Report by Paula Antolini, August 30, 2021, 8:50PM EDT
Are we headed for “Vaccine Passports”? It certainly sounds like it. View “DDCC:VS” below, and decide for yourself.
*****
The World Health Organization (W.H.O.) has published a “Digital Documentation of COVID-19 Certificates: Vaccination Status” guidance document, dated August 27, 2021 which contains “technical specifications and implementation guidance” for countries and implementing partners on the introduction of digital vaccine certificates, dubbed DDCC:VS.
“This is a guidance document for countries and implementing partners on the technical requirements for developing digital information systems for issuing standards-based interoperable digital certificates for COVID-19 vaccination status, and considerations for implementation of such systems, for the purposes of continuity of care, and proof of vaccination,” the
This work was funded by the Bill and Melinda Gates Foundation, the Government of Estonia, Foundation Botnar, the State of Kuwait, and the Rockefeller Foundation. The views of the funding bodies have not influenced the content of this document.
Below is a shorter version of the document (and thus some references to “figures” or “sections” can be viewed on the full document.) Click here to view entire document after downloading.
*****
EXECUTIVE SUMMARY:
In the context of the coronavirus disease (COVID-19) pandemic, the concept of Digital Documentation of COVID-19 Certificates (DDCC) is proposed as a mechanism by which a person’s COVID-19-related health data can be digitally documented via an electronic certificate. A digital vaccination certificate that documents a person’s current
vaccination status to protect against COVID-19 can then be used for continuity of care or as proof of vaccination for purposes other than health care. The resulting artefact of this approach is referred to as the Digital Documentation of COVID-19 Certificates: Vaccination Status (DDCC:VS).
The current document is written for the ongoing global COVID-19 pandemic; thus, the approach is
architected to respond to the evolving science and to the immediate needs of countries in this rapidly
changing context; for this reason, the document is issued as interim guidance. The approach could
eventually be extended to capture vaccination status to protect against other diseases.
The document is part of a series of guidance documents (see Fig. 1) on digital documentation of
COVID-19-related data of interest: vaccination status (this document), laboratory test results, and
history of SARS-CoV-2 infection.
The World Health Organization (WHO) has developed this guidance and accompanying technical
specifications, in collaboration with a multidisciplinary group of partners and experts, in order to
support WHO Member States in adopting interoperable standards for recording vaccination status. The
audience of this document is therefore Member States and their implementing partners that want to
put in place digitally signed vaccination records.
*****
What is the DDCC:VS?
A vaccination certificate is a health document that records a vaccination service received by an
individual, traditionally as a paper card noting key details about the vaccinated individual, vaccine
administered, date administered, and other data in the core data set (see section 5.2). Digital
vaccination certificates are immunization records in an electronic format that are accessible by both
the vaccinated person and authorized health workers, and which can be used in the same way as the
paper card: to ensure continuity of care or provide proof of vaccination. These are the two scenarios
considered in this document (see Table 1).
A vaccination certificate can be purely digital (e.g. stored in a smartphone application or on a cloudbased server) and replace the need for a paper card, or it can be a digital representation of the
traditional paper-based record (see Fig. 2). A digital certificate should never require individuals to
have a smartphone or computer. The link between the paper record and the digital record can be
established using a one-dimensional (1D) or two-dimensional (2D) barcode, for example, printed on
or affixed to the paper vaccination card. References to the “paper” record in this document mean a
physical document (printed on paper, plastic card, cardboard, etc.). An illustrative example of a paperbased DDCC:VS is given in Annex 1.
*****
Scenarios of use of the DDCC:VS
The scope of this document covers two scenarios of use for the DDCC:VS (see Table 1).
- CONTINUITY OF CARE: Vaccination records are an important part of an individual’s medical records,
starting at birth. The Continuity of Care scenario describes the primary purpose of a vaccination
certificate. The vaccination record shows individuals and caregivers which vaccinations an
individual has received, as part of that individual’s medical history; it therefore supports informed
decision-making on any future health service provision. - PROOF OF VACCINATION: Vaccination records can also provide proof of vaccination status for
purposes not related to health care.
