A scoping review of global vaccine certificate solutions for COVID-19.

Globally, measures, such as lockdown, quarantining, and physical distancing, have been implemented to curb the spread of COVID-19. As the vaccines are now available and reintegration into society is beginning, measures such as vaccine certificates are being implemented around the world. We conducted a scoping review to identify the initial digital solutions for COVID-19 vaccine certificates and evaluate them on the basis of purpose and use case, technological architecture, and ethical and legal implications. Articles identified from a Google search and a search of MEDLINE, Ovid and preprint servers were reviewed in duplicate, and data were extracted using a data extraction form. Data were extracted for date, location, type of article, source, companies identified for creating vaccine certificates, technology used, type of evidence provided (article quoting research study or an expert opinion), digital architecture, security and privacy measures, and use cases. Technology emerged as the most dominant theme followed by ethics, travel, legal concerns, public policy, and scientific concerns. Our review identified eight solutions that are working toward COVID-19 vaccine certificates world-wide, all optimizing blockchain technology. COVID-19 vaccine certificates are being considered in 11 countries and are in place in 5 others. Many issues concerning the themes we identified remain to be addressed to facilitate successful implementation.

Introduction

Globally, unprecedented measures have been implemented to reduce the spread of the COVID-19 pandemic and prevent healthcare systems from being overwhelmed. These measures include states of lockdown, travel restrictions, work from home orders and quarantine of citizens. These have had serious psychological and socio-economic consequences.[1-3] A key focus to mitigating and recovering from the economic impacts of COVID-19 will be safely reintegrating individuals into the workforce and society.

COVID-19 vaccines were first approved for use in December 2020.[4] With vaccination rates increasing around the world, social and travel restrictions are beginning to ease. There are currently international travel requirements in place for the Yellow Fever vaccine under the International Health Regulations[5] and it is possible that similar requirements for COVID-19 vaccines may be added.[6,7] Beyond facilitating international travel, digital proof of vaccination is being considered as a mechanism to facilitate return to work and reopening of the economy.[8]

The use of digital vaccine certificates is evolving rapidly. We have undertaken a scoping review to assemble and map existing digital solutions for vaccine certificates. The secondary objective is to evaluate the initial digital solutions with respect to (1) purpose and use case, (2) technological architecture, and (3) ethical, legal, and policy considerations. A scoping review is a process to map key concepts, main sources, and types of evidence available and also to highlight the gaps in the research area which are complex or have not been previously reviewed in a comprehensive manner.[9] Considering that the development of digital vaccination certificate solutions is still in its early stages and changing rapidly, the flexibility and breadth of a scoping review lends particularly well to this topic. We use the findings of this review to consider what potential barriers may exist to implementation of these solutions.

Methods

The scoping review was guided by the methodological framework developed by Arksey and O’Malley[10] and reported by the Preferred Reporting Items for Systematic reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) (available in supplementary materials).[11] The following five steps have been followed in this scoping review: (i) identifying the research question, (ii) identifying relevant studies, (iii) selection of eligible studies, (iv) charting the data, and (v) collating and summarizing the results.

Identifying the research question

The main research question was “What are the existing digital solutions for vaccine certificates available globally?”

The research sub-questions were as follows:

What is the purpose and use case of these initial solutions?

What is the technological architecture for these initial solutions?

What are the ethical, legal, and policy implications for these initial solutions?

Identifying relevant studies

Grey literature search

Digital solutions for vaccine certificates may be described on the websites of the groups who have developed them or in news articles or blogs. Therefore, we undertook a comprehensive Google search of grey literature to identify existing vaccine certificates around the world.

