with public health officials and scientists. Some key figures named in the piece, including Peter Marks, Rochelle Walensky, Craig Zinderman, and Narayan Nair, did not respond to requests for comment, meaning their side of certain events is not represented. The article does not provide independent clinical data proving a causal link between the vaccines and the specific side effects discussed beyond what the safety-monitoring reports themselves show.
Funding and Disclosures
The account is adapted from an upcoming book about COVID-19 and the vaccines written by David Willman and Peter Doshi. Doshi is senior editor of The BMJ Investigations Unit. The BMJ Investigations Unit funded the feature.
Publication Details
Paper Title: “US officials knew covid vaccine safety system was flawed, but turned aside the FDA doctor who alerted them”
Author: David Willman, investigative journalist.
Journal: The BMJ, 2026;394:e100806, 16 September 2026.







