Digital Vaccine Credentials (GAO-21-534SP)

Summary

A GAO Science & Tech Spotlight on digital vaccine credentials, GAO-21-534SP, dated June 2021, from GAO's Science, Technology Assessment, and Analytics team. It explains that a digital vaccine credential, often referred to as a vaccine passport, can confirm a person's identity and whether the person has been vaccinated or tested for COVID-19. It notes that the aviation industry has led efforts to develop such credentials, and that in spring 2021, 50 international airlines were piloting the International Air Transport Association's (IATA) Travel Pass. It identifies challenges related to data protection, interoperability and equity.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Science, Technology Assessment,
JUNE 2021
and Analytics
WHY THIS MATTERS
Digital vaccine credentials certify that a person has been
vaccinated or tested for COVID-19. Such credentials
SCIENCE & TECH SPOTLIGHT: can be a tool to mitigate COVID-19 transmission as

DIGITAL VACCINE
countries seek to safely reopen social and economic
activities, including travel. However, challenges related
to data protection, interoperability, and equity may limit
CREDENTIALS their use and potential public health benefits.

/// THE TECHNOLOGY pandemic, and in anticipation of increased passenger travel in summer
2021, the aviation industry has led efforts to develop digital credentials to
What is it? A digital vaccine credential can be used to confirm a person’s facilitate safer and more efficient travel (see fig. 2). For example, in spring
identity and whether the person has been vaccinated for COVID-19. 2021, 50 international airlines were piloting the International Air Transport
Often referred to as vaccine passports, digital credentials can also include Association’s (IATA) Travel Pass for digital proof of COVID-19 testing.
information on whether the person has tested negative for or recovered IATA also announced plans to pilot the use of the Travel Pass for proof of
from COVID-19. Some countries and industries require proof of a negative COVID-19 vaccination by summer 2021. Many other digital credentials are
COVID-19 test or vaccination to mitigate transmission of the disease, and being developed, piloted, and launched for use in the travel industry and
view digital credentials as a tool to safely reopen societies and economies. other sectors, such as the entertainment industry.
The concept of a health credential is not new. For example, a paper
vaccine certificate known as the “yellow card” has long been recognized
as an official record of immunizations for international travel and other
purposes. It was first created in 1933 by a precursor to the World Health
Organization (WHO).

How does it work? Generally, users of a digital credential would
download an application (app) onto a mobile device, create an account,
and link it to their COVID-19 vaccination record from an immunization
registry or to a COVID-19 test result from a certified test laboratory. A digital
credential confirms the user’s identity and authenticates COVID-19 health
information. It also validates the health information against the destination’s
entry requirements, such as specific vaccines or tests accepted by a
country. The app then generates a secure digital code the user can present
to, for example, airline staff at check-in before boarding a flight or border
control officials at an airport passport control checkpoint (see fig. 1).

2:12 PM

Jane Doe Figure 2. Use of digital credentials at airports could make departure and arrival procedures
faster and more efficient for travelers, airlines, and border officials compared to review and
verification of paper vaccine cards in different languages.

National governments are taking different approaches to this technology.
1 Person is 2 Person’s identity is 3 Secure digital code
vaccinated. linked to verified is generated for use The U.S. government stated in spring 2021 that it planned to work with
vaccination status. on a mobile device private sector entities to develop common standards for digital credentials,
or for printing.
especially with regard to health data privacy, but would not create a
Source: GAO. | GAO-21-534SP
centralized federal vaccination database or mandate a national digital
credential. By comparison, several countries, including Denmark, Israel,
and the United Kingdom, are introducing or have launched national digital
Figure 1. A simplified illustration of how a digital vaccine credential is created.
credentials. The European Union (EU) announced plans to launch its
How mature is it? Public and private entities, both in the U.S. and other Digital Green Certificate in June 2021 for travel among member states.
countries, are developing and piloting digital credentials, but governance The EU may also allow vaccinated Americans to travel to EU countries in
frameworks and technical standards for the use of this new technology summer 2021.
are still emerging. As one of the industries hardest hit by the COVID-19

GAO-21-534SP Digital Vaccine Credentials
Science, Technology Assessment,
and Analytics

Internationally, WHO established the Smart Vaccination Certificate ■ Equity. Widespread use of digital credentials may exacerbate
working group in December 2020 to develop standards for a vaccination inequalities or constrain freedom of movement for those who do not
certificate that will serve as the yellow card’s digital equivalent and include have access to vaccines, cannot be vaccinated for health or age
COVID-19 vaccination status. reasons, or do not own a mobile device.

