IE 11 is not supported. For an optimal experience visit our site on another browser.

Paper beats app: Vaccine verification will likely be proven offline. Here's why.

The realities of medical records, privacy concerns and the virus itself mean efforts to build vaccine passport apps are unlikely to succeed in the coming months.
Coronavirus disease (COVID-19) vaccination study at the Research Centers of America in Hollywood
A volunteer is injected with a vaccine candidate in a Covid-19 vaccination study at Research Centers of America in Hollywood, Fla., on Sept. 24.Marco Bello / Reuters file

It's an intuitive idea: an app that provides proof that a person has received a coronavirus vaccine.

Plenty of technologists are working to make it a reality. Companies of all sizes have been pouring in resources: Microsoft, major airlines, Ticketmaster, prominent nonprofits, security companies, tech startups and blockchain companies are all taking hacks at what some call vaccine passports. Apple and Google have participated in discussions about how to create digital Covid-19 vaccine certificates, experts said, but they haven't announced plans.

But behind the scenes, the realities of medical records, privacy concerns and the virus itself mean such products are unlikely to be widely available in the coming months, experts said.

"This is something that almost no one can focus on right now," said Rebecca Coyle, executive director of the American Immunization Registry Association, a membership organization for state and local vaccine registries. She said digital Covid-19 certificates may seem like "a nice shiny object" but might not be a reality for many months.

Full coverage of the coronavirus outbreak

The challenges underscore how the pandemic has laid bare the gap between what technologists hope to accomplish and the stark realities of responding to a nationwide crisis. While all states and some cities keep vaccine databases, few of them so far have been willing or able to embrace vaccine apps.

And with some Americans set to start receiving Covid-19 vaccines as early as this month, the proof that they got their shots will come on an older technology: paper.

Paper-based "yellow cards" have been used for years as proof that people have been vaccinated. International travelers who are vaccinated against yellow fever are given signed and stamped certificates to take on their trips.

"It's the same thing they did in 1918," said Billy Sparks, a co-founder of Vacmobile, an Atlanta startup that is one of many companies and organizations working to make digital immunization certificates a reality. Its app is in testing, so it won't be ready for a rollout with the potential first wave of U.S. vaccinations.

The probability that Covid-19 certificates will be paper-only, at least at first, strikes some people as ridiculous.

"As a country, we've transitioned health care from paper to digital records. And now that we're in this public health crisis, we should be using that infrastructure we built, not reverting back to the technology from past decades or even centuries," said Ben Moscovitch, director of the health information technology project at the nonprofit Pew Charitable Trusts.

A survey for Pew Charitable Trusts found this year that 61 percent of adults said they would want to be able to download their medical records onto mobile apps to manage their health.

Airlines are an early test

But creating a digital immunization certificate has proved a grueling task, even as other kinds of medical records have been digitized and more people get used to storing electronic health records on their smartphones.

A network of tech companies called the Covid-19 Credentials Initiative is trying to set standards for vaccine certificates, while the Commons Project, a nonprofit, is working with the World Economic Forum on a digital health pass that has been going through trials, some of them on flights between Hong Kong, Singapore, London and New York.

Microsoft has helped spearhead work on a collaborative framework that it says would allow consumers "to store and manage their own COVID-19 vaccination or laboratory records, and present these records to another party in a verifiable manner." The company has posted details and a video online.

"Key use cases include conveying vaccination records or point-in-time infection status for return-to-workplace or travel," the company said in a statement.

Apple and Google have participated in similar discussions about digital Covid-19 vaccine certificates, experts said, but the companies haven't announced any plans. They declined to comment.

A major obstacle is that no one knows how long immunity from a Covid-19 vaccine may last, so it's impossible to say how long proof of vaccination may be worth anything.

"What's the expiration date we're going to put on that vaccination certificate?" asked L.J. Tan, chief strategy officer for the nonprofit Immunization Action Coalition.

"We know we need more data," he said, adding that the data might not be available until next summer. Digital immunization certificates, he said, are "a little premature."