On November 18 and November 19, 2020 we followed the guidelines outlined by Canadian Agency for Drugs and Technology in Health (CADTH) to conduct the Google review.[12] The search terms used were “coronavirus,” “COVID-19,” “SARS COV2,” “immunization passport,” “immunization certificate,” “vaccine certificate,” “vaccination certificate” and “digital.” A total of 9 searches were conducted combining the search terms and are listed in supplementary Table 1. All searches were conducted using privacy settings with location settings turned off. The Google search was limited to 150 results per search to maintain the search to a manageable level while also capturing relevant content, unless less than 150 results were obtained. Our Google search yielded a total of 1056 results, 641 after removing the duplicates.

As it is an evolving area, we further augmented our results beyond the time of the initial search with additional solutions that emerged. This was done through a second specific Google search to incorporate the most important and recent announcements by EU and Israel and are presented in the results.

Academic search

To ensure the comprehensiveness of our review, we also conducted a search of Embase, Ovid MEDLINE and preprint servers (MedRXIV, BioRXIV) on November 26, 2020. The database search terms included “coronavirus,” “COVID,” COVID19”, “sars cov-2,” “vaccination,” “immunization,” “certificate,” “passport,” “document” “vaccination pass.” The search strategy is available in supplementary materials.

Selection of eligible studies

The scoping review inclusion criteria were articles in the English language that included any discussion of a digital solution for vaccine certificate/documentation or passport for the COVID-19 vaccine published from December 2019 to the search date. Articles were excluded if they 1) did not have relevant content such as primarily discussed immunity passport (i.e., immunity from disease) or primarily discussed various conspiracy theories circulating at the time (such as the use of vaccines to inject microchips), 2) had limited content defined as less than three lines of relevant text, 3) had broken links or 4) had content presented in video format.

Screening process

Two reviewers (SSM, ABB) independently screened titles and content (SSM, DZ) according to the inclusion and exclusion criteria. Data extraction was conducted in duplicate using an electronic data extraction form. Back searching of identified digital solutions was conducted to fill information gaps. Any disagreements that arose during screening were resolved by consensus.

Charting the data

Following full-text screening, two reviewers (SSM, DZ) charted each article chosen for inclusion using the data extraction form to gather common and comparable information on each study. Data extracted included publication date, location, type of article, source, companies identified, technology used, type of evidence provided (articles quoting a research study or a health expert opinion – which included academic thought leaders, politicians, or the CEOs of the companies developing a vaccine certificate), digital architecture, security and privacy measures, and use cases. We categorized articles based on the following six pre-identified themes: 1) legal, 2) technology, 3) ethics, 4) travel, 5) policy, and 6) science. Based on preliminary research we identified these themes as important areas to review when considering the use of vaccine certificates.[13-15]

Results

Collating, summarizing, and reporting the results

A total of 742 articles were identified for screening (Google n = 641, academic literature n = 101). Based on the title and headline screening, 551 articles were eliminated including 24 duplicates identified with the same heading or near similar content. One hundred and ninety-one articles remained for full text review, of which 70 were included in the final analysis (Figure 1). Those articles that only discussed immunity passports (i.e., immunity from disease) as opposed to vaccine certificates or passports, had relevant content less than three lines or focused on conspiracy theories that were circulating at the time were excluded from the final analysis.

Figure 1.

Flowchart.

Characteristics of included articles

Of the 70 relevant articles, nearly half were opinion/editorials (n = 29, 41.4%), followed by news articles (n = 25, 35.7%), research articles (n = 7, 28.7%), company websites (n = 3, 4.3%), and blogs (n = 2, 2.9%). The remaining articles (n = 4, 5.7%) were considered other (event description, guidelines etc.) (Table 1).

Table 1.

