This section below describes scientific evidence and jurisdictional guidance/experiences regarding the design and implementation of vaccine passports, immunity passports, and proofs of vaccination/immunity during the COVID-19 pandemic.

The following limitations should be noted:

• The majority of the information presented contains jurisdictional and expert guidance; these recommendations are those of the authors of the original studies and the Research, Analysis, and Evaluation Branch does not have the expertise to evaluate such recommendations. 
• Because of the relative novelty of vaccine passports aimed at such a broad target population, there was no direct evidence of the impact such programs have on either vaccine coverage or virus spread.

Scientific Evidence

• Design/Development: Several recommendations for the format and design of vaccine passports were identified across nine sources, including: determining whether the passport covers only vaccination status or all possible sources of immunity; determining whether the passport is merely a certificate or proof of vaccination or whether it also functions as a license; introducing a digital version of the passport; and identifying standards for reliable documentation.
  • One paper suggested that an advantage of introducing vaccine passports rather than passports or certificates covering immunity resulting from either vaccine or previous infection would be the avoidance of perverse incentives to seek out infection for the sake of immunity certification.
  • The terminology used may have an impact on behaviour. One study found that using the term “Immunity” (vs. “Antibody”) to describe antibody tests for SARS-CoV-2 increases the proportion of people believing that an antibody-positive result means they have no risk of being infected in the future. The study found, however, that the terms “passport” and “certificate” had no such impact.
  • One review emphasized the importance of differentiating between certification (providing reliable proof of vaccination or immunity) and licensing (issuing a permit, or permission, from an authority to engage in a particular activity once vaccinated/immune). The authors cautioned that immunity certificates issued by governments should not specify the level of protection that may be conferred by vaccination or previous infection, at least until our scientific understanding of immunity to and protection from COVID-19 matures.
  • One source observed that if a digital passport is issued, there would need to be a non-digital (e.g., paper) version made available so as not to exclude those who do not have access to a smartphone.
  • One source cautioned against the use of the International Certificate of Vaccination or Prophylaxis framework for requiring vaccination against yellow fever in the case of SARS-CoV-2, as the cases are meaningfully different, both because of the variety of vaccines and the limited information available regarding their respective effectiveness.
• Impact: Findings from four sources suggest that the implementation of vaccine passports may incentivize individuals to get vaccinated, though there is no direct evidence of such an impact. While there was no evidence of the impact vaccine passports might have on the spread of the SARS-CoV-2 virus, multiple sources indicated that the impact likely depends on the durability of immunity from vaccines, and – where certificates are issued for either natural immunity or SARS-CoV-2 test results – the durability of natural immunity, the risk of transmission, and the sensitivity and accuracy of available tests, much of which is presently uncertain.
  • One research article examined the impact of Israel’s Green Pass program on vaccine coverage in the country, citing poll results that found that 31% of respondents said the offer of a Green Pass and the associated benefits would possibly or definitely persuade them to get vaccinated. A review of the same program likewise suggested that the introduction of the Green Pass likely incentivized vaccine uptake.
  • Seven articles suggested that where rapid antigen or PCR test results can be used in place of proof of vaccination, the accuracy, reliability, and/or sensitivity of the available tests would partly determine the impact of such a policy.
  • Three articles also mentioned the value of additional benefits of incentivizing vaccine uptake for those populations made especially vulnerable by social isolation or at elevated risk of severe disease (e.g., lonely and isolated individuals could be visited by immune friends and relatives; small businesses could be reopened by staff who are immune and will not risk the health of colleagues and customers; immune health care staff could care for patients with COVID-19).
• Ethical/Equity Risks:Findings from 13 sources indicated that vaccine or immunity passport programs would introduce ethical and/or equity risks related to: limited or inequitable vaccine and test availability; existing racial and socioeconomic inequalities; unintended coercion; and stigmatization or reduced social cohesion. Several sources noted, however, that there is an ethical cost to maintaining mobility restrictions on individuals who present a small risk of infection to others or of being infected themselves. In general, while certification discriminates by design, discrimination is not legally or ethically problematic unless it lacks good rationale. 
  • The risk of exacerbating existing social, racial, or economic inequalities was discussed in six sources, with one paper noting that the reported racial disparities in rates of death from COVID-19 underscore the need to prevent further health care inequities.
  • One article suggested that inequality in vaccine access caused by lack of trust could be mitigated through community-led approaches to promoting vaccine uptake executed by trusted community leaders, organizations, and local health care institutions.
  • The ethical risks of a vaccine passport program may depend on the use cases. One article noted that when a government conditions participation in essential activities such as work or education, certification can result in unintentional coercion, essentially functioning as a mandatory vaccination program.
• Data Privacy/Security: Five sources identified data privacy concerns related to the implementation of vaccine passports. In particular, there is a concern that digital vaccine passports may put sensitive personal health information at risk. While privacy and security measures would be important, one paper observed that these risks are not unique to a vaccine passport program (conventional passports and contact tracing measures also encounter such problems).
• Enforcement/Fraud: One source recommended stiff penalties to discourage the production/use of fraudulent passports. Another source noted that forgery of Israel’s Green Pass is regarded as a criminal act punishable by fine or incarceration.
  • Five sources identified fraud as a concern with the implementation of vaccine or immunity passports. One source suggested that the likelihood of fraud could be mitigated by including some form of digital signature in the passport; another suggested the use of biometric data or a protected digital identity.

