You've received a COVID-19 vaccine. How do you prove it?
Millions of people are counting on widespread COVID-19 vaccines to enable a return to normal after a year of business closures and restrictions. But how can someone prove they've been vaccinated? For many, the key will be digital vaccine certificates uploaded onto their smartphone.
IBM on Monday unveiled updates to Digital Health Pass, including a partnership with Salesforce that puts blockchain technology at the center of the tech firm's vaccine credentialing platform. Unveiled to coincide with CES, the annual consumer-technology showcase, passport technology promises to securely record and exchange information with other vaccine services, information that includes an individual's recent temperature checks, the version of the vaccine they received, where and how long ago the vaccination took place and contact-tracing data.
Certificates that authenticate vaccination will be essential for critical services like education, travel and office work to function again at large scale, said IBM's Eric Piscini, an executive at the company's Watson Health division. "To get back to work, we need to trust the vaccination process," Piscini told CBS News. "Passports help with trust at scale."
Obtaining a vaccination certificate should be fairly straightforward, Piscini said. Once a health care provider vaccinates a patient, they will issue "verifiable health credentials" to an encrypted digital wallet on the patient's smartphone. The person can then choose to share that data with others, such as a concert venue or airline.
What about privacy?
Privacy controls would be enabled by the use of blockchain, a peer-to-peer "distributed ledger" technology that is difficult to hack and alter. With blockchain, there would be no central database of health care information that could be targeted by hackers. Instead, personal data would be encrypted in the blockchain using an algorithmic "hash" which masks the underlying material. When apps or websites ask if a particular person has been vaccinated, the verification process of blockchain takes place against the hash instead of the medical information.
A broad spectrum of private companies, think tanks and world governments are developing vaccine passports, which means compatibility between apps could be an issue. Piscini said the Digital Health Pass updates announced this week will use custom APIs — code that allows two apps to securely exchange data — to integrate with and operate in the background of other applications. In theory this will provide a "streamlined user experience while checking in with an airline or entering a stadium," he said.
The digital divide
Of course, COVID-19 is a global pandemic, and billions of people do not have access to a smartphone. This exposes a major limitation in many vaccine passports.
Most major passports, including IBM's, offer alternate methods of storing and accessing vaccination data. But nearly every solution requires a computer or mobile phone. Users with access to a computer and printer can print Digital Health Pass data as a QR code — those familiar square-shaped code stamps we see used more and more by retailers to draw customers to their website, or restaurants these days to avoid the sharing of physical menus. The passport platform also allows vaccine recipients to store QR codes on someone else's trusted device. This could be particularly useful for parents to host their children's vaccination credentials.
COVID-19 vaccination passports are also being developed by Greece and Denmark and will be available later this year, though it's not clear if they will be available on smartphones. The World Economic Forum, an organization that brings together global business and political leaders, is rolling out CommonPass in Google Play and Apple App stores. Like the updated Digital Health Pass by IBM and Salesforce, CommonPass is a platform that integrates with other apps. The health data of vaccine recipients is encrypted and can be stored, transferred to another device and printed as a QR code. The app also displays a QR code that can be scanned at ticket counters, on commuter trains and buses or at live events.
A post-pandemic future
Piscini said the use of blockchain will help the platform remain technology-neutral. This should increase the speed of adoption and help apps that rely on the platform to evolve with emerging technologies and serve a broad range of needs.
"I would envision that there would be extended use cases beyond the pandemic," Piscini said. "For individuals to use the IBM Digital Health Pass for broader healthcare data — to demonstrate their flu vaccination status to schools or to share their entire immunization records to onboard as a doctor or nurse in a hospital."
Salesforce is integrating the technology with its Work.com suite of office products. The open platform strategy will help developers keep their apps up to date without being locked into a single solution, according to the firm's chief medical officer, Ashwini Zenooz.
"In this next phase," Zenooz said, "vaccination digital credentialing will play a critical part in how we can resume our lives."
In order to protect the privacy of vaccination recipients it's critically important for the creators of passport platforms to collaborate on security standards, Zenooz emphasized.
"For this technology to be effective and trusted, it must be built responsibly," she said. "As we move forward, it's critical we do this keeping human rights, security and privacy paramount in how we determine health status, how people share their data and how the data is ultimately used and deleted."