Characteristics of the articles

Article Type	n	Percentage (%)
Research paper	7	10.0
News article	25	35.7
Opinion/editorial	29	41.4
Company website	3	4.3
Blog	2	2.9
Other (event description, guidelines, concept paper etc.)	4	5.7
Pre-identified themes
Travel	21	30
Ethics	22	31
Technology	41	58.5
Legal concerns	10	14
Public policy	9	13
Scientific concerns	1	1.5
Sub Themes
Reopening of economy	12	17
Data security	9	13
Transmission control	3	4.3
Inequities	3	4.3

More than half (n = 54, 77%) of the articles referred to some source of evidence. Sources of evidence included articles quoting “research studies” or an “expert opinion.” Research studies were the source of evidence for 14% (n = 10) of the articles whereas expert opinions included academic thought leaders (n = 12, 17%), politicians (n = 16, 23%), and the CEOs of the companies developing a vaccine certificate (n = 16, 23%). Twenty-three percent (n = 16) did not quote any source of evidence.

Digital solutions for COVID-19 vaccination certificates

Our search identified eight digital vaccine certificate solutions in use or under development (Table 2). At the time of the search four solutions (CommonPass, DigiLocker, Covi-pass, and VaccineGuard)[18,22,23,32,33] were in the pilot/trial stage or available for use. Three solutions (QDX Health ID, Vaccify, and IBM Digital Health pass)[16,17,24,26,34] were in the beta testing and demo stage and no information was available about the product stage of WIShelter SafePass app. Following our initial search, we identified two additional solutions- the EU Digital Covid Certificate (EUDCC),[35] formerly known as The Digital Green Certificate for travel among EU countries and the Green Pass[36] both of which have reached the implementation stage. In June 2021 we reviewed the solutions to update any information on the production stage or use. WIShelter is now available for use[27] and Digital Health Pass[26] now also provides proof of vaccination. No other updates were available for the remaining solutions.

Table 2.

Digital solutions for COVID-19 vaccine certificates

Product name	Company name	Objective	Product operation	Product Stage	Technology	Data privacy	Data security
Vaccify[16,17]	TrustNet Pakistan	To support safe travel, return to work and aid hospitals to evaluate which staff/visitors are allowed into certain locations of the hospitals.	Users will be issued a vaccination certificate by the hospital/healthcare organization that administered the vaccine. The vaccine certificate (VC) shows up as a QR code on the users Vaccify app that can be scanned by officials (e.g., employers, border agents).	Demo	Decentralized block chain – (1) Uses the “Hyperledger INDY,” “Hyperledger ARIES,” and “VON” (Verifiable Organizations Network) blockchain. (2) Verifiable Digital Credential Technology (VDCT) preserves privacy	QR code identifies whether the user has a vaccine certificate or a positive /negative PCR/antibody test.	1) App is accessible through biometrics or a passcode.2) Aligns with world wide web consortium (W3C) standards.3) Certificate can be issued (or revoked) rapidly, thus, potential for fraud is mitigated.
CommonPass[18–20]	The Commons Project	To support safe travel.	The app will assess whether the user’s lab test results or vaccination records (a) come from a trusted source, and (b) satisfy the health screening requirements of the country they want to enter.	In trials by United Airlines and Cathay Pacific Airways	Block chain – no detail provided	CommonPass provides a yes/no answer to whether the user meets the current border entry criteria. QR code is generated that can be scanned by airline officials. Underlying health information remains in the users control.	Uses open, globally interoperable standards (e.g., HL7 FHIR, W3C verifiable credentials).
QDX HealthID Immunization Passports[21]	Quantum Materials Corp	Supporting return to work, social settings and society during COVID-19 pandemic.	App-based interface that provides a green, yellow or red indicator, and a scannable QR code. Green indicates the user is virus free and safe to return to work/socialize to some degree. Hosted on the Microsoft Azure cloud and can integrate with existing EMR system.	Beta testing	Block chain – Based on the Hyperledger Sawtooth enterprise blockchain	Verifiers of user’s VC scan the QR code. Personal information stays with the user except evidence of VC.	Implements distributed ledger applications via Digital Asset Modeling Language (DAML) which decreases fraud risk.
Covi-Pass[22]	Tento Health	Supporting return to work, social settings, and society during COVID-19.	Considered in 15 countries including France, Canada and India. Currently, it only supports COVID-19 test results but there is a plan to expand the app to include VC.	Available for download on the iOS and Android stores	Block chain – no detail provided	Verifiers of VC will scan the QR code which indicates presence/absence of VC. Personal information stays with the user. App is password-protected.	Not available
DigiLocker[23–25]	Government of India	Supporting return to work, social settings, and society during the COVID-19 pandemic.	A government platform for issuing and verifying documents and VC digitally. For dual-dosage vaccines, people are issued a provisional certificate. The full certificate will be issued after both doses, with dates of administration and vaccine information. Certificates are stored in DigiLocker.	Available for download on the iOS and Android stores	Block chain – no detail provided	Verifiers of the VC scan the QR code indicating presence or absence of VC and date and details of the vaccination. Personal information remains with the user.	Not available
Digital Health Pass[26]	IBM	Supporting return to work, social settings, and society during COVID-19 pandemic.	Supports COVID-19 test results and vaccination records.*	Demo	IBM Blockchain technology	Health Pass would be stored in digital wallet of the user.User has control over what health data they wish to share.	Not available
WIShelter SafePass[27–29]	WISeKey International Holding	Supporting return to work, social settings, and society during COVID-19 pandemic.	VC on WIShelter SafePass which ensures users’ privacy, security and safety while providing access to diagnostics, vaccine education and necessary medical services and data.	Not yet available at time of reviewNow available for download on the iOS and Android stores**	Block chain – no detail provided	To ensure data privacy, each user’s Personal Identifiable Information is kept encrypted and only disclosed with user’s consent.	WISeID implements standards such as OpenID Connect and OAUTH2, which enhances the security of their cloud applications.
VaccineGuard[30,31]	Guardtime, OpenHealth, SIPCA, WHO	To capture and protect proof of critical data accuracy, facilitate privacy-preserving global certificate verification, and provide real-time insights on vaccination deployments for public health authorities.	It will provide proof of critical data accuracy, deliver automated aggregated reports from vaccination sites, automated monitoring of stock and vaccinations, and provide the ability to facilitate adverse effect reporting, supporting investigations around this more quickly.	In pilot stage with Estonia, Iceland, and Hungary	Blockchain – Keyless Signature Infrastructure (KSI)	Embedded decentralized privacy.	No data is registered into the KSI Blockchain itself – only hashes of data, any data movement is between known hosts in a point-to-point fashion using secure transport.