International Scan

Jurisdictional guidance was identified from the World Health Organization (WHO), the European Commission, and the Royal Society in the United Kingdom (UK). Information regarding jurisdictional experiences was identified from Israel, the European Union (EU), Denmark, Estonia, Norway, Hungary, China, Bahrain, New York, Hawai’i, the UK, and the African Centers for Disease Control and Prevention (CDC). In addition, information regarding private sector vaccine passport development was identified from the International Air Transportation Association, The Commons Project Foundation, and IBM.

• Use Cases: The international guidance is mixed with regard to the best use cases for vaccine passports. Some guidelines suggest that helping allow for international travel or improving continuity of care may be a beneficial use case, though the WHO recommends against adoption altogether at present. Among jurisdictions that have implemented vaccine passport or certificate programs, the programs are either used for: 1) facilitating and regulating inter-jurisdictional travel; 2) the domestic purpose of regulating access to certain public spaces or services; or 3) allowing participation in large events. In general, the uses specified depend on whether the certificate/passport is intended to certify that an individual is vaccinated or to indicate that they are unlikely to contract or transmit the virus. The UK Royal Society included the need to ensure that use cases are understood and accepted by the general public as one of its key principles for vaccine passports.
  • Certificate of Vaccination vs. Certificate of Immunity: Most developed vaccine certificate/passport programs are intended to indicate that an individual is relatively free of risk of either infection or transmission of SARS-CoV-2. As such, proof of having recovered from COVID-19, or a negative rapid antigen or PCR test result, can be used in place of the vaccine certificate/passport in many contexts. However, some jurisdictions have only established a system to provide individuals with a proof of vaccination, and accordingly do not specify use cases (e.g., Québec’s proof of vaccination program), suggest that proof of vaccination may only be useful for international travel (e.g., UK’s COVID-19 vaccination status program), or only use proof of vaccination for limited cases of travel and require that the vaccine have been delivered locally (e.g., Hawai’i’s Safe Travels Hawai’i Program).
  • International Travel: The following jurisdictions mention international travel as a use for their vaccine passport/certificate: Israel (either their Vaccination Certificate or Proof of Recovery), the European Union, Estonia, Norway, Hawai’i, the UK, the African Union Commision and the African CDC, China, and Bahrain. In addition, three prominent private-sector digital applications have been developed to manage individuals’ vaccine and test information with an explicit aim of facilitating international travel: the International Air Transportation Association’s (IATA) Travel Pass App, IBM’s Digital Health Pass, and The Commons Project Foundation’s CommonPass.
  • Domestic: The following jurisdictions mention domestic uses for their vaccine passport/certificate, including regulating access to certain public spaces or services and allowing participation in large events: Israel, Denmark, Norway, and New York.
  • Public Health: The African Union Commission and the African CDC’s My COVID Pass digital application may be used to monitor vaccine effectiveness, but no further details were provided.
  • Entry Requirements: Many jurisdictions (e.g., Denmark, Iceland, and the EU) now either require all foreign travelers’ proof of vaccination for entry or allow fully vaccinated travelers with adequate proof to avoid some or all of the testing and quarantine requirements in place. By contrast, many states in the US have now passed laws either prohibiting governments from issuing vaccine passports or public/private entities from requiring them. 
• Eligibility and Validity: Across jurisdictions, there are up to three cases where adults become eligible for vaccination or immunity passports: 1) they have been fully vaccinated; 2) they have recovered from a previous SARS-CoV-2 infection; or 3) they have recently received negative SARS-CoV-2 test results. 
  • The most common period of validity for a pass based on negative test results is 72 hours. For a certificate based on either recovery from previous infection or a full course of vaccination, validity periods vary between jurisdictions: Denmark’s Corona Pass remains valid for eight months, Israel’s Green Pass remains valid until the cut-off date of Dec. 31, 2021, and the EU’s pass is at present valid indefinitely, pending further scientific evidence as to the length of protection of the different vaccines.
  • Children are typically either included automatically in their parents’ passports, or, as is the case with the EU Digital COVID Certificate, children can be issued certificates independently, but they can be stored in their parents’ digital certificate manager.
  • Israel implemented an alternative for individuals who could not receive vaccines due to contraindications, requiring that they present a note from their insuring Health Maintenance Organizations that they have a contraindication to the COVID-19 vaccine, according to the criteria determined by the Ministry of Health, a negative test result taken within the preceding 72 hours, and personal ID.
  • The UK Royal Society recommended that vaccine passports accommodate differences between vaccines in their efficacy, and changes in vaccine efficacy against emerging variants.
• Design/Development: The two most common design features across all identified jurisdictions were: 1) the inclusion of both a paper version and a digital version of the certificate (delivered through a smartphone application); and 2) the use of scannable QR codes as a means of verification. Interoperability between jurisdictions was also a significant design feature among European jurisdictions. For example:
