According to U.S. Government Accountability Office (GAO) research, digital vaccine credentials and exposure notification apps have benefits and challenges in helping track the progression of COVID-19 and individuals’ safe integration into society.
A digital vaccine credentialing app, sometimes called a vaccine passport, links people’s verified identity to their vaccine status. In many states, vaccinated persons can download an app that connects their identity – which has been verified by the health authority administering the vaccine – to their vaccination status. The app generates a secure digital code confirming the users’ identity and vaccine status.
Also available in many states, exposure notification apps alert users when their phone has been near enough to another phone whose owner has reported a positive COVID test. They use the phone’s native apps to measure location and distance to determine exposure risk. Such apps can notify users quickly, giving them more accurate data on where they’ve been and cutting down on manual contact tracing.
These types of apps allow users to have higher confidence in the authenticity of the data. Digital credentials are also often easier to use. Unlike paper cards, phones (and their stored data) are less likely to get lost. Additionally, many of the credentialing apps use colour-coded information, so language is not a barrier for those checking vaccine status.
– Hayden Huang, GAO’s Assistant Director for Science, Technology Assessment and Analytics
These apps are typically developed and launched by individual states because the vaccination data is housed with state registries. New York launched its Excelsior Pass after successful testing at a sporting event. The state also offers a Pass+ app for use outside the state. California issues a QR code that links to a registry. Hawaii launched a SMART Health Card program that allows residents to upload proof of vaccination and receive a QR code digital proof of their immunisation against COVID-19.
Other states, including Pennsylvania, New Jersey and the District of Columbia are using VaccineCheck. That app allows users to upload their pictures along with an image of their vaccination card. Once the data is verified, users can access the VaccineCheck’s digital card. Louisiana incorporated a vaccine verification function into its LA Wallet, a smartphone app that holds users’ driver’s licenses.
The apps hold great potential for slowing the spread of disease because they make it easy to gather, redistribute information to potentially infected people. However, their success depends on a sufficient number of people using the same system. So long as all parties involved have compatible apps, this process for notification can be faster and somewhat more objective than conventionally done.
Data and privacy must be protected. The apps collect health, location and personally-identifying information, which can make users uncomfortable, as might the fact that the app must always be on, monitoring the user’s location. A lack of clear standards about how the information is intended to be processed and how it would be handled also hinders adoption.
Uniformity across vaccine registries, diagnostic testing results, testing standards, permissions, formats and outputs would help make the vaccine credentials interoperable, a requirement if the apps expect to be used nationwide or internationally.
To make the apps useful, GAO had several suggestions for federal, state, local governments and non-profits:
- Conduct studies to benchmark the effectiveness of various approaches.
- Work to establish standards of effectiveness for apps and iron out interoperability and privacy issues, ensuring that data is collected, used and stored in ways to inspire confidence in users.
- Develop a national strategy leveraging messaging, funding and steps to address equity (language and accessibility are IT-solvable) that could help encourage adoption.