VC: Vaccination certificate

VDCT: Verifiable Digital Credential Technology

W3C: World wide web consortium

FHIR: Fast Healthcare Interoperability Resources

EMR: Electronic Medical Record

*: As of June 2021, Digital Health Pass shows proof of vaccine

**: As of June 2021, WIShelter SafePass app is now available for use

Technological architecture

The use of digital certifications was discussed in 78% of articles identified (n = 53). Digital certificate hereby refers to the proof of vaccination in a digital format. Only one article mentioned the use of paper certificates for those who do not own a smartphone and a printout of the Quick Response (QR) code would be given to them.

Implementations

Table 3 identifies the countries which are considering, plans to implement or have implemented digital vaccine certificates and provides a brief summary of the details. At the time of the search, Denmark, Estonia, UK, and Israel had implemented vaccine certificates.[30,31,37,41,57] Estonia is piloting the VaccineGuard app in collaboration with the World Health Organization.[30] Finland, Australia, Italy, Sweden, Switzerland, and Spain have plans to implement the vaccine certificate and the details are expected to be released in the upcoming months.[37,44,45,47-50,53-56] Australia and Finland are moving forward using the existing health platforms, Express Plus Medicare app and My Kanta, respectively.[44,47] Pakistan, Russia, Indonesia, are all considering vaccine certificates but have not shared any confirmed plans yet[16,17,24,42,43,46] though Pakistan is considering the implementation of digital platform under development, Vaccify.[16,17,24] Canada is currently considering vaccine certificates for international travel only.[51,52] Indonesia is also considering the implementation of vaccine certificates and has identified several processes which must be put in place in order for the certificate to be considered halal which will allow it to be accepted by their larger population.[46]

Table 3.