  • The EU’s Digital COVID Certificate, as well as the vaccination certificates developed in Denmark, Estonia, and Norway, were designed in accordance with the EU’s standards for interoperability. In the case of Norway’s vaccination certificate, there were two versions developed: one for domestic use, which contains less personal information (since in domestic use cases it will rarely be necessary to display information other than that the certificate is valid), and one designed to be compatible with EU standards for international travel.
  • New York’s Excelsior Pass requires that adults aged 18+ years present a matching photo ID with name and birth date alongside each unique pass.
• Impact: Reports from the World Health Organization (WHO), European Commission’s eHealth Network, and the Royal Society in the United Kingdom (UK) identify the following variables that affect the impact of vaccine passport programs on public health, all of which remain uncertain: degree and duration of vaccine effectiveness; whether and to what extent vaccines reduce the risk of transmission; degree and duration of protection resulting from prior infection; and the impact of new variants of concern and others that may yet emerge.
  • For this reason, the WHO advises that that national authorities and conveyance operators should not introduce requirements of proof of COVID-19 vaccination for international travel as a condition for departure or entry, given that there are still critical unknowns regarding the efficacy of vaccination in reducing transmission.
• Ethical/Equity Risks: International guidance from WHO, European Commission’s eHealth Network, and the UK Royal Society identifies a number of ethical/equity concerns related to the implementation of vaccine passports, including: the risk of exacerbating existing inequalities, especially related to vaccine access; ensuring that vaccine passports are accessible to all in their design and implementation, and that they are affordable by all; developing equivalent certificates for those who cannot be vaccinated on medical grounds; and defining use cases to avoid harms to those without vaccine passports and to protect the personal information of those with them.
  • The WHO specifically recommends that where vaccine passports are developed, they should be made accessible to all, including through the use of open standards.
  • The UK Royal Society identifies use cases as a particular concern: the acceptable sectors in which vaccine passports can be used must be specified in advance as they carry the risk that they could be used to discriminate in hiring or access to restaurants, health care centres, sporting or cultural events, insurance companies, housing applications, or other services.
  • By contrast, the WHO raises the concern that introducing a requirement of vaccination as a condition for travel has the potential to hinder equitable global access to a limited vaccine supply and would be unlikely to maximize the benefits of vaccination for individual societies and overall global health.
• Legal Considerations: The implementation of vaccine passports needs to be consistent with various legal standards, including: international, regional, and domestic human rights laws; data protection laws; equality and discrimination laws; COVID-19 legislation; and labour, occupational health, and safety laws.
  • The WHO additionally observes that Member States^[1] who have agreed to the provisions of the International Health Regulations (IHR) are expected to abide by its stipulations concerning the introduction of a requirement for proof of vaccination for outgoing or incoming international travellers. At present, yellow fever is the only disease mentioned in the IHR for which countries can require proof of vaccination for international travellers (Annex 7 of the IHR).
• Data Privacy/Security: Many digital vaccine passport programs allow for the inclusion of personal data, including name, date of birth, and health information related to vaccines received, without making them available to third parties when the pass is verified. For example, the EU Digital COVID Certificate contains the above-mentioned data along with the date of issuance and a unique ID; only the validity and authenticity of the certificate is checked by verifying who issued and signed it. All personal health data remains with the Member State that issued an EU Digital COVID Certificate. The passport programs of both Denmark and New York likewise emphasize that personal information is not stored when the passes are scanned or verified.
  • Denmark produced a Data Protection Impact Assessment while their passport program was in development to describe the risks relating to user data and the measures applied to mitigate these risks. Many jurisdictions, however, did not specify any data protection principles adhered to in the development of their certificate programs. 
  • The importance of maintaining the privacy and security of personal data (including health data) was discussed in guidance documents produced by the European Commission’s eHealth Network, the WHO, and the UK Royal Society. Particular principles mentioned included:
    • Data Minimization: Both the European Commission’s eHealth Network and the UK Royal Society mention the importance of minimizing the amount and kinds of data that need to be collected and used in the development of vaccine passports.
    • Purpose Limitation: The eHealth Network and the Royal Society likewise discuss the importance of limiting the purposes for which the data that is collected could be used.
• Enforcement/Fraud: Only the State of Hawai’i described enforcement principles, although protecting against fraud was also mentioned as a relevant concern by the WHO.
  • Hawai’i’s Safe Travels Hawai’i Program will be enforced by the Department of the Attorney General. Potential violations will be reported to law enforcement if it appears information is fraudulent, false, or misleading and used to qualify for the program. County and state law enforcement also have been actively engaged in the enforcement of Safe Travels requirements with the issuance of citations, arrests, and prosecution of violators.

