Coalition proposes secure standard model for Covid-19 passports

A new coalition of health and technology industry bodies, including Microsoft, Mitre, Oracle and Salesforce, has set out to develop a standardised model for organisations administering Covid-19 vaccinations to make credentials available in an “accessible, interoperable, digital” format.

The Vaccination Credential Initiative (VCI) believes that vaccination record systems currently in use do not readily support convenient access, control and sharing of verifiable vaccination records.

With borders closed and global travel still off the agenda, probably for months to come, many people expect vaccine passports will become a critical component of the hoped-for return to normal life – but their use must be balanced with user privacy.

The VCI says it is “committed to empowering individuals with digital access to their vaccination records based on open, interoperable standards”. It hopes the standards it develops, when combined with the availability of smartphone-enabled rapid Covid-19 tests, will enable app developers to create privacy-preserving health status verification apps that can be integrated with existing ticketing workflows.

It said this would empower people to obtain encrypted digital copies of their immunisation credentials to store in a digital wallet, with paper-based systems in place for those without smartphones.

“The goal of the Vaccination Credential Initiative is to empower individuals with digital access to their vaccination records so they can use tools like CommonPass to safely return to travel, work, school and life, while protecting their data privacy,” said Paul Meyer, CEO of VCI member the Commons Project Foundation.

“Open standards and interoperability are at the heart of VCI’s efforts and we look forward to supporting the World Health Organization and other global stakeholders in implementing and scaling open global standards for health data interoperability.”

The Commons Project has already been working on the creation of digital certifications to prove airline passengers have received a negative Covid-19 test before travel, and the VCI’s work will incorporate these efforts.

“As the world begins to recover from the pandemic, having electronic access to vaccination, testing and other medical records will be vital to resuming travel and more,” said Mike Sicilia, executive vice-president of Oracle’s Global Business Units.

“This process needs to be as easy as online banking. We are committed to working collectively with the technology and medical communities, as well as global governments, to ensure people will have secure access to this information where and when they need it.”

Brian Anderson, chief digital health physician at Mitre, added: “As we explore the many use cases for the vaccination credential, we are working to ensure that underserved populations have access to this verification.

“Just as Covid-19 does not discriminate based on socio-economic status, we must ensure that convenient access to records crosses the digital divide. Mitre is an independent adviser and trusted source for managing third-party data and is proud to be joining with the Commons Project and other coalition members to deliver an open-source credential.”

Meanwhile, a UK trial of vaccine passports at two undisclosed NHS bodies using an Innovate UK-funded system developed by iProov and Mvine has been criticised by the developer of an alternative digital health pass.

According to its creators Blok BioScience, the solution, which was launched in December 2020, is already being rolled out in care homes alongside lateral flow Covid-19 tests, and is certified by the ID2020 identity-protecting framework.

The developers said their system was built using private and secure self-sovereign ID technology to avoid leaking personal heath data, which remains owned and controlled by the individual at all times.

Blok BioScience president Chris Justice said: “With entire industries struggling, it is very positive that the government is investigating the use of health pass technology to allow society to open up safely. However, it doesn’t make sense for them to start this project from scratch when we have the solution already built. 

“Until now, the public has largely been kept in the dark about where testing and vaccination data is being recorded and how it might be used in the future. This is a missed opportunity, as giving people access to this information about themselves could enable greater freedoms, while also fighting the pandemic. It has been widely reported that privacy and security concerns have hampered adoption of many Covid apps, so we shouldn’t make the same mistakes again. 

“With the vaccine roll-out now in full swing, the government needs to act fast to introduce a tamper-proof and privacy-centric way for individuals to prove their vaccination and test status. The fact that our health pass is the first in the world to be certified by ID2020 and is already being rolled out to industry shows that we are already there.”