WHO Issues COVID-19 Digital ‘Vaccine Pass’ Guidelines – But Stresses These Should Not be Requirements for Travel

Although the World Health Organization (WHO) has issued technical guidelines for the development of digital COVID-19 ‘vaccine certificates’, it has stressed that these should not be a prerequisite for international travel.  

At the release of the technical guidelines last Friday (27 August), the WHO stated that it “does not support the requirement of proof of COVID-19 vaccination in order to travel”, citing that vaccines were not yet widely available in many countries.

“In some situations, however, depending on the risk assessment of the countries concerned, information about vaccination against COVID-19 may be used to reduce requirements for quarantine or testing upon arrival,” it added in a media statement.

“Historically, paper-based vaccination records have presented many challenges – such as the possibility of losing or damaging the card, or even the possibility of fraud. The proposed digital solutions are designed to address these challenges.”

In mid-July, the International Health Regulations Emergency Committee (IHR EC) advised the WHO to “expedite the work to establish updated means for documenting COVID-19 status of travellers, including vaccination, history of SARS-CoV-2 infection, and SARS-CoV-2 test results”.

It also advised that WHO member states recognise “all COVID-19 vaccines that have received WHO Emergency Use Listing in the context of international travel”. 

Adaptation of ‘yellow card’?

The WHO has proposed that, in the absence of digital certificates to record COVID-19 vaccinations, the International Certificate of Vaccination and Prophylaxis (ICVP) could be updated to include COVID-19 vaccinations. The ICVP, known as the “yellow card”, is used internationally mostly to show that travellers have had yellow fever vaccines.

However, the technical guidance sets out how to create a signed digital version of a vaccination record for COVID-19 “based on a core data set of key information to be recorded, and an approach for the digital signature”. 

It provides member states with a baseline set of requirements for a compliant digital system that is a “software-agnostic”  starting point for member states, who can use it to develop their own systems based on whichever format best suits their needs, from a paper card with a barcode or QR code stickers, to a smartphone application. 

The guidance stresses that the certificates should “never create inequity due to lack of access to specific software or technologies”, and must be “applicable to the widest range of use cases, catering to many different levels of digital maturity between implementing countries”. 

However, it identifies the “minimum requirements” for the introduction of digital certificates, namely that:

  • The ethical and privacy implications and potential risks are properly assessed
  • There are policies to establish their appropriate use, data protection and governance
  •  A digitally signed electronic version of the data about a vaccination event must exist
  • Anyone who has received vaccination should have access to proof of this – either as a traditional paper card or an electronic database.
  • If a paper vaccination card is used, it should be associated with a health certificate identifier (HCID) in a format that can be read by both people and machines (eg bar codes)
  • A digital registry should exist to store the information associated with the HCID and generate data about a vaccination.

International verification

The guideline includes a section on how digital vaccine ‘passes’ could be developed to enable them to be verified in foreign jurisdictions, such as for international travel. In these cases, international bodies should be able to access a country’s national registry, using digital cryptographic processes, to check whether the HCID barcode on paper is valid and hasn’t been revoked or altered.

A number of international COVID-19 ‘vaccine passes’ are already in use. The European Union started using its digital COVID-19 certificate on 1 July to facilitate travel in the EU.

The EU certificate is based on a QR code that “contains necessary key information such as name, date of birth, date of issuance, relevant information about vaccine/ test/ recovery and a unique identifier”.This data is not retained by the countries a person visits. 

There is no national system in the US other than a card issued by the Centers for Disease Control (CDC), but some states and even cities such as New York have developed apps to enable fully vaccinated people to verify their status, which is often necessary to enter various public gatherings.

There have been protests through Europe against ‘vaccine passports’, mostly by libertarians and anti-vaxxers opposed to any form of compulsory vaccination.


Image Credits: UNICEF/Kokoroko, Wikimedia Commons: Nemo.

Combat the infodemic in health information and support health policy reporting from the global South. Our growing network of journalists in Africa, Asia, Geneva and New York connect the dots between regional realities and the big global debates, with evidence-based, open access news and analysis. To make a personal or organisational contribution click here on PayPal.