Canadian Scan

The following guidance was drawn from reports from the Chief Science Advisor of Canada, the Privacy Commissioner of Canada, the Québec Government’s Comité D’éthique De Santé Publique, and the Canadian Civil Liberties Association. Information was also identified regarding Québec and Manitoba’s implementation of proof of vaccination resources.

• Use Cases: Both the Chief Science Advisor of Canada and the Comité D’éthique De Santé Publique note the possible benefits from using vaccine certificates to allow for increased travel. While Québec is offering digital vaccination certificates, they do not establish immunity and at present have no specified use cases apart from conveying information about the vaccines an individual has received. Manitoba’s immunization card allows for inter-provincial travel without being required to self-isolate on the return to Manitoba. Additionally, Manitoba health care facilities, including hospitals and personal care homes, will permit expanded visitation if both the patient/resident and visitor are fully vaccinated. The Province of Manitoba has also indicated that further benefits may be announced in the future.
  • Specific ethical/equity risks depend on the use cases for vaccine certificates. For instance, requiring certification of vaccine status to access work may be advisable in higher-risk workplaces where mask wearing and/or maintaining physical distance is difficult or impossible, but doing so may affect job opportunities for those who do not have access to the vaccine or who are exempt for medical reasons.
  • The Comité D’éthique De Santé Publique recommends against using vaccine passports to regulate access to work.
• Eligibility and Validity: Consideration must be given to individuals not eligible to be vaccinated (e.g., children under 16 years of age, or those with medical conditions) and alternatives offered. Manitoba’s immunization card requires that individuals have a Manitoba health card and be at least 14 days removed from their second dose.
• Design/Development: Québec’s digital proof of vaccination contains the individual’s personal information, details regarding the vaccine that they received, and a QR code containing this information. Manitoba’s immunization cards only show the individual’s first and last names and a QR code, which, when scanned, indicates their vaccination status. The Chief Science Advisor of Canada’s report identified three key considerations for the development and design of vaccine certificates: 
  • Authenticity: There will be a need to ensure authenticity and minimize fraud.
  • Standardization: It will be important to establish standards for what counts as “vaccinated,” the data that can be used, and the ways in which the relevant personal data can be used.
  • Monitoring: It will be important to maintain consistent post-vaccine monitoring, ongoing research, and epidemiologic data-sharing, all of which provide the essential scientific basis for the utility of vaccination certificates within and outside the health care context.
• Impact: The use of COVID-19 vaccination certificates to ease mobility restrictions is predicated on the effectiveness of the different vaccines to mitigate the risk of importing or spreading SARS-CoV-2 and its emerging variants. 
  • Compared to vaccination certificates for yellow fever, COVID-19 vaccination certificates present more complexity due to the multiplicity of available COVID-19 vaccines and the uncertainty regarding their efficacy against the different and emerging virus variants. Moreover, unlike with yellow fever vaccination certificates, the use of COVID-19 vaccination certificates would not be targeted, specific, and auditable, but pervasive, variable, and diffuse.
• Ethical/Equity Risks: Any use of vaccination certificates must respect human rights. There are, in addition, concerns about inequitable impacts on disadvantaged communities and unintended coercion.
  • Equity: Special attention needs to be directed to certain racialized, Indigenous, and disadvantaged communities, as they may lack both equitable access to vaccines and trust in governments and some medical institutions. Clearly defining in law, the contexts in which vaccination certificates must be presented could avoid vaccination certificates becoming a predicate for harassing racialized populations. It is essential that vaccine certificates be obtainable in both electronic and paper form to ensure that those who do not have cell phones are not discriminated against.