/// OPPORTUNITIES /// POLICY CONTEXT AND QUESTIONS

■ Verifiability. If designed and implemented properly, a digital As U.S. policymakers evaluate the role of this emerging technology in the
credential could be more difficult to falsify than a paper vaccine card. larger public health response, the following questions may be useful to
A digital credential links a person’s identity to verified COVID-19 consider:
vaccine or test information, whereas a paper vaccine card does not
generally provide the same digital linkage. ■ What security, privacy, and legal safeguards might protect personal
health data used in digital credentials?
■ Efficiency and safety. Contactless scanning of digital credentials
could expedite processing large numbers of people at airports ■ What might be done to help ensure that the use of digital credentials
and other venues. In contrast, reviewing and verifying paper does not exacerbate existing health and economic inequalities, for
vaccine cards and test results in different languages has caused example by restricting freedom of movement for some populations?
overcrowding at some international airports, even at currently ■ What might be done to facilitate the interoperability of numerous
reduced passenger levels. Minimizing long lines and overcrowding digital platforms to maximize the public health benefits of digital
can benefit public health by reducing the risk of COVID-19 credential use?
transmission.
■ What steps might ensure that digital credentials can access
■ Data security. A digital credential can use technologies that information from U.S. immunization registries, in order to facilitate
address widely shared concerns about the security and ownership Americans’ international travel and for other purposes?
of personal health information. An example of a technology that
addresses certain security concerns is blockchain, which enables /// SELECTED GAO WORK
the encrypted transfer of digital information without storing it in a
centralized database. ■ Science & Tech Spotlight: Contact Tracing Apps, GAO-20-666SP.

/// CHALLENGES ■ Science & Tech Spotlight: Herd Immunity for COVID-19,
GAO-20-646SP.
■ Data protection. A lack of clear standards for defined uses of digital
■ Science & Tech Spotlight: Blockchain & Distributed Ledger
credentials, and for minimizing collection of personal information,
Technologies, GAO-19-704SP.
can undermine the security and privacy of users’ health data. This
could limit public acceptance of digital credentials, reducing their /// SELECTED REFERENCES
potential public health benefits.
■ Interoperability. Various digital platforms should be interoperable, International Air Transport Association. IATA Travel Pass Initiative. Accessed May 11, 2021.
or be able to communicate with one another and exchange
The Royal Society. Twelve Criteria for the Development and Use of COVID-19 Vaccine
usable data. Without harmonized technical standards, it would be
Passports. London, United Kingdom: February 14, 2021.
challenging to achieve effective and secure data transfer among
numerous digital platforms used by immunization registries, testing World Health Organization. Interim Guidance for Developing a Smart Vaccination Certificate.
laboratories, industries, governments, and other parties. For March 19, 2021.
example, in the U.S. there are more than 60 different immunization
registries run by cities, states, and territories.

GAO SUPPORT: This document is not an audit product and is subject to revision based on continued
advances in science and technology. It contains information prepared by GAO
GAO meets congressional information needs in several ways, including by to provide technical insight to legislative bodies or other external organizations.
providing oversight, insight, and foresight on science and technology issues. This document has been reviewed by the Chief Scientist of the U.S. Government
GAO staff are available to brief on completed bodies of work or specific reports Accountability Office.
and answer follow-up questions. GAO also provides targeted assistance on
This is a work of the U.S. government and is not subject to copyright protection in
specific science and technology topics to support congressional oversight activities
the United States. The published product may be reproduced and distributed in its
and provide advice on legislative proposals.
entirety without further permission from GAO. However, because this work may
Timothy M. Persons, PhD, Chief Scientist, personst@gao.gov contain copyrighted images or other material, permission from the copyright holder
may be necessary if you wish to reproduce this material separately.
Staff Acknowledgments: Karen Howard and Heather Krause (Directors), Hayden
Huang and Jonathan Carver (Assistant Directors), Sada Aksartova and Catherine
Kim (Analysts-in-Charge), Angelica Aboulhosn, Paul Aussendorf, Nacole King, and
Anika McMillon.

GAO-21-534SP Digital Vaccine Credentials

File and source

File: gao-21-534sp.pdf
Size: 453,011 bytes
SHA-256: 352ac482aff2f28fc9fed7ed6e3909d6b5f5df8b33c49231e8c35a6258d1de05
Our copy: gao-21-534sp.pdf
Original: www.gao.gov