Approach of countries toward a vaccine certificate for COVID-19

Country	Government issuing immunization passport?	Vaccine certificate details
Estonia[30,31]	Implemented	VaccineGuard developed in collaboration with the World Health Organization and Guardtime (See Table 2)
Denmark[37,38]	Implemented	Has launched its own Corona passport (coronapas). The passport is being used to lift the restrictions and re-open the economy. Users are required to have a negative test result within the previous 72 hours, a VC or proof of infection within the last 2 to 12 weeks
USA[39,40]	Not considering it	USA does not have plans to develop a national vaccine certificate although some states like New York are issuing Excelsior Pass to those who get vaccinated.
UK[41]	Implemented	NHS app to be used for travel
Pakistan[16,17]	Under consideration	Vaccify by Trust Net Pakistan (See Table 2)
India[23–25]	Implemented*	DigiLocker – A government platform for issuing and verifying documents and vaccine certificate digitally (See Table 2) India is also using CoWIN and Aarogya Setu App to download the VC
Russia[42,43]	Under consideration	Covid passports would possibly be in a digital form
Finland[44,45]	Plans to implement	The vaccine certificate would be available on “My Kanta” which is a nation-wide service platform for accessing health records. It will be available for use at the end of May 2021
Indonesia[46]	Under consideration	There are several processes that must be passed for Indonesia’s national agency BPJPH to issue a halal certificate: application, examination, determination, testing, checking, fatwa, and finally the issuance of the certificate
Australia[47]	Plans to implement	It will allow people to access digital proof of vaccination via the Express Plus Medicare app and MyGov accounts. Approval is expected by March 2021A paper form will also be available through Services Australia or through the vaccine provider
Italy[48,49]	Plans to implement	Will use EU’s Green pass. More details will be released end of June 2021
Sweden[37,50]	Plans to implement	Will use EU’s Green pass
Canada**[51,52]	Under consideration	Details are not yet released
Switzerland[53,54]	Plans to implement	Details will be released by the end of May 2021
Spain**[55,56]	Plans to implement	Spain will develop their own vaccine certificate, releasing details end of June 2021 which will work in tandem with the EU Green pass
Israel**[57]	Implemented	Green pass provides both digital and downloadable paper certificates. It shows whether the user is vaccinated and/or has a recent negative test
EU Commission**[58,59]	Plans to implement	Officially introducing Digital Green Certificate which will be available in both digital and paper format. Vaccine certificate will show details of inoculation and brand used, negative test certificates, and medical certificates for people who have recovered from COVID-19 in the last 180 days. Intended for travel between all EU countries. Plans to become available from July 1, 2021

*As of June 2021, India has implemented the VC solution.

**Additional search identified the use or consideration of vaccine certificates. At this time, we do not have sufficient data about the EU countries that are in support of the EU commission’s decision to implement vaccine certificates.

“Under consideration” refers to the state of exploring and deciding, “plans to implement” refers to the state that the product will be released soon, and “implemented” refers to the product available for the people to use.

Following our initial search, additional solutions were announced and therefore, we incorporated them into Table 2. On March 17, 2021, the European Commission introduced a vaccine certificate to ensure free and safe travel within the European Union (EU) countries.[35] The EU Digital Covid Certificate (EUDCC), formerly known as The Digital Green Certificate, will be valid for all EU countries as well as some non-EU countries and will be available in both digital and paper formats.[35] It works with the help of a QR code issued by a recognized health authority such as a hospital or test center, that embeds a digital signature to protect it against fraud. To check the certificate, the QR code is scanned and the signature verified.[58,60,61] Quarantine rules will not apply to those who are fully vaccinated.[61] The EUDCC includes information about an individual’s vaccination status as well as COVID-19 test results or recovery status from COVID-19.[35] Some EU countries such as France and Germany are developing their own national solutions.[60] Israel’s Green pass released on 21st Feb 2021 is also available in both digital and paper format. It displays proof of vaccination or if you had recovered from COVID-19.[36]

