COVID-19 Vaccine Certificate: Will the US Catch Up with the Rest of the World?

Less than four months after the first COVID-19 vaccine was administered in the UK, over half a billion people across the world have now received at least the first dose. In many countries, vaccinations are being recorded in a single database which can provide proof of vaccination to those who have received it. As economies start opening up, the “COVID Vaccine Certificate” (CVC) is increasingly becoming a ticket to return to normality, lifting restrictions on work, travel and leisure.

In many parts of the world, CVC is already being rolled out quickly and at scale. For nearly 60 million people in India, it is easy to verify their vaccination status simply by scanning a QR code either on their smartphones or in a paper copy downloaded from the national vaccination portal. In Denmark, the CVC will be included in people’s health records which can then be authorized for verification if required.

There is an intense debate on whether CVC should be required for domestic purposes to open up the economy, allowing people with proof of vaccination to undertake normal activities. Getting a consensus on cross-border mobility is probably an easier proposition. Globally, millions of jobs are at stake when it comes to restarting travel for both business and tourism, especially in developing countries. COVID-19 has already inflicted huge costs on African countries from the downturn in tourism. As more governments start lifting travel advisories and quarantine requirements for vaccinated individuals, possessing a “COVID Passport” is becoming an important criterion. The European Union has announced plans for a digital green passport to facilitate travel between its member countries while the UK is pushing G7 nations to cooperate on common standards as vaccination campaigns pick up steam.

The United States is an exception—at least for now. The US leads the world in the number of vaccinations (one in four vaccinated people are in the US) but does not issue a digital certificate, only hand-written paper cards issued locally. Without a centralized database, and with states in charge of managing the vaccine rollout, issuing a digital CVC like India’s or Israel’s will not be an easy task. Citing privacy concerns as a barrier to government management, the US also plans to leave the certification in the hands of the private sector—raising questions about potential private access to data and multiple competing initiatives with differing standards. The likely capabilities of the CVC itself, accessible on a smartphone, and also downloadable in paper form, appear to resemble those of India’s Digital Infrastructure for Verifiable Open Credentialing (DIVOC ) program, which are secured through a digitally signed QR code.

Because of the formidable constraints, including considerable opposition to a CVC from parts of the political establishment, any US path to a CVC would probably need to start with a light touch. With no national consolidation of vaccination databases, each state would need to work towards a digitized register with, at a minimum, name, date of birth and vaccination details. A paper card would continue to be issued. Using any one of several digital communication channels, a person could contact their state registry through their approved CVC provider, presenting the information on the paper card—name, data of birth and dates of vaccination—and requesting verification. If correct, a CVC would be issued through the communications channel selected. At least in the early stages, some states will be ahead of others in their ability to verify data for a CVC; some might resist altogether.

In this case, there is no direct reference to identification documentation; the CVC is not itself an ID. The combination of name, date of birth, and vaccination dates is used to identify against the register, and the name and date of birth to identify for verification; this will be close to, but not completely unique, as we have written before. To fully verify vaccination of the holder, the CVC would have to be presented with some form of recognized identification with the same name and date of birth, like a driver’s license or a passport, quite similar to airline tickets being checked against a valid ID. But such a CVC would still be accessible to the many people who have no government-issued picture ID.

Further options for a CVC in the US include embedding ID information provided at vaccination, such as a driver’s license number, into the CVC, and moving the CVC towards a secure physical identity credential like a driver’s license. The last options is not realistic because of cost, issuance constraints and the need to be able to update the vaccination record as needed.

Irrespective of the exact design, there are important policy issues that need to be taken into consideration before rolling out a CVC. Who will approve CVC providers and set common standards for verification, an essential step if their certificates are to be accepted for international travel? Who can access the data, beyond the individual requesting the certificate? When would it be permissible to request someone to present a CVC; would private individuals and businesses have discretion to require it for service? How then does the country then deal with people from jurisdictions that choose not to maintain electronic vaccination registries and so are not able to issue a CVC? How to ensure linked records across jurisdictions, for example if a person had two shots in MD and a third booster shot later in Tennessee?

COVID-19 is not the first pandemic; neither is it likely to be the last. Even if many of the issues will not be solved in the short term, it will be important to develop agreement on the general path forward.