26 Feb 2021

techUK's response to the Ada Lovelace Institute's call for evidence on vaccine passports

For some countries, access to vaccinations against COVID-19 are becoming an increasing reality. As a result, the viability of ‘vaccination passports’ or ‘vaccination passes’ are being considered across the world. The overall aim is to support a gradual return to life as we know it, including the return of international travel for business and leisure, and in some parts of the world, the reopening of schools, shops, bars and restaurants.  

As we respond to this call for evidence, there are still a number of unknowns when it comes to the epidemiology of COVID-19. For example, further investigation is needed as to whether people who have been vaccinated can still transmit the virus and how long vaccines last before another dose is needed. Any future vaccination passport system would most likely have to work in conjunction with other measures (regular rapid testing, social-distancing measures, face masks, etc.) to reduce the risk of transmission.  

In recent months, a number of countries, such as Denmark, Sweden, Greece and Spain, have given a green light to the development of vaccination passports. In the UK, the Government recently announced it would be reviewing the role COVID-status certification could play in helping to reopen our economy. techUK supports government’s commitment to draw on external advice and stands ready to provide advice and support.  

Further clarity from government on the UK’s direction of travel is needed urgently so that potential suppliers of the technology and EHR vendors can prepare accordingly. If the Government allows the use of vaccine passes in the future, further discussion is necessary on how the roll-out of these apps will be funded, for example, government subsidy, business only or a mix of both.   

As the trade association for the UK tech sector, techUK welcomes the opportunity to provide input to the call for evidence on the technical considerations that must be taken into account and addressed as the debate on vaccine passes continues. From our engagement with our members, we have summarised below some of the main technical considerations that we believe must be addressed:  

Access to good quality data- In the UK, patient access to Summary Care Records (SCR), an electronic record of important patient information such as vaccination status, is not widely available online. Patient access to data on vaccinations remains limited because GPs act as the primary data controller and can choose whether this data is available for the patient to see on the NHS App or other approved users of the NHS’ Patient Facing Services API. Data stored in the National Immunisation Management Service (NIMS) is classified as management information. Additionally, valuable data is siloed in other parts of the health and care system (e.g. National Immunisation Vaccination System for healthcare workers) and it is either not collected or held in analogue formats. There are a relatively small number of companies authorised to get access to the required data through existing APIs, and it is often not complete. Further consideration is needed as to how this data could be shared safely and securely with third parties. The National Events Management System (NEMS) is one potential solution to this challenge, which is already being used to track vaccinations in children and could be extended further to the adult population. 

In addition, the COPI notices, used for easier data access for research during COVID-19, are an example of where we’ve seen some relaxation of information governance on COVID-related data and a further extension beyond 30 September 2021 would be welcomed.  

Data privacy and security- Since vaccination passports requires the use of patient data, which is highly sensitive personal data, any health pass that’s approved must ensure it’s been developed to a high ethical standard and applied a privacy-by-design approach. Reducing the risk of data leakage and protection against malicious actors will also be key.  

Useability and interoperability- There is a current indication that UK Government are assessing the use of vaccine passports for international travel, but other potential domestic use cases might also exist. Further consideration of where it could be considered unethical to use/require vaccine passports is also necessary. 

From a user perspective, it’s important that any site using a vaccine app has the ability to manage a multiplicity of health pass apps and does not become reliant on a single app or technology solution. It’s also important to understand how citizens will be able to prove something that is true about them while not fully disclosing their identity. In addition, non-digital alternatives to the health pass must be available for those that don’t have access to digital devices. Any adopted approach must undergo rigorous user testing to ensure it’s easy for everyone to use and should not place any burden on the frontline workers who are administrating the vaccine. 

For international travel purposes, any health passes that are developed must be recognised and supported across borders. There may therefore need to be a mechanism put in place to verify the credibility of a particular health pass system at an international level. Further consideration would be needed as to which trusted authority is best placed to verify the different health passes that may become available.  

Other countries have already expressed that international visitors may require vaccine documentation before entry. The UK will therefore also need to decide on its approach to assessing vaccination passes developed abroad.  

Scalability- Providers of vaccination passes need to ensure their architecture patterns can work globally and have the appropriate rigour when it comes to security, integration and scalability. The challenge here is also delivering a viable digital end-to-end credential. 

Inclusion- A multiplicity of vaccine passes is beneficial for many reasons. It encourages competition and innovation, provides users with choice, improves flexibility and reduces the risks associated with reliance on a single pass. Any approach to vaccination passports cannot and should not be delivered centrally by government alone. Public/private partnerships will be essential and collaborative working in this space will deliver the best results. This has been evident throughout the UK’s response to the COVID-19 pandemic, for example the Ventilator Challenge, where British manufactures helped to produce over 14,000 ventilators last year. 

For further information on techUK's work in this area, please contact [email protected] or [email protected]

Katherine Holden

Katherine Holden

Associate Director, Data Analytics, AI and Digital ID, techUK

Leontina Postelnicu

Leontina Postelnicu

Head of Health and Social Care, techUK