In June 2021, we updated our review of countries implementing digital vaccine solutions. At that time India had also implemented vaccine certificates which users can download from their DigiLocker account or through CoWIN and Aarogya Setu app.[23,25] The United States were originally considering implementing a digital vaccine certificate but have since decided against implementing a national solution.[39]

Data security and privacy

The data privacy and security of the digital platforms identified were based on the fundamentals of blockchain, that is all personal identifiable information is encrypted and cannot be disclosed without the user’s consent.[28] All solutions allow the verifier of the vaccine certificate to scan the QR code indicating presence or absence of a vaccine certificate and date and details of the vaccination without disclosing other personal identifiable information.

There are many major standard-setting efforts for data security and privacy underway of which two were mentioned in our articles:

1) Worldwide Web Consortium (W3C): W3C is an open, globally interoperable standard setting body for data security.[62] The body is known for such standards as the early versions of HTML.[63] Companies such as TrustNet Pakistan, works on W3C standard and looks for instances where Verifiable Credentials (VCs) can be used to address the public health crisis.[63,64] The Commons Project also uses W3C standards for their application.[32]

2) HyperLedger: HyperLedger is another standard-setting body which is an open-source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments with interoperability and tokens as their expertise.[62] Quantum Materials Corp’s (QMC) blockchain-based QDX HealthID app, is based on the Hyperledger Sawtooth enterprise blockchain and for smart contracts, it’s using the Digital Asset Modeling Language (DAML).[34] Apart from it, WISekey has implemented standards such as OpenID Connect and OAUTH2 to enhance the security of their cloud applications.[29]

Thematic analysis

We evaluated the articles for six pre-identified themes. Technology emerged as the most dominant theme, appearing in 58.5% (n = 41) articles. Ethics (n = 22, 31%), travel (n = 21, 30%), legal concerns (n = 10, 14%), public policy (n = 9, 13%), and scientific concerns (n = 1, 1.5%) were also among the themes identified. The article identified under scientific concerns largely discussed the science of immunity.[65] Public policy concerns identified related to requirements for vaccine certificates for entering malls, gyms, sports matches or other events.[66,67] They also focused on the impacts of vaccine certificates at work.[68] Articles categorized under travel focused on cross-border travel.[69,70]

During our review we identified the following four sub themes: 1) reopening of economy, 2) data security, 3) COVID-19 infection prevention, and 4) inequities. Reopening of economy was the most common reason for introducing vaccine certificates (n = 12, 17%). A lot of the discourse identified was around reopening of social events, gyms, and restaurants.

Issues around data security (n = 9, 13%), COVID-19 infection prevention (n = 3, 4.3%), and inequities (n = 3, 4.3%) were also noted. More than half of the articles had no sub themes that were identified (n = 43, 61%).

Purpose and use case

Some airlines are requiring a negative COVID-19 test prior to boarding a flight, and in future this may be adapted to a vaccine certificate for passengers and staff.[71] The UK government has sought a proposal for digital health certificates for travel from the company Onfido.[72] Health policy experts[73] envision vaccine mandates could be instituted and enforced by local governments or employers – similar to the current vaccine requirements for school-age children, military personnel, and hospital workers.[73] CommonPass, a product of the Commons Project is one example which has been trialed out by United Airlines and Cathay Pacific Airways to show COVID-19 test results and has been presented to over 37 governments. In the near future, it will integrate vaccine certificates.[19] Germany, Indonesia, Italy, Colombia, Argentina, have considered implementing health passports like CommonPass.[18] The company has proposed its use for travel, schools, hotels, and concert venues.[20] Guardtime, a KSI blockchain technology company, in collaboration with the Estonian government and the WHO has piloted a digital vaccination certificate program.[33] The platform is based on KSI blockchain, an EU-EIDAS certified trust service and X-Road, Estonia’s data sharing platform, and out of its many objectives, one of them is to test the proof of vaccination, similar to the International Certificate of Vaccination or “yellow card.” Covi-pass is another app that is now being considered in 15 countries including France, Canada, and India and is also supporting return to work and society. It is currently available for COVID-19 test results but plans to expand to incorporate vaccine certificates.[22] A secure COVID-19 vaccination certificate will play a critical role as economies reopen and international travel resumes.[33]

