Companies are racing to build digital passports for people to prove they’ve had the Covid vaccine

People who get vaccinated against Covid-19 at Dodger Stadium leave with inoculation against the virus, a band-aid on their arm, and a CDC card with handwritten details such as when it was provided and which type of vaccine it was.

The CDC card is a tradition that goes back to the 1880s, when paper cards were first used to let students return to schools amid a smallpox outbreak.

Now, during the Covid-19 pandemic, those cards are going digital.

Patients from L.A. County can sign up to get a text message with a link to the same information as the paper card. The message also offers to send a follow-up text to remind the patient to come back to get their second dose.

It also includes a link to add all that data to Apple Wallet, a built-in iPhone app that’s normally used to store things like tickets to events and airplane boarding passes. It can be added to Google Wallet too, as well as downloaded as a PDF file.

“You’ve given those CDC paper cards that document you’ve received it, but early on, we were concerned about it, because in this day and age, people just carry their phones around,” Claire Jarashow, director of vaccine preventable disease control at the Los Angeles County Department of Public Health said.

The Los Angeles Wallet pass is one of the first examples in the United States of a digital Covid-19 vaccine proof, where patients can store information related to their vaccination status on their phones and quickly produce it for anyone who might need to know — like an airline, or a school, or a stadium holding a concert once it’s safe again.

Whether they’ll accept it is another question.

There’s currently no international or national coordination on the best practices for implementing vaccine passes, so companies that run large events don’t have a authority to refer to about what’s legal and what’s ethical when choosing their policies and technology.

The FDA hasn’t approved any third-party companies to deliver real-time vaccination results. A World Health Organization committee addressing the topic met this week, but has not published its results.

The Los Angeles Wallet passes are essentially a digital version of the old paper certificate. There’s no way for authorities to check whether it’s legit or if it might have been faked.

In the meantime, a variety of different companies, trade groups, and non-profits are rushing to build a competing systems that include extra security and features.

The airline industry is particularly motivated, as it faces a second straight year of depressed international travel. It really wants a system that can be checked and verified, as airlines have seen people presenting fake or photoshopped Covid-19 tests so they can fly.

“The world is leaning towards a requirement for something to be able to illustrate that you’ve had your test or vaccine in order to be able to allow for travel,” Nick Careen, senior vice president at the International Air Transport Association (IATA), a trade group that counts 290 airlines as members. “We cannot do this manually for the entire planet. Ultimately we need to get digitization.”

This week, Emirates Airlines said that it would use an app developed by IATA called Travel Pass to verify Covid-19 tests before flying out of Dubai. The IATA hopes that the system will reduce long lines at the airports if employees have to manually evaluate paper records.

Careen says the plan is to expand Travel Pass to vaccines as soon as it’s possible.

Medical privacy is another consideration — some advocates say it doesn’t make sense for a security guard or administrator to have access to medical details that are typically on the paper card, like which vaccine or test a person received and where the shot took place. Instead, they say, the system should be as simple as scanning a barcode and getting a quick yes or no.

“The whole point is that the verifier effectively says what their rules are,” said Paul Meyer, CEO of the Commons Project, which is developing a passport app called CommonPass that United Airlines is testing. “The rule might be, you need to have a test in the last 72 hours, or you need to have gotten both doses of the Pfizer or the Moderna vaccine. All CommonPass does is say, red or green. You meet the rules.”

The Commons Project is working with a group of tech and health giants to develop common standards — essentially, a new computer file type that could hold vaccination records with all the appropriate security and information.

These companies, which include Microsoft, Oracle, Salesforce, Cerner, Epic, and Cigna, are looking beyond just vaccine proof, building for a world where medical records can be wrested from providers and stored on your phone.

The market for health record technology is potentially massive, with one estimate saying it hit $31.5 billion in 2018 and is growing 6% per year. Apple (not part of the coalition) already has a system in place for people to store health records on their phones — and it can be used for vaccine records as well.

“This is just sort of a really urgent use case that requires it, but also can help catalyze what should exist anyway, which is the ability for individuals to use whatever app to pull down and take control of their health information,” Meyer said.

However, some of the people working on these technologies worry that they may be over-designing for the short-term problem of getting people back to work and play. They point to exposure notification, a novel technology designed by Apple and Google early during the pandemic to anonymously alert people they may have been exposed to the coronavirus. While the system was elegantly designed to protect privacy, the apps only started to launch in the United States in the second half of last year and have not been widely adopted.

“With regard to digital vaccination records, a lot of people are solving the third-, fourth, fifth order problems. If it could be amazing, it would look like ‘X.’ We’re focused on the first-order problem, which is getting patients access to their vaccination information in a way that’s beyond a piece of paper,” said Ramin Bastani, CEO of Healthvana, which built the software that Los Angeles Public Health is using.

The variety of approaches means a single unified system is unlikely to emerge in the U.S. Instead, people will probably need multiple proofs on their phone — perhaps one credential for an airline, a Wallet pass to show school, and a different app to attend a sports game.

“If everyone builds out their own credential system, you’re not going to be able to naturally talk to one another,” said Jenny Wagner, director of programs at Linux Foundation Public Health. “All of a sudden if you’re going to want to go to the movies versus to the office versus on a plane, you’re going to have to download three different apps, generate the credential three different ways, and get the paperwork done three different times.”