LegiStorm

Summary:
Why This Matters

Digital vaccine credentials certify that a person has been vaccinated or tested for COVID-19. Such credentials can be a tool to mitigate COVID-19 transmission as countries seek to safely reopen social and economic activities, including travel. However, challenges related to data protection, interoperability, and equity may limit their use and potential public health benefits.

The Technology

What is it?

A digital vaccine credential can be used to confirm a person’s identity and whether the person has been vaccinated for COVID-19. Often referred to as vaccine passports, digital credentials can also include information on whether the person has tested negative for or recovered from COVID-19. Some countries and industries require proof of a negative COVID-19 test or vaccination to mitigate transmission of the disease, and view digital credentials as a tool to safely reopen societies and economies.

The concept of a health credential is not new. For example, a paper vaccine certificate known as the “yellow card” has long been recognized as an official record of immunizations for international travel and other purposes. It was first created in 1933 by a precursor to the World Health Organization (WHO).

How does it work?

Generally, users of a digital credential would download an application (app) onto a mobile device, create an account, and link it to their COVID-19 vaccination record from an immunization registry or to a COVID-19 test result from a certified test laboratory. A digital credential confirms the user’s identity and authenticates COVID-19 health information. It also validates the health information against the destination’s entry requirements, such as specific vaccines or tests accepted by a country. The app then generates a secure digital code the user can present to, for example, airline staff at check-in before boarding a flight or border control officials at an airport passport control checkpoint (see fig. 1).



Figure 1. A simplified illustration of how a digital vaccine credential is created.

How mature is it?

Public and private entities, both in the U.S. and other countries, are developing and piloting digital credentials, but governance frameworks and technical standards for the use of this new technology are still emerging. As one of the industries hardest hit by the COVID-19 pandemic, and in anticipation of increased passenger travel in summer 2021, the aviation industry has led efforts to develop digital credentials to facilitate safer and more efficient travel (see fig. 2). For example, in spring 2021, 50 international airlines were piloting the International Air Transport Association’s (IATA) Travel Pass for digital proof of COVID-19 testing. IATA also announced plans to pilot the use of the Travel Pass for proof of COVID-19 vaccination by summer 2021. Many other digital credentials are being developed, piloted, and launched for use in the travel industry and other sectors, such as the entertainment industry.



Figure 2. Use of digital credentials at airports could make departure and arrival procedures faster and more efficient for travelers, airlines, and border officials compared to review and verification of paper vaccine cards in different languages.

National governments are taking different approaches to this technology. The U.S. government stated in spring 2021 that it planned to work with private sector entities to develop common standards for digital credentials, especially with regard to health data privacy, but would not create a centralized federal vaccination database or mandate a national digital credential. By comparison, several countries, including Denmark, Israel, and the United Kingdom, are introducing or have launched national digital credentials. The European Union (EU) announced plans to launch its Digital Green Certificate in June 2021 for travel among member states. The EU may also allow vaccinated Americans to travel to EU countries in summer 2021.

Internationally, WHO established the Smart Vaccination Certificate working group in December 2020 to develop standards for a vaccination certificate that will serve as the yellow card’s digital equivalent and include COVID-19 vaccination status.

Opportunities

Verifiability. If designed and implemented properly, a digital credential could be more difficult to falsify than a paper vaccine card. A digital credential links a person’s identity to verified COVID-19 vaccine or test information, whereas a paper vaccine card does not generally provide the same digital linkage.
Efficiency and safety. Contactless scanning of digital credentials could expedite processing large numbers of people at airports and other venues. In contrast, reviewing and verifying paper vaccine cards and test results in different languages has caused overcrowding at some international airports, even at currently reduced passenger levels. Minimizing long lines and overcrowding can benefit public health by reducing the risk of COVID-19 transmission.
Data security. A digital credential can use technologies that address widely shared concerns about the security and ownership of personal health information. An example of a technology that addresses certain security concerns is blockchain, which enables the encrypted transfer of digital information without storing it in a centralized database.
Challenges

Data protection. A lack of clear standards for defined uses of digital credentials, and for minimizing collection of personal information, can undermine the security and privacy of users’ health data. This could limit public acceptance of digital credentials, reducing their potential public health benefits.
Interoperability. Various digital platforms should be interoperable, or be able to communicate with one another and exchange usable data. Without harmonized technical standards, it would be challenging to achieve effective and secure data transfer among numerous digital platforms used by immunization registries, testing laboratories, industries, governments, and other parties. For example, in the U.S. there are more than 60 different immunization registries run by cities, states, and territories.
Equity. Widespread use of digital credentials may exacerbate inequalities or constrain freedom of movement for those who do not have access to vaccines, cannot be vaccinated for health or age reasons, or do not own a mobile device.
Policy Context and Questions

As U.S. policymakers evaluate the role of this emerging technology in the larger public health response, the following questions may be useful to consider:

What security, privacy, and legal safeguards might protect personal health data used in digital credentials?
What might be done to help ensure that the use of digital credentials does not exacerbate existing health and economic inequalities, for example by restricting freedom of movement for some populations?
What might be done to facilitate the interoperability of numerous digital platforms to maximize the public health benefits of digital credential use?
What steps might ensure that digital credentials can access information from U.S. immunization registries, in order to facilitate Americans’ international travel and for other purposes?
For more information, contact Karen Howard at 202-512-6888 or HowardK@gao.gov.