WHO, IATA, CommonCheck, EU jostle for digital health passes, guidance to get world moving

Representatives from travel, intergovernmental organizations and a non-profit discuss the issues facing the standardization and interoperability of health passes around the world. Tools are reaching completion to allow verifiers to check digital health passes issued by governments, health services and test centers worldwide. With all the integrated health pass verifiers touting similar products promising similar transparency and security, will one take the lead?

The first webinar in a series called the ‘Road to Border Management and Identity Conference,’ which will now take place in Bangkok in December 2022, brought together speakers from the EU, IATA, WHO and The Commons Project to share their views. The webinar, ‘Digital Health Certificates for Cross-Border Mobility’ was arranged by the Asia-Pacific Smart Card Association (APSCA) and hosted by Denato Colucci, head of Border and Identity Solutions at the IOM.

WHO: Digital Documentation of COVID-19 Certificates as worldwide guidance

First up, Nataschja (Nat) Ratanaprayul, technical officer, Public Health Technology, Department of Digital Health and Innovations at the World Health Organization laid out their guidance to member states, spanning everything from interoperability to environmental awareness.

As guidance, this is not a platform or solution in its own right nor a policy document, but clear sets of guidelines for how member states might implement digital health pass systems and technologies in ways that can interact with approaches used in other countries. The WHO’s guidance and upcoming tools are intended to get the world moving again in a fair, transparent way.

“Interoperability of systems stems from interoperability of people,” said Ratanaprayul, referring to the need for agreements as much as the need for people to be able to travel. Given the competing products already coming to market, the private sector could monopolize the solutions, she added. Representatives from some of the other organizations would later state that issues are for governments, not the private sector.

The WHO is producing technical specifications and implementation guidance on the Digital Documentation of COVID-19 Certificates (DDCC), with 11 design principles covering functionality, data representation, national trust architectures, ethics, privacy protection, open standards and avoidance of vendor lock-in on the individual and national levels.

In a bid to make certification as accessible as possible whether for vaccination status or test result, Ratanaprayul said, “It should be possible to potentially have something that’s hand-written on paper, but then have a QR code that’s embedded on it that can be verified.” The QR code would contain a data set.

Fraud in the form of fake paper or digital health passes is a growing concern, urging the WHO to develop its guidance.

The Canada Border Services Agency (CBSA) says it has intercepted almost 500 suspected fake COVID-19 test results and vaccination records from people trying to enter the country by land and air. The CBC reports 374 suspected fraudulent test results and 92 fake vaccination certificates had been identified by the end of October.

DDCCs are not intended to be identity documents, said Ratanaprayul. States must decide if they want to link documents to citizens’ ID and how – whether to a health number, ID number, passport numbers and so on. The WHO intends for the developments to integrate with states’ digital health systems and underpin future immunization campaigns.

New tools developed as part of WHO efforts are almost ready. By the end of 2021, the DDCC Gateway (PKI) beta reference software is expected and a Universal Status Checking app beta, using Google Android FHIR SDK and based on the EU DCC (see below). It is intended to be able to recognize all the health pass QR code formats being used worldwide.

Then further test result certificate generation service tools will be available in January 2022 and further guidance on test results published by the end of Q1 2022.

IATA: Airline organization ready to take on the task to avoid 8-hour airport processing

“COVID has been the most severe crisis for aviation during the time aviation has existed,” said Vinoop Goel, Asia-Pacific regional director, Airports and External Relations, International Air Transport Association (IATA).

Pre-COVID, the average time spent in processing at the airport at either end of a journey was 1.5 hours. This has already doubled at peak times, despite overall lower passenger numbers. “If travel returns to pre-COVID levels in numbers, that processing time will increase to 8 hours.”

As a result, and at the request of its members, IATA developed the IATA Travel Pass. It creates a digital identity from a traveler’s passport (with more authentication steps if it is not an e-passport), communicates with testing laboratories to import results and also checks the organization’s database of countries’ entry requirements around COVID.

