Damn, I hate being right. And right yet again.  Sure I do. ?

Not to rehash my amaaazing prescience but I wrote back in September 2020 that there would be a digital COVID passport Coming Real Soon Now and that government would put pressure on venue owners to require proof of negative infection before allowing a customer to enter their establishments. Recently, Governor Cuomo soft-launched this initiative, not coincidentally with the announcement of reopenings. If you want to see a Broadway show when the Great White Way turns its lights back on in September or a live indoor sporting event, a show at Radio City or the free, star-studded Homecoming Concert in Central Park on August 21, you’ll need proof of vaccination (POV). Same with the Met and Carnegie Hall. This week Cuomo began encouraging restaurants and bars to do likewise. Some of these places may take proof of a negative < 72 hours old COVID PCR test but most want to see POV.

I won’t belabor, at least not in this article, how important it is that everyone get vaccinated, especially now with all new COVID cases in New York being the much more contagious Delta variant. I have to give Cuomo an “attaboy” for this. The “vaccine hesitant” may complain that such draconian social engineering is an assault on their freedoms but screw them. I did my part and got vaccinated.  I want my freedom not to hang out with potentially infected antivax and pretendonitis nuts because Delta can still make me sick.

Instead, this is about the secure digital passports currently being deployed. I’ll make another prediction: those COVID vaccination cards we were given at our inoculation sites will soon no longer be trusted as POV. Nor should they have ever been. A ten year old could forge one. In fact, the Trumper forums are jammed with instructions how to fake a vaccination card. Big surprise there.

CDC must get off their asses and create a national digital health pass for this to work. We know CDC has the back end data to enable it but unfortunately the agency was a complete mess under Trump’s CDC director, Robert Redfield. This project needed to be tested and ready to launch with the initial vaccine roll out last December. Reverse engineering such an app now with half the country already vaccinated makes the job 100x harder.

The Digital Passports

These are apps for smart phones which can be downloaded for free from the Apple App Store or Android’s Google Play. Just type their names into the Search window in those digital stores. If you’re one of the rare individuals who doesn’t own a smart phone some will let you print hard copy of a QR code on your desktop computer as proof. To be honest, I don’t know how some of them work but they’re being endorsed by government and medical people and that’s more compelling than a shrill, pink-haired loon on Youtube.

The NYS Excelsior Pass Wallet

This was the first digital pass built with blockchain security by IBM. It’s only for people who were vaccinated in New York State. It’s also the easiest digital pass to configure. All you’ll need is a copy of your COVID-19 Vaccination Record Card that was given to you after your shot(s).  Your information is checked against the vaccination records at the NYS Health Department and will generate a QR Code for a companion venue-side smart phone app for verification. The pass is stored in your phone’s digital wallet. In the case of iPhones it’s in Apple’s Wallet along with any credit cards you’ve uploaded to it.

The downside is that it’s only for New Yorkers who were vaccinated in New York and only for New York venues as well. Unless it branches out in consortium with other states it’s at best a stopgap measure, especially for New York tourists and the millions of residents of NJ, CT and PA who work here every day.

The VaxYes/GoGetVax Digital Pass

This is one of the new kids. You can hit it on your desktop but like all these digital passes it wants the transaction to occur through the phone app, if only because that will be the point of contact for your validation. VaxYes claims to have four levels of validation:

1. Digitized version of your vaccine card, no validation. A level 1 digital vaccine card will be issued based on information submitted by the member. Please note that no validation has been completed.

2. Identity and vaccine card validation. An initial review to ensure a match between personal identification and the vaccine card, the vaccine dates make sense with lot numbers, and there are no fraud markers.

3. Advanced validation. Artificial Intelligence and trained medical professionals are used to verify the validity of the information and vaccine card photo submitted.

4. State-Level Record validation. State immunization records are used to verify the information entered into VaxYes. The company submits a request on behalf of the patient to receive a complete validation.

So far I’ve only been given Level 2 validation so it’s only marginally better than a cardboard vaccination card as POV. There are no instructions for how to get higher validation levels or, if it’s automatic, how long this process will take. This is different from the NY Excelsior Pass which validates your information almost immediately with the NY State vaccination database. The Excelsior Pass is VaxYes’ version of Level 4.

The application was pretty simple although it forces you to re-enter your vaccination data down to the vaccine lot number at every login, which is pretty tedious.

The CLEAR Health Pass

CLEAR was originally a subscription-based, touchless biometric airport security application that lets you skip airport security lines. It has more in common with TSA Precheck than a health app. They’ve apparently spun it off to create the (currently) free Health Pass. Hawaii partnered with CLEAR to create it’s own digital passport. It’s the most intrusive application insofar as it requires you to take a photograph of yourself and your state ID card or driver’s license. These are probably carryover requirements from the original CLEAR application which is more concerned with who you are than whether or not you’re vaccinated.

There’s no mention of whether or not it has portal connections to state health databases other than Hawaii’s Safe Travels system to confirm your vaccination status. I suspect it doesn’t so, like VaxYes, it’s at least no better POV than a photo of your vaccination card.

CommonPass

This digital passport is targeted more at airline transportation but it actually seems the most promising of the vaccination passports because rather than linking to a disparate set of 50 state health department databases, none of which are modeled at all alike, it leverages a common SMART™ Health Card. It’s a standard I’m unfamiliar with and which is also unfortunately not supported by any NYC health organization I use. So I couldn’t test it. I didn’t even recognize the names of most of the organizations which do support it.

As a side note, everybody believes that HIPAA is about medical privacy, and it is, but the ‘P’ in HIPAA is actually for Portability, not Privacy. The primary intent of this 1996 federal law was to modernize and bring the Tower of Babel that is health record information into a common exchange standard for all providers so they could share it with security protocols, which is what HIPAA is mostly known for. Unfortunately, it was implemented the Republican Way which was rather than letting medical informatics, cybersecurity and Big Data professionals spend five years codifying a federal protocol they left it to the ever-so-efficient private sector to develop their proprietary standards. And that’s why we’ve got so many “standards” to choose from today, which is to say that 25 years later we still have no widespread standard.

The Takeaway

These are just four of many other digital passports. The International Air Transportation Association (IATA) has one, Verifly has another, the UK has V-Health, in fact several foreign countries are developing their own.  Only a couple of them provide more authority than the cardboard record. Most just create digital copies of the COVID-19 Vaccination Record Card that vaccinated people already have, which is about as susceptible to fraud as letting people draw their own paper money. Two weeks after vaccines started to get jabbed into arms you could buy blank vaccine cards on Facebook and eBay. No effort was made at the federal level to inconvenience amateur forgers.

Just an FYI in case you’re tempted to do this: it’s a federal crime to forge a federal document. Punishment is up to five years in prison and prosecutions are happening. Just get the friggin’ shot.

At this point, the most trustworthy digital vaccine passport is NY’s Excelsior Pass because it actually validates your vaccine data with the state database. None of the others appear to be doing this, at least not now.  But it’s useless to anyone who didn’t get their ouchies in NY State and have no use for the NY-only validation app.

Added 10:30pm: NYC mayor, Bill De Blasio, passed an order today that as of either August 16 or September 13 (the order is confusing) those who want to patronize a NYC restaurant or bar must be fully vaccinated and show proof of same in order to dine/drink indoors. While similar orders have been passed in Europe, notably France, this is a first for the US.