Vaccination Record on Phone?

“Don’t Leave Home Without It?”…..does that apply to the vaccination card?

Three screenshots from a smartphone showing how to use NY state's Excelsior Vaccine Record for Phones.
Should we put a vaccine record on the phone? Credit:

Dear Ms. Smartphone:  We are planning Fall travel to the East Coast and can’t decide whether to put our vaccination record on the phone. Unlike a piece of paper that everyone can read, will select people know my family’s details? Will we need to have cellular service or wifi  to show proof?  And, what if the technology does not work in places we go?  Perhaps I am overthinking this. Hector, Corte Madera

Dear Hector:

There are lots of things we store on our phones these days when we travel: a pass like the ‘Clipper Card’ for the bus or train, our plane ticket, hotel keys, and, of course, the holiday photos. So, should we add the proof that we got a Covid vaccine to the smartphone mix?  I am going to give you the high tech solution first and then the low tech one. 

If you already store your airplane tickets on a digital wallet, you will find the vaccine information, aka the vaccine passport, to be similar. In one case, it’s the airline and the TSA that verify your information. Now it’s a  health authority or their proxy. Is that proxy secure? In an earlier Dearsmartphone I weighed the issues and note a date breach at TSA from a trusted third party.

But, that said, there has been a literal race to develop these vaccine passports, alongside the race to develop the vaccine itself. China and Israel were the first countries to implement digital passports. Israel now seem to be ramping up to reinstate a Green Pass (think ‘green’ traffic light). In the U.S., there are multiple data credential centers springing up and no one knows if they will be able to keep your health information safe, secure, and locked down.


If your upcoming trip takes you to New York, there is a first-mover experiment taking place there. The former Governor Cuomo (remember him), IBM, and the department of Public Health have teamed up to offer an ‘ Excelsior Pass’.  People vaccinated in NY have an option to upload basic information like the date they got the Covid vaccines, their birth date, zip code, and phone number. Next they receive a QR code for their phones. When they need to show proof, say at Yankee Stadium, they flash  a picture ID, alongside the QR code on their phones. A scanner to a distributed network verifies that the QR code is valid. The QR codes have to be renewed after six or nine months as the protection from the vaccination is believed to weaken.

But, to confuse matters further, the City of New York is developing a brand new app, also with IBM, so that visitors who live outside the state, like you, can show their credentials. Meanwhile, Walgreen, Sam’s Club, and others have issued their own proprietary apps for uploading digital  health data. It sounds like the NYC/IBM collaboration has more data protections than average but you must still agree to trust their encryption method based on blockchain technology.


But if you want the low-tech solution before you travel, then either scan, or take pictures of the vaccine cards for your entire family and save them to your phone. Then, if you forget to take the cards, or worse, lose them, you will have a record. It’s not a huge advancement over the first vaccine record that public health officials instituted, in 1884! But it most certainly works. The downside is that people might fake them, making public exposure to the virus more likely. That said, digital records can be faked too, but with a higher level of effort. 

As those under age 12 wait for a vaccine, and other groups question whether they need it at all, those who are vaccinated ask whether it is safe to put the information on our phones.  New issues for new times. Perhaps that is why it was initially called the ‘Novel‘ Corona virus. Safe travels.

Vaccine Record on Phone..more

Would keeping a vaccine record on my phone be a healthy thing to do?

Airline passengers need to produce test results showing they have been tested for Covid. Are vaccination results next?
Covid records needed for travel. photo credit: International Airport Review

Dear Ms. Smartphone: If paper records can be forged, how about those on smartphones? I enjoyed last week’s column about digital record keeping. But then you mentioned that some passengers (mostly outside the U.S.) were using negative results from faked Covid tests to get travel access. I hope to start flying soon and want my plane to be Covid free. Are the same people going to fake getting the vaccine, and if so, would it be safer if the virtual record is kept on our phones?  Erin, Sausalito

Dear Erin: I didn’t mean to alarm people with the item about travel and counterfeit Covid records. I am not in public health but imagine that there is always some level of forged activity and behavior. But to your question: would it be safer to keep vaccination records on our smartphones? 