Ethical, legal, and policy considerations

More than half of the articles combined (n = 41, 58.5%) discussed legal, ethical, and policy concerns regarding COVID-19 vaccine certificate. The major concerns emerging from the ethical and legal perspective was that of health equity. Technology as much benefit as it brings, can also become a barrier for some, adding to existing inequities.[74] Development of vaccine certificates may exclude vulnerable and marginalized populations who do not have access to smart phones.[74] In terms of reopening the economy, including access to in-person social events, updating travel guidelines, or going to restaurants, gyms, and salons, one of the important questions will be to ask how society deals with the admission of non-vaccinated people. Alternatively, vaccine certificates may incentivize individuals to obtain vaccination against the virus, which is a social good.[75]

Discussion

As one of the largest mass immunization campaigns in history is underway, tracking of those who have been vaccinated could become essential as individuals return to work and international travel resumes. This review identified eight early vaccine certificate technologies that were under development. At the time of the initial review four countries had adopted the use of vaccine certificates[30,31,37,41,57] while at least 11 others including the European Union were in the process of planning and implementation.[16,17,24,35,37,42-56,58,59] As of June 2021, 1 of these countries had implemented the vaccine certificate while 1 country is now no longer considering the development of national vaccine certificate.[25,39]

The results of our scoping review point toward the different solutions that are being developed for vaccine certificate globally and the discourse about the challenges it brings. This is a rapidly evolving area, and our study describes the initial exploration of this concept. Since this is a preliminary review, we acknowledge that the use of vaccine certificates will evolve. It is difficult to predict the success or outcomes of the vaccine certificate solutions at this stage as most of the available information about vaccine certificates is from the grey literature and there is limited experience with implementation and evaluation.

All vaccine certificates identified are using blockchain technology which provides a secure system where data control lies with the end-user. Blockchain technology is a distributed ledger technology (DLT) which stores copies of a document on nodes across the entire network. Blockchain is considered essentially secure and cannot be tampered with or changed.[62,76] In addition to their use in vaccine certificates, blockchain technology has also recently been used for other healthcare initiatives such as contact tracing among others.[77-79] Companies such as IBM, WISekey, and Quantum Material Corp have already been working toward vaccine tracking,[21] COVID-19 test results,[26,80] and providing access to diagnostics, vaccine education and necessary medical services and data[28] prior to introducing vaccine certificates. At the time of this review, their solutions for vaccine certificates had reached the demo and beta testing trials.[26] Though blockchain was considered by all the solutions identified, it lacks uniform data security and privacy standards.

Vaccine certificates come with some ethical challenges. Historically and socially marginalized groups may be less likely to be vaccinated, due to poor access to healthcare but also due to lack of trust in the government as a result of past experiences of medical abuse.[81] For those who are unable to be vaccinated because of their religion or health status, or those who have difficulty accessing a vaccine or an antibody testing, a vaccine certificate could impact them unfairly.[75,81] To address these ethical challenges, there must be equitable policies for implementing vaccine certificates. To combat the mistrust in government, a community-based approach to promote vaccine uptake executed by the trusted community leaders, organizations, and local health care institutions should be considered.[81] Access to technology may also be a barrier to vaccine certificate use. Implementation of vaccine certificates must not marginalize against those who do not have access to or choose not to use technology.Therefore, alternate solutions such as paper-based vaccine certificate with a scannable QR code could be an option for those who cannot access technology.