*****
What are the minimum requirements to implement a DDCC:VS?
Digital vaccination certificates should meet the public health needs of each WHO Member State,
as well as the needs of individuals around the world. They should never create inequity due to lack
of access to specific software or technologies (i.e. a digital divide). The recommendations for the
implementation of DDCC:VS must therefore be applicable to the widest range of use cases, catering to
many different levels of digital maturity between implementing countries. The minimum requirements
were developed accordingly, to allow the greatest possible flexibility for Member States and their
implementer(s) to build a solution that is fit for purpose in the context of their overall health
information systems.
The minimum requirements for a DDCC:VS are as follows:
→ The potential benefits, risks and costs of implementing a DDCC:VS solution should be assessed
before introducing a DDCC:VS system and its associated infrastructure. This includes an impact
assessment of the ethical and privacy implications and potential risks that may arise with the
implementation of a DDCC:VS.
→ Member States must establish the appropriate policies for appropriate use, data protection and
governance of the DDCC:VS to reduce the potential harms, while achieving the public health
benefits involved in deploying such a solution.
→ A digitally signed electronic version of the data about a vaccination event, called a DDCC:VS, must
exist. As a minimum, both the required data elements in the core data set and the metadata should
be recorded, as described in section 5.2.
→ An individual who has received a vaccination should have access to proof of this – either as a
traditional paper card or a version of the electronic DDCC:VS.
→ Where a paper vaccination card is used, it should be associated with a health certificate identifier
(HCID). A DDCC:VS should be associated, as a digital representation, with the paper vaccination
card via the HCID. Multiple forms of digital representations of the DDCC:VS may be associated with
the paper vaccination card via the HCID.
→ The HCID should appear on any paper card in both a human-readable and a machine-readable
format (i.e. alphanumeric characters that are printed, as well as rendered as a 1D or 2D barcode).
→ A DDCC:VS Generation Service should exist. The DDCC:VS Generation Service is responsible for
taking data about a vaccination event, converting it to use the FHIR standard, and then digitally
signing the FHIR document and returning it to the DDCC:VS Holder. This signed FHIR document is
the DDCC:VS.
→ A DDCC:VS Registry Service should exist. The DDCC:VS Registry Service is responsible for storing
an index that associates an HCID with metadata about the DDCC:VS. As a minimum, the Registry
Service stores the core metadata described in section 5.2. One or more DDCC:VS Repository
Service(s) may exist, which can be used to retrieve a DDCC:VS; in which case the location of the
DDCC:VS may also be included in the metadata within the DDCC:VS Registry Service.
The different services are discussed in more detail in sections 3 and 4, and are shown in Fig. 7.
These components are minimum requirements; Member States may adopt and develop additional
components for their deployed DDCC:VS system.
*****
Other sections are:
Section 1: Introduction
Coronavirus disease (COVID-19), caused by the severe acute respiratory
syndrome coronavirus 2 (SARS-CoV-2), was first identified in December
2019 and has spread to become a global pandemic. The outbreak has
forced curtailment of movement, curfews and adoption of preventative
measures to try to halt transmission, lower the burden on health
systems, and reduce morbidity and loss of life. COVID-19 vaccines
are being delivered at record speed, and countries need a way to
give individuals a record of their vaccination status. Ideally, digital
technology can be leveraged to facilitate large-scale vaccination
campaigns and augment paper-based vaccination cards, which are
easily lost and prone to fraud (1–4). There are a wide range of digital
solutions that can be used to document COVID-19 vaccination, and
choices on design and implementation should be guided by balancing
various values and contextual considerations. To ensure respect for
human rights and protection of values such as equity and public trust,
the technical specifications and implementation guidance outlined in
this document have been built on the basis of the ethical considerations
and data protection principles described in section 2 of this document.