There is a precedent for paperless, digital certificates.  When you take an airline trip, you might be one of the millions who upload your boarding pass to a digital wallet. Behind the scenes as you board, the bar code in your wallet is ‘read’, transmitted to a central data base, and matched to the airline’s reservations file. You are fairly secure since the bar code has to match the record in the airline’s data base.  Yes, there are fraudsters who could facilely fake bar codes for phones  but they have to be highly sophisticated to hack into the airline’s data base. 

Digital Record Keepers

Since Covid began, companies like IBM, with its Digital Health Pass  have vied to develop platforms so that people can upload their health records and fly with confidence.  And, a Swiss non-profit called the Commons Project and the World Economic Forum, have partnered with many major airlines including United and JetBlue. 

I imagine there are similar protocols for vaccination records.  When you finish the (two) shots, then a  digital certificate, like a barcode, will be issued to your smartphone.

This week, LA County is piloting a smartphone record as they roll out the vaccine. But, it is administratively more complex than airline reservations as there is no central source for certification. Lot of different health organizations will administer the vaccine, from large retail pharmacies, pop-up vaccination centers in supermarkets to wellness centers. These sites have to upload vaccination records to a “platform.”

And then, assuming each one has that capacity, who will maintain the platform and the database to insure its integrity and accuracy? For example, might it be the platform provider, like IBM or Common Trust, or might it be the U.S. government’s Center for Disease Control? 

‘Opening Up’ Means UpLoading?

For this data base to be useful for reopening the economy, connectivity with the platform is essential. Say you need to show that you got the Covid vaccine to gain entrance to a big conference, rent a car, or get ticketed for a sports event. Your credentials would be checked by two-way communications between the bar-code on your phone and a centralized data-base. Note that if the data check was asynchronous, not done in real time, then it would be easier to create bogus entrance passes. 

In researching this topic, I learned that a business teamed up with US Customs and Border Protection (TSA is part of them) to create a mobile passport in 2014  without government funding. The digital passport on the phone cuts out the need to wait in line at customs. Pre Covid they had 30 airport locations and 7 million users. But, this type of  business model may now be subject to greater scrutiny. Customers and Border Protection had a large data breach in 2019 when facial imaging data was transmitted by a (private) subcontractor’s database.


We are in the early days of understanding what can and should be kept on phones when it comes to digital certification. There will not be an overnight solution because there will be further digital divides, perhaps digital chasms, between those with tech and those who lack smartphones and a data plan. While many of us continue to put money in our digital wallets and do banking online, health and travel records are tricky. 

On a personal note, my friends and family who have been fortunate enough to get Covid shots have all received, shades of grade school, yellow index sized cards or papers with the date of inoculation, the manufacturer name, lot number of the vaccine, and the health care site. Whether that piece of paper will satisfy the airlines, hotels, and public venues remains an open issue and whether those with phones ‘opt in’ to ‘get out.’

Vaccine Record on Phone

Vaccination record on old yellow form.
Phones are replacing paper as the receipt for vaccines.

Dear Ms. Smartphone: I am hoping to get the Covid vaccine soon along with other members of my family. I heard that when we get it we will need to keep a receipt for it on our phones. I have not done this before and am wondering if this is so necessary. Janine, TIburon

Dear Janine: The Covid virus has been a real shot in the arm (pun intended) for smartphones. Initially, contact tracing apps were rolled out for phones with a mix of opt-in, opt-out functionality.  Next, smartphones became a vital part of getting tested. Most of us have to sign up for a Covid test, reserve a spot, and learn the results through a combination of text, email, and web site. So, it’s not a surprise that the most important and anticipated element, the vaccine, is also intertwined with our phones. 

Phones Have Background!

Some background: Putting health records on phones is not entirely new but since the beginning of Covid, many firms  have vied to be first to issue or manage digital health credentials. Among the firms are IBM, a Swiss non-profit called the Commons Project Foundation, and Healthvana. The latter company teamed up with Los Angeles County. A county health official said they wanted to “give patients ownership of their records.” Phones were deemed to be particularly useful, since the calendar function and text can remind the public when it’s time to get the second dose of the two-shot regime.  Still, those getting the vaccine in LA County are also said to receive a paper card.

Paper has turned out to be a problem. During Covid there has been a booming market in creating fake test results. Back in November, a publication reported