Today, the committee voted to approve the third dose for people in “moderate to severe immune compromise.” That includes anyone who received an organ transplant and is taking anti-rejection drugs; is undergoing treatment for cancers in various organs, or varieties of leukemia; has received stem-cell transplants or CAR-T cells as part of cancer treatment; has advanced (or untreated) HIV or a primary immune-deficiency syndrome; or takes high doses of steroids, TNF blockers, or other immune system-suppressing drugs.

During the Friday meeting, officials estimated that the change might cover 7 million people, the 2.7 percent of US adults affected by a serious immune deficit. But the committee did not stretch the authorization to a potentially larger group who experience impaired immunity as a result of chronic illnesses.

“The intent is to limit this to individuals which are considered under the EUA to be in moderate or severe” immunosuppression, Amanda Cohn of the CDC said during the meeting. “That would not include long-term care facility residents or persons with diabetes, persons with heart disease—those types of chronic medical conditions are not the intent here.”

That did not sit well with some members of the public who spoke during the meeting’s public comment period. “I want to stress the importance of recommending third doses for people in all categories of immune compromise,” said a woman connecting to the video session from Tennessee. “Please give all of us who are immune-compromised a fighting chance to protect ourselves.”

Evidence has been building for several months that the Covid vaccines, which create robust protection in healthy people, have not been doing the job for immune-compromised ones. Right after the FDA authorized the mRNA vaccines in December, a team from the Johns Hopkins University School of Medicine put out an invitation on social media for immune-suppressed people to enroll in a registry so their immune responses to vaccination could be documented. In the spring, the team published their first analyses: After their first dose, only 17 percent of participants made antibodies to a section of the virus’s spike protein; only 54 percent showed an antibody response after the second dose. (In the manufacturers’ clinical trials, 100 percent of vaccine recipients developed antibody responses after their first dose.)

Another study, from Weill Cornell Medical Center, found that only 25 percent of kidney transplant recipients developed detectable antibodies. A team at the University of Pittsburgh warned of “virtually non-existent” responses to the vaccine in leukemia patients. A project shared by the Washington University School of Medicine and UC San Francisco showed that antibody levels can vary in patients with chronic inflammatory diseases—such as rheumatoid arthritis, lupus, and multiple sclerosis—depending on which immune-suppressing drugs they take.

To some patients and their physicians, it was already obvious that the vaccines were not protecting them. Despite being fully vaccinated, they came down with Covid—not the mild breakthrough cases experienced by fully immune people, but serious illness requiring hospitalization. Data cited by the CDC on Friday shows that immune-impaired people shed the virus for longer and are more likely to infect their household contacts than healthy people; they comprise up to 44 percent of vaccinated people hospitalized with breakthrough infections. And a study published online last month in the journal Transplantation estimates that organ transplant patients who have received two vaccine doses are 82 times more likely to develop breakthrough infections than healthy fully vaccinated people, and 485 times more likely than healthy vaccinated people to be hospitalized with Covid or die.

Online communities of patients began sharing information about their increased risk, and some of those who hadn’t fallen ill began hacking a remedy: seeking out third doses by finding sympathetic health care workers, pretending to lose their vaccine cards, or crossing state lines so the third shot wouldn’t be recorded in their home state’s registry. (According to CDC data presented at the Friday meeting, more than 1 million Americans may have received unauthorized boosters.)