Vaccine Credentials Are Going Digital But With Challenges

Over half of adult Americans have now had at least one shot of the COVID-19 vaccine, and the Biden administration is working with private companies to soon offer digital vaccine credentials from a mobile device, which would allow Americans to prove they have been vaccinated against COVID-19 as businesses reopen.

“The U.S. government stated in Spring 2021 that it planned to work with private sector entities to develop common standards for digital credentials, especially with regard to health data privacy, but would not create a centralized federal vaccination database or mandate a national digital credential,” said a spokesperson from the U.S. Government Accountability Office. 

While there are no current legal requirements at the federal level to be vaccinated or to show proof of vaccination, the Equal Employment Opportunity Commission, a federal agency, has ruled that it is permissible for businesses to ask for proof of vaccination from their employees.

According to GAO, the concept of a health credential is not new, and that “a paper vaccine certificate known as the ‘yellow card’ has long been recognized as an official record of immunizations for international travel and other purposes.”

Created by the International Sanitary Convention for Aerial Navigation in 1933, the yellow card also known as the Carte Jaune, is an official vaccination record typically carried with a passport to show customs authorities that a traveler has been vaccinated against certain diseases, such as yellow fever, typhoid or cholera.

“Currently, WHO does not have an internationally recognized card for COVID-19 that is equivalent to its paper yellow fever card. When WHO releases its standards for the digital version of the yellow card, it is likely that some or many countries will adopt those standards,” said the GAO. 

Like a yellow card, digital vaccine credentials could be used to certify that a person has been vaccinated or tested for COVID-19, but those tools come with challenges that can limit the use of the credentials including security and health data privacy concerns, according to the GAO. 

Israel was the first country to issue a digital passport with the launch of the Green Pass in February 2021. 

As of May, Israel, China, Bahrain, and Japan are the only countries to have issued vaccine passports for international travel and other uses. Australia and other countries like Denmark and Greece have committed efforts to developing similar programs. 

Fifty international airlines also piloted an International Air Transport Association’s Travel Pass for digital proof of COVID-19 testing. The association announced plans to pilot the use of the Travel Pass for proof of COVID-19 vaccination by summer 2021.

Although the Biden administration and leaders at the Centers for Disease Control and Prevention have not yet created federal guidelines for official vaccine passports for Americans, states have also already begun their own programs.

New York launched the Excelsior Pass in March 2021 which is a free, secure and voluntary digital health pass devised by IBM to support the safe reopening of New York. 

To utilize a digital vaccine credential users would download a free application on a mobile device, create an account, and link their COVID-19 vaccination record from an immunization registry, or a COVID-19 test result from a certified test laboratory. 

The application would confirm the user’s identity and authenticate COVID-19 health information, validate health information against the destination’s entry requirements, like specific vaccines or tests accepted by a country, and generate a secure digital code the user can present to officials, like airline staff or border control officials.

“A digital credential can use technologies that address widely shared concerns about the security and ownership of personal health information,” wrote GAO. 

“An example of a technology that addresses certain security concerns is blockchain, which enables the encrypted transfer of digital information without storing it in a centralized database.” 

Pharmacies, labs and providers can issue secured health credentials (QR code), such as a COVID-19 test result or vaccination record, for individuals to add to their digital health passport. 

The credential doesn’t contain personal health information or transfer sensitive health details, it simply provides proof that the passport holder meets an entity’s health screening criteria.

Experts from the GAO say the role of digital vaccine credential might pose equity challenges, as it could exacerbate inequalities and constrain freedom of movement for those who don’t have vaccine access, those who cannot be vaccinated for health or age reasons, or those who don’t own mobile devices.

A digital vaccine credentialing system also comes with considerable challenges, GAO said, including a lack of clear standards undermining the security and privacy of users’ health data, and need for harmonized standards for data transfer between immunization registries and governments, etc.

Unlike in many countries, the U.S. does not have a central immunization registry, and the administration has stated there are no plans to create one. 

While the CDC maintains an Immunization Information System, this information is at a population level and not for individuals.

Despite acknowledgement of these challenges, leaders from the International Business Machines aim for a digital vaccine credentialing system to be used in schools for health requirements in attendance, or for employers regarding clearances without having to access private health information.