Public Health

Vaccine credentials: How to make sure they’re done right

Kevin B. O'Reilly , Senior News Editor

What’s the news: The AMA is calling on the federal government to take a strong role in establishing, publicizing and enforcing guidelines that all digital vaccine credential services (DVCS)—aka “vaccine passports”—must follow.

COVID-19 vaccine development

Get reliable information on developments in the authorization, distribution and administration of COVID-19 vaccines.

But first, “the use of DCVS should not outpace vaccine availability,” the AMA’s executive vice president and CEO, James L. Madara, MD, wrote in a letter to National Coordinator for Health Information Technology Micky Tripathi, PhD, MPP.

“Until the time that all Americans are easily able to access vaccines and trusted DVCS, we must guard against programs that appear to confer special social privilege based on one’s COVID-19 vaccination status,” Dr. Madara wrote. “For DVCS to be successful, vaccines must be universally accessible and the federal government must create strong guardrails around DVCS’ use of personal data.”

Related Coverage

Push is on to expand COVID-19 vaccine access in hardest-hit areas

Why it’s important: Nearly 20 DCVS are under development, but without consistent policies in place to protect patient privacy and target inequities these smartphone-enabled COVID-19 vaccine credentials could follow in the footsteps of the digital contact-tracing apps that have garnered low adoption rates among users.

“Concerns regarding privacy and surveillance dominated the digital contract-tracing discussion, leaving little room to explore potential benefits,” Dr. Madara wrote. “Often cited were concerns with the amount of information collected by apps and uncertainty, skepticism and fear around what was being done with data, including with whom it was shared. ... Vaccine-credentialing apps are likely to face similar concerns regarding privacy, surveillance, and apprehension.”



The AMA’s letter outlines detailed advice on how to proceed. Among other things, a DCVS should:

  • Limit the data collected on the individual.
  • Be barred from requiring people to create customer accounts to use vaccine credentialing.
  • Provide opt-in choices for data collection, use and disclosure rather than registering people automatically.
  • Only collect and store the data necessary for the app to function as a credential.
  • Not be tied to unrelated commercial services or the collection of personal data for unrelated purposes.

“Failure to include these commonsense approaches will perpetuate the deprivation of privacy rights among historically marginalized and minoritized communities with no meaningful opportunity to avoid data collection—leading to associated marketing at best and targeted harassment of certain communities at worst,” Dr. Madara wrote.

That AMA’s letter notes that careful consideration must be given to “what can be done to prevent the creation or exacerbation of inequities” in various populations, such as people who:

  • Are subject to disproportionate rates of incarceration and heightened surveillance based on immigration status or race.
  • Have stigmatized health conditions such as substance-use disorder, HIV/AIDS and other sexually transmitted infections.
  • Are part of LGBTQ+ community, lack housing or have disabilities.

These people “may be wary of DVCS due to the possibility that third parties will share their data with employers, insurers, landlords, the police or other government agencies,” Dr. Madara wrote. The digital vaccine credentials should be “designed in an equity-centric, participatory fashion,” he added.

Related Coverage

Do’s and don’ts for talking with patients about coronavirus vaccines

The AMA’s letter urges that federal agencies create:

  • A system which DCVS can register with the federal government after meeting certain standards.
  • A public-facing list of all registered DCVS, with clear and understandable information available about each DCVS.

The federal government also should set clear guidelines around personal health information and personally identifiable information use, as well as data-collection sunsetting provisions on DVCS, Dr. Madara wrote. Incorporating these and the AMA’s other recommendations “will strengthen the overall effectiveness of DVCS and ensure DVCS are designed with equity in mind while also bolstering public trust in appropriate access and use of their personal information.”

Learn more: Stay updated with the AMA on COVID-19 and vaccine development. Find the latest clinical information, AMA guides and resources, advocacy and medical ethics information at the AMA COVID-19 resource center for physicians.