Even once more is known about the vaccines, the challenges are numerous for those trying to make Covid-19 apps. There's been no outline of a national strategy for whether and how to go about building them.

Digital files will have to be protected against forgery and impersonation to be meaningful to third parties, such as airlines. They will also have to be compatible with different third parties, whether they are restaurants or concert venues. And there has to be a secure way to transmit the proof while keeping people in control of their data, privacy advocates said.

A simple digital photo of a record may not be enough to satisfy anyone that you've been vaccinated, given that it can be copied and shared.

"You can't just snapshot it, like a bar code," Tan said.

States have the data but little money

But vaccine certificates would also be built on the backbone of those who currently hold vaccination records: medical providers, such as doctors' offices, and the vaccine registries that operate on the state and local levels. Many don't have the resources to help with proposed apps.

The vaccine registries set up by states and cities — New York City has its own, for example — have been around for decades, but they have never gotten the money they need to be comprehensive or to keep up with technological change, experts said.

Coyle, of the American Immunization Registry Association, said that the state registries want to accommodate the demand for digital vaccine certificates but that in addition to addressing the lack of resources, they want to make sure any system meets the privacy requirements they're used to, such as health-specific data sharing standards.

She said she was encouraged that Apple and Google had been part of discussions about digital certificates, because the companies have more experience than many others in Silicon Valley in consumer health apps. But she said the challenges are still daunting, including building a system to prevent forgery.

"You've got to build that type of authentication system into any app that's going to be used for these purposes. And that's actually a huge lift. I think it's a lot bigger lift that people realize," she said.

Apple already allows people to download immunization and other medical records onto their devices if their providers have agreements with Apple. There's a similar app for Google's Android operating system, developed by the nonprofit Commons Project, and it is connected to 230 U.S. health care systems. But other apps in the works might have greater capability, such as easier sharing with third parties.

Just magical thinking?

Some worry that the apps could be a distraction from public health priorities or, worse, compromise privacy or create two classes of people.

"This is something that's being driven by the greed of tech corporations, not the actual public health guidance," said Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, a digital privacy group in New York.

Cahn compared the idea to the Covid-19 exposure notification apps that technologists came up with early in the pandemic, which haven't had a wide impact. He also said there's no assurance that digital vaccine records held by third parties wouldn't end up in the wrong hands, such as law enforcement.

New York Gov. Andrew Cuomo and others have expressed concern that vaccine records could end up in a federal database accessible to immigration authorities, for example.

"We keep seeing Silicon Valley salesmanship winning out over somber public health guidance, and we really just have to stop the magical thinking," Cahn said. "The reason a lot of this technology seems too good to be true is that it is."

A Seattle startup said in a news release that it planned to sell Covid-19 digital vaccine certificates for up to $199.99, not for airline boarding but "for other social situations, such as an elderly person wanting to confirm their plumber is vaccinated before entering the home."

Some skeptics may be warming to the idea. The World Health Organization has opposed "immunity passports" for people who have recovered from Covid-19, because of the lack of knowledge about how long immunity lasts, but it is working with Estonia on possible "e-vaccination certificates," Reuters reported last week.

Download the NBC News app for full coverage of the coronavirus outbreak

Ticketmaster, the ticket sales and distribution giant, has moved in the opposite direction. It told Billboard last month that it was exploring the idea of checking vaccination status, but it later clarified on its website that it was "just a potential idea and is not being implemented at this time."

Joe Berchtold, president of Ticketmaster's parent company, Live Nation, told CNBC this week that he didn't think mandatory vaccination proof would be necessary at live events next summer, unless local health officials mandate it.

But even after Covid-19 subsides, there will probably be demand for digital proof of past vaccinations. Jenny Wanger, head of the Implementer's Forum at Linux Foundation Public Health, said any systems that get built now will have lasting effects, so they should have privacy and transparency at the center.

"Vaccine credentials are a very slippery slope," she said. "If not done right, vaccine credentials will be a major violation — and an easy one — of individuals' health privacy, because you're carrying around in your pocket something that's a critical piece of health data."