  • Coercion: Policies that require vaccination status as a precondition to full participation in public life run the risk of rendering a voluntary vaccination regime de facto mandatory.
• Legal Considerations: In the Canadian context, there are distinct jurisdictional challenges: 1) vaccination records are considered part of a health record, issued within provincial and territorial health care jurisdictions, yet a Canadian COVID-19 vaccine certificate may be required for international travel; and 2) vaccine certificates/passports necessarily involve the disclosure of personal health information and so must be designed in accordance with the relevant privacy laws.
  • There is at present no standardized, secure technology system in place upon which an interoperable, interprovincial/territorial vaccine registry could be built.
  • According to the Privacy Commissioner of Canada, the significant privacy risks involved mean that the necessity, effectiveness, and proportionality of vaccine passports must be established and continually monitored for each specific context in which they will be used. In addition, they advise that consent alone is not a sufficient basis upon which to proceed under existing public sector privacy laws for vaccine passports introduced by and for the use of public bodies.
  • There is currently no legal basis for vaccine passports in Canada, and public and private sector entities that require or request individuals to present a vaccine passport in order to receive services or enter premises must ensure that they have the legal authority to make such a demand or request.
• Data Privacy/Security: Manitoba’s immunization card contains only the bearer’s name and a QR code (which indicates vaccination status only) in order to limit the amount of personal information it makes available. While there are data privacy and security concerns related to vaccine certificates/passports regardless of their format, the digitization of personal information presents special risks. The Canadian Civil Liberties Association raised a series of questions regarding the handling of personal data, including:
  • What data are collected and used, and where do the data come from? 
  • Where do the data live – each individual’s device or a central server? 
  • How are the data transferred to a requestor/authenticated/updated/secured? 
  • Are the data used to simply display a credential (much like flashing a paper certificate or ID card) or scanned and recorded, and does the scan connect to a personal identifier accessible to the requestor?
  • Is the credential tied to a central digital identifier, and is that identifier (e.g., health card number) shared or kept private after it is used to authenticate the user and vaccination status? 
  • Who certifies the authentication for external requestors? 
  • What kinds of data linkages are created and what linkages are made possible that may be undesirable? 
  • Will there be risk scores/artificial intelligence-driven analysis as part of a system?

Ontario Scan

Provincial guidance on the use of immunity passports was identified in an environmental scan produced by Public Health Ontario.

• Impact:The scan noted that the degree and duration of protection provided by vaccines is not well understood and that there is still a paucity of data regarding an individual’s ability to transmit the virus once vaccinated, all of which would determine the impact of implementing a vaccine passport.
• Ethical/Equity Risks: A vaccine passport program has the potential to increase social stigmatization and exacerbate existing inequalities, particularly among marginalized groups, including racialized populations who have been disproportionately impacted by the COVID-19 pandemic.
  • A risk-decision framework in the context of equity needs to be considered when considering individual- versus population-level public health measures in the context of immunity status, whether through vaccination or infection.

Individual articles were identified through PubMed and JAMA Network. Full-text results extracted were limited to those available through Open Access. Jurisdictional information was identified using Google, relevant government and private sector websites, and relevant news outlets.

The Medical Subject Heading Term “Vaccine” was used in combination with keywords to identify relevant articles for this review, including: “passport,” “certificate,” “immunity passport,” and “immunity certificate.”