Although there is much ongoing debate about the medical and ethical issues surrounding vaccine certificates, there has been less inspection of the technical foundations of vaccine certificate solutions.[63,82] The majority of the digital solutions we identified have involved a stack of data security and privacy standards, such as Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) from the World Wide Web Consortium (W3C). The standards can be based on the Semantic Web (an extension of the internet based on standards set by the W3C), with the goal of making data readable by machines.[63] This is useful for open public data but when combined with personal data and globally unique identifiers like DIDs, it could be used for other activities.

The leaders of IBM, the World Economic Forum, and International Air Transport Association (IATA) have also voiced the need for a single set of standards that can allow multiple platforms to interoperate.[83] To support the interoperability between vaccine certificates, the EU guideline has established criteria which includes 1) the use of minimal personal identifiable data, 2) a unique identifier for vaccination certificates, and 3) basis for a trust framework, i.e. the vaccine certificates should be issued by trusted entities and possible to verify the authenticity.[84] The WHO also released their first draft of the guide in March 2021, highlighting the guiding principles of vaccine certificates but the details around uniform technical standards will be shared in their release candidate 2 version.[85]

Fraud and counterfeit vaccine certificates also posit another challenge and undermine the biosecurity of a COVID-19 vaccine certificate.[86] The model based on data integration can be exploited by signature exclusion and replacement attacks. A person can remove the signature of a signed message or a digital document and replace it with another signature, tricking the verifier into believing an invalid message as valid. In this case, it can cause vaccine certificates to be completely fabricated as well.[63]

While there has been considerable discussion on implementation of digital vaccine certificates, there have been comparatively few implementations. Our review has identified some of the potential obstacles, specifically ethical and legal issues and technology challenges. Facilitating travel appears to be the most compelling use case. Conflating domestic use cases with facilitation of international travel may be creating barriers for implementation in the latter scenario. While, arguably, ethical and legal concerns are less of an issue for international travel use cases compared to domestic uses cases, technology challenges, in particular agreeing to international standards and trust frameworks, would be more problematic. Furthermore, in federal countries, there can be real challenges in harmonizing regional government efforts with federal.[87] In many of these countries, the immunization record would be generated at the regional government level and may not adhere to federal standards.

This study has several limitations. We chose to use a Google search for this review as the platforms we were evaluating were in the early development phase and not necessarily searchable in a traditional review platform. Although this allowed us to identify companies and platforms in production, we recognize that this is a rapidly evolving area, and several new solutions will be emerging. Since many of the applications identified were in the beta testing or demo phase, further development will likely still occur. Furthermore, using Google as a search platform may create bias in the articles identified. We attempted to mitigate that by reviewing up to 150 search results, conducting numerous searches and conducting the search in privacy mode. Of the articles identified, the majority were from news articles, opinions/editorials, or research articles (91%) many of which referred to some kind of evidence (i.e., research or expert opinions). Finally, this review was limited to English language content. Since we are reviewing digital solutions around the world, it is likely that other relevant solutions were missed. As the conversations around vaccine certificate evolved, we conducted additional searching to identify countries approach toward vaccine certificates.

Conclusion

In summary, we have identified a number of early digital platforms under development for COVID-19 vaccine certificates around the world. Several countries are moving forward with vaccine certificates in certain settings. The solutions we identified are based upon blockchain technology, which is considered the gold standard for securely storing personal information. It is important to consider limitations to blockchain-related healthcare implementations. Moreover, it is important when considering the implementation of vaccine certificates that it is taken up in an ethical manner that does not discriminate against those who do not have access to the technology as well as access to the vaccines itself. Therefore, it is integral to the success of these blockchain-based solutions for policymakers and government safety and privacy regulators to consider laws that detail appropriate risk management to put in place while still allowing the tool to work as intended.

Click here for additional data file.

Click here for additional data file.