“You can pretty much verify whether this person should be allowed into the country or not,” said Goel. The app’s information can be securely shared with airlines, immigration and airports, but the passenger has control in the decentralized identity framework with nod central database. A move which removes the airlines from the position of data middleman, according to Goel.

IATA has had interest from almost every airline in the world, some are trialling the system and the organization is working with governments on compliance as it is hoping for them to use the service for health pass pre-approval for passengers before arrival. It is also working with laboratories around the world on integrating test results with its open APIs and open standards.

The Seychelles is the latest country to devise a system for pre-approving passenger health statuses, allowing them to walk down a biometric detection corridor on arrival.

Meanwhile, “We are hoping that the future processes will be contactless end-to-end, based on biometrics,” said Goel, with an eye to the IATA One ID concept.

CommonCheck: government-type service when the government is not prepared

“This is fundamentally a government issue, it’s not an airline issue to solve,” said Paul Meyer, executive founder and president, The Commons Project, which stems from the Rockerfeller Foundation as a non-profit which aims to deliver global-scale digital platforms and services for the common good.

“The idea that an airline check-in agent looking at a piece of paper of a test result in any language is actually a reliable way of ensuring that someone actually got tested – it’s just not reliable,” said Meyer, who added that governments would have to re-verify, if they cared enough.

While getting the world moving again may come down to government efforts, “You’ll never get a verifiable credential from the US government,” said Meyer who has been in digital health for 25 years and has never before seen such rapid adoption of open and interoperable standards in the field. Yet in the States, you might get state, hospital or pharmacy-issued health credentials rather than federal.

One of The Commons Project’s divisions is the SMART Health Card which has become the de facto standard in the U.S., according to Meyer. It has been adopted as the state-level standard in nine states so far with three more underway reports Forbes and is being adopted by other countries such as Canada, Japan, North Macedonia, Rwanda and a number of other African countries.

The organization is also offering CommonCheck, a tool to simplify interoperability by recognizing all health pass formats. Governments would be able to set their rules for entry and then, pre-departure, a passenger would enter their documentation and if they qualify, would receive a certificate. Airlines and immigration could also access the secure record.

The system is already integrated into passenger locator form portals such as the Cayman Islands’.

EU: Built on freedom of movement, countries line up to join

The European Union’s Digital COVID Certificate (EU DCC) was implemented in 64 days over the spring and helped save the EU’s tourism sector in the summer. It is built on the EU’s commitment to the freedom of movement, not specifically for crossing the bloc’s external border, said Michiel Sweerts, policy officer, Directorate-General for Communications Networks, Content and Technology at the European Commission.

It issues certificates per vaccine dose, per test and per COVID recovery. Together these have already passed 707 million certificates, 490 million of which are vaccination certificates.

Fifty-two countries are now connected to the EU DCC Gateway, a system which uses a digitally-signed QR codes and public and private keys to mean that when the public keys are exchanged via national backends to the EU DCC Gateway, no health of personal data cross borders, just the key.

The 52 countries already integrating are the EU27, 3 EEA and 22 third countries such as Switzerland, Turkey, Israel, the UK and newest member, El Salvador. A further 29 countries across five continents are under assessment, with one or two more joining the line each week.

All standards are open, meaning countries have been able to use them to build their own systems or parts thereof, such as the UK. While the EU has provided a common template for the app, QR code reader and wallet, it has no plans at the European level to have unified app or wallet.

“We’re seeing a convergence of different initiatives at the moment where the potential for using these kinds of digital tools in a broader context to potentially materialize in the coming years,” said Sweerts, referring to the revision of EIDAS regulations with electronic ID, the intention to deploy health as a use case, the Digital Services Act and the European Health Data Space.

While this will be a slow process, he notes, acceleration of digital certificates across the world has huge potential.

It seems that as a standards-setter, the EU could have a significant role in this.

Article Topics

airports  |  APSCA  |  biometrics  |  border management  |  digital ID  |  document verification  |  health passes  |  International Air Transport Association  |  interoperability  |  standards  |  travel and tourism  |  verifiable credentials