Making COVID-19 vaccination reliable
By: Ain Aaviksoo
Tags: Certificate, Public Health, Covid 19, Digital Health, Vaccination

Trust framework of authorised providers

If somebody shows to you a document (for example a certificate) one of the first “reliability checks” is to understand where it came from. In other words — is the source reliable?

Most vaccination or test certificate solutions bundle together the trust anchor for the certificate (a document) and that of the issuer (a provider). This is impractical, because the standardisation effort in order to agree, who is authorised to perform certain task is much easier that to agree on standardisation on all the potential documents that may be issued. With the response to COVID-19 it has become clear that certifying a lab result is a very different task from certifying a vaccination fact.

Also, the variability of privacy restrictions for processing the “identities” of healthcare providers are incomparable with the requirements defined for personal or health data in various countries. Adding the option of making also other healthcare documents globally interoperable suggests that governing the system participants separately from the services the participants are using is much more resilient towards the yet unknown future needs.

Hence, authenticating and authorising trustworthy certificate issuers is a task, which has its challenges, but is perhaps feasible even at the global scale. Technologically there are a few (but not unlimited) ways to build such Trust Framework. Estonian government has suggested one solution that is based on open standards and software and is successfully used by various countries.

For global governance perhaps the World Health Organization would be a good candidate to set up and maintain such trust framework. There are and will be private initiatives to perform such task, which is probably a practical approach to get the immediate global trusted healthcare networks going. In the longer run, if it is to form a basis for digital health services trusted by sovereign states (eg authorising the entry to a country) there is a good justification for a body for international agreements and standards.

In its simplest form WHO can manage a “secure digital address list” of competent institutions in every country (plus some trusted international organisations) that have the authority to further certify digitally the list of individual trusted healthcare providers or health data managers (eg health information systems) in their jurisdiction. Such a distributed network of trusted digital health system participants will operate under similar technological (standards for exchanging and maintaining information) and organisational principles (adding and removing members).

The Trust Framework can effectively become the anchor of the initial foundation of trust for every global digital service. For each specific service the participants must agree what proofs any network member is trusted for and what additional trust anchors may be needed for a comprehensive reliability guarantee. In the case of Smart Vaccination Certificates the questions of personal identity and vaccine authenticity come to mind first.