Section 2: Ethical considerations and data protection principles
As with any digital solution, there are ethical considerations, such
as potential impacts on equity and on equitable access, and data
protection principles that need to inform the design of the technical
specifications, as well as provide guidance on how resulting solutions
can be ethically implemented. The following sections discuss some key
ethical considerations and data protection principles that Member
States are encouraged to – and, where they have legal obligations, must
– include in their respective deployments of any DDCC:VS. These ethical
considerations and data protection principles have also informed the
design criteria for a DDCC:VS outlined in the following section.
Section 3: Continuity of Care scenario
This section describes the use cases and actors involved in using a
DDCC:VS for Continuity of Care, as well as functional requirements for
a digital solution. In the context of COVID-19, the use of a vaccination
record for Continuity of Care is primarily to: ensure that individuals
know if, and when, they will need a subsequent dose; for health
workers to use the proof of COVID-19 vaccination to decide on provision
of health services based on medical history; and for ensuring health
workers have access to accurate vaccination history when an adverse
event follows immunization. It will be up to Member States to define
how this scenario is applied and adapted to their own context and
level of digital maturity, in compliance with their legal and policy
frameworks.
Section 4: Proof of Vaccination scenario
This section describes the use cases and actors involved in using a
DDCC:VS for Proof of Vaccination, as well as functional requirements
for a digital solution. The Proof of Vaccination scenario relies on the
PHA having access to a trusted means of digitally signing an HL7 FHIR
document, which represents the core data set for the DDCC:VS. It will
be up to Member States to define the purposes for which this scenario
is applied and adapted to their own contexts and levels of digital
maturity, in compliance with their legal and policy frameworks.
Section 5: DDCC:VS core data set
The DDCC:VS core data set includes data elements about the Subject
of Care and vaccine administration events that are required for the
two core scenarios of Continuity of Care and Proof of Vaccination.
Stakeholders and systems may use the DDCC:VS core data set as
defined, or they may continue to use their existing terminology with a
map to the DDCC:VS core data set, so long as it contains the required
data elements in the DDCC:VS core data set. The recommended
core data set is intended to include the critical data required for
interoperability, specific to the scenarios of use defined and driven by
the public health need. A comprehensive data dictionary in spreadsheet
format can be found in Web Annex A.
Section 6: National Trust Architecture for the DDCC:VS
The scenarios presented in earlier chapters, and the data associated
with them, suggest the need for a digital ecosystem within a country
for the issuance, updating and verification of the DDCC:VS. This
ecosystem would comprise a suite of digital tools for the management
of DDCC:VS data and the processes and governance rules for using
these systems. It could be as simple as a server for storing and
managing the data or as extensive as an entire health information
exchange infrastructure.
Section 7: National governance considerations
Governance in the health sector is “a wide range of steering and
rule-making related functions carried out by governments/decisions
makers as they seek to achieve national health policy objectives that
are conducive to universal health coverage” (33). A national framework
to govern the complex and dynamic health policy for implementing
DDCC:VS should be tailored to meet the Member State’s needs, which
vary. This section provides an overview of some key governance
considerations for Member States implementing DDCC:VS solutions.
However, it will be the responsibility of the Member State to determine
the most appropriate governance mechanisms for its context.
Section 8: Implementation considerations
Since COVID-19 was declared a Public Health Emergency of
International Concern under the IHR in January 2020, there has been a
clear and urgent need for all Member States to effectively address the
COVID-19 pandemic. In the digital age, there has also been immediate
acknowledgement that digital health solutions can effectively and
immediately be leveraged to support the public health response to
the pandemic (35). However, there are two distinct approaches that
Member States can use to pursue the implementation of DDCC:VS, both
of which have different implications for implementation strategy
VIEW FULL DOCUMENT HERE (download).
###