Implementing digital passports for SARS-CoV-2 immunization in Canada

• Public authorities and private entities may soon require people to provide proof of immunization to severe acute respiratory syndome coronavirus 2 (SARS-CoV-2) in certain contexts as an adjunct to efforts to safely re-open society.

• International bodies have explored potential standards and immunization passport solutions, with an initial focus on international travel.

• In Canada, provincial and territorial governments should ensure their ability to issue a crytographically signed digital vaccination record from a government repository to operationalize immunization passports that meet national standards and are aligned with international initiatives.

• If governments do not implement immunization passports, private corporations (e.g., airlines and large event venues) may develop their own requirements and systems, potentially leading to problems related to equity, privacy and coercion.

• Limited access to vaccines, technology and other resources may prevent people from using immunization passports.

The emergence and deployment of vaccines for severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) that are safe and effective offers hope for the alleviation of the enormous social, economic and health tolls of the coronavirus disease 2019 (COVID-19) pandemic. Public authorities and private entities may soon require people to provide proof of immunization to SARS-CoV-2 in certain contexts as an adjunct to efforts to safely re-open society. “Immunization passports” or certificates would allow bearers to show proof of adequate vaccination. We discuss how SARS-CoV-2 immunization passports could work, the infrastructure required to operationalize them and potential barriers and limitations to their use.

Proof of immunization is far from a new idea; during campaigns for the smallpox vaccine, the vaccine scar often served as this proof and gated access to such things as train travel.1 In Canada, certain provinces require proof of immunization for school entry.2 Internationally, proof of vaccination against yellow fever is required for entry into countries where the disease is endemic, as outlined in Annex 7 of the International Health Regulations.3^,4 In the current context, a move to digitize vaccination records and to use digital immunization passports to safely open activities and events to those able to prove their immunity is novel.

The World Health Organization (WHO), International Air Traffic Association and World Economic Forum have explored potential standards and mechanisms for the implementation of immunity passport solutions,5^–7 reflecting the likelihood that their first implementation would be for international travel. However, their use may be extended to proving immunity for certain workplaces and mass gatherings. Several concerns have been raised in the past about immunity passports that focus on natural immunity.8 We believe the use of passports will be restricted to immunity conferred by vaccines, as there is more scientific evidence for immunity from vaccines than from natural immunity.

In Canada, a digital passport for SARS-CoV-2 immunization could take the form of a a scannable bar code or Quick Response (QR) code showing vaccination status, which would be stored on a smartphone device in the same way as an airline boarding pass. The passport could be downloaded from a provincial or territorial immunization repository through a government portal and be linked to an individual’s identity. On seeking entry to a restricted place or activity, the passport holder would present it to be scanned for verification of the holder’s immunity status. The bar code would include a cryptographic digital signature so that the verifier would know that the passport was issued by a trusted entity, such as a provincial or territorial government. The system used to scan the bar code would require the ability to check whether the immunization record satisfied current public health guidelines on which vaccine products, dose intervals and dose counts confer adequate levels of immunity based on currently available evidence. The passport holder may also need to provide proof of identity with government-issued photo identification.

To enable effective digital immunization passports, governments will need to establish several core requirements, such as those articulated by the Royal Society in the United Kingdom (Box 1).9 The foundation of any system must be an accurate and comprehensive digital vaccination record in a government repository, with a mechanism to give people access to their records and those of their children and dependents. In certain provinces, emerging digital identity solutions may help people securely access their health data through third-party applications, which may be used for return-to-work solutions. Governments will need the capability to generate and issue cryptographically signed immunization records. Software, implemented in a standardized fashion, will be required to verify vaccination status and to determine whether immunization passports meet current requirements for entry or access. Mechanisms must also exist to revoke passports if, for example, data emerge that new variants of SARS-CoV-2 are resistant to vaccines. The questions of what vaccination series constitute immunity, and for how long immunity is established after completion of the vaccination series, will be challenging to answer, as variations are already occurring with the recommended vaccine schedules.

The development and implementation of an immunization passport must occur with input from legal and ethical experts.10 Safeguards must be in place to protect the privacy of people’s information, for example when third parties are logging into the system to verify vaccine status. Although the information in an immunization passport should be verifiable without making a request to the government issuer, certain edge cases, such as passport revocation, may require the verifier to check the validity of the passport against the issuer’s server, which creates the potential for the issuer to track the location of passport holders.

Access to vaccines is another important ethical concern when considering the use of immunization passports. The deployment of such passports in Canada may need to be limited until population-wide access to vaccines is established. In the meantime, there may be situations where people are required to show either proof of vaccination or proof of recently testing negative for SARS-CoV-2 to obtain access to a restricted activity such as air travel. However, those who cannot be vaccinated should not be discriminated against or be denied access to services.

Access to technology may be a barrier to using immunization passports. Bar codes or QR codes could be printed on paper, although those without access to digital devices will likely be disadvantaged by not having easy access to records. The need for proof of identity could unfairly restrict access among marginalized populations who do not have this proof. Technological development should occur in concert with legal and ethical review to ensure that the solution is the least restrictive means of reopening society, without adversely affecting populations that are already marginalized.

In Canada, further complexities exist for the implementation of digital immunization passports, related to technological maturity, the absence of digital identities and our federated system of government. The federal government will need to consider international standards that are designed for international travel, and potentially facilitate their adoption by provincial governments for other purposes. At the federal level, the National Advisory Committee on Immunization should establish standards for what constitutes vaccination-derived immunity. As general responsibility for immunization resides with provinces and territories, they should develop digital immunization records that are accessible from their immunization repositories and that respect privacy and other human rights concerns as much as possible. However, these provincial efforts should be guided by a federal or international standard. If governments do not develop the necessary capacity to implement immunization passports, it is likely that private corporations (e.g., airlines and large event venues) will develop their own requirements and systems, potentially leading to problems related to equity, privacy and coercion.

We expect that immunization passports will be imminently introduced for international travel. Canada will need to ensure alignment with global standards for security, authentication, privacy and data exchange, developed by the WHO Smart Vaccination Certificate initiative.5 This initiative would further benefit from creating international standards for what constitutes immunity and standardizing approaches to gating access as evidence on immunity changes. A properly constructed approach to immunization passports, tested first for international travel, could help to limit the spread of SARS-CoV-2 while allowing the global economy to be revitalized.