Vaccine Record on Phone..more

Dear Ms. Smartphone: If paper records can be forged, how about those on smartphones? I enjoyed last week’s column about digital record keeping. But then you mentioned that some passengers (mostly outside the U.S.) were using negative results from faked Covid tests to get travel access. I hope to start flying soon and want my plane to be Covid free. Are the same people going to fake getting the vaccine, and if so, would it be safer if the virtual record is kept on our phones?  Erin, Sausalito

Dear Erin: I didn’t mean to alarm people with the item about travel and counterfeit Covid records. I am not in public health but imagine that there is always some level of forged activity and behavior. But to your question: would it be safer to keep vaccination records on our smartphones? 

There is a precedent for paperless, digital certificates.  When you take an airline trip, you might be one of the millions who upload your boarding pass to a digital wallet. Behind the scenes as you board, the bar code in your wallet is ‘read’, transmitted to a central data base, and matched to the airline’s reservations file. You are fairly secure since the bar code has to match the record in the airline’s data base.  Yes, there are fraudsters who could facilely fake bar codes for phones  but they have to be highly sophisticated to hack into the airline’s data base. 

Digital Record Keepers

Since Covid began, companies like IBM, with its Digital Health Pass  have vied to develop platforms so that people can upload their health records and fly with confidence.  And, a Swiss non-profit called the Commons Project and the World Economic Forum, have partnered with many major airlines including United and JetBlue. 

This week, LA County is piloting a smartphone record as they roll out the vaccine. But, it is administratively more complex than airline reservations as there is no central source for certification. Lot of different health organizations will administer the vaccine, from large retail pharmacies, pop-up vaccination centers in supermarkets to wellness centers. These sites have to upload vaccination records to a “platform.”

And then, assuming each one has that capacity, who will maintain the platform and the database to insure its integrity and accuracy? For example, might it be the platform provider, like IBM or Common Trust, or might it be the U.S. government’s Center for Disease Control? 

‘Opening Up’ Means UpLoading?

For this data base to be useful for reopening the economy, connectivity with the platform is essential. Say you need to show that you got the Covid vaccine to gain entrance to a big conference, rent a car, or get ticketed for a sports event. Your credentials would be checked by two-way communications between the bar-code on your phone and a centralized data-base. Note that if the data check was asynchronous, not done in real time, then it would be easier to create bogus entrance passes. 

In researching this topic, I learned that a business teamed up with US Customs and Border Protection (TSA is part of them) to create a mobile passport in 2014  without government funding. The digital passport on the phone cuts out the need to wait in line at customs. Pre Covid they had 30 airport locations and 7 million users. But, this type of  business model may now be subject to greater scrutiny. Customers and Border Protection had a large data breach in 2019 when facial imaging data was transmitted by a (private) subcontractor’s database.

Solutions?

We are in the early days of understanding what can and should be kept on phones when it comes to digital certification. There will not be an overnight solution because there will be further digital divides, perhaps digital chasms, between those with tech and those who lack smartphones and a data plan. While many of us continue to put money in our digital wallets and do banking online, health and travel records are tricky. 

On a personal note, my friends and family who have been fortunate enough to get Covid shots have all received, shades of grade school, yellow index sized cards or papers with the date of inoculation, the manufacturer name, lot number of the vaccine, and the health care site. Whether that piece of paper will satisfy the airlines, hotels, and public venues remains an open issue and whether those with phones ‘opt in’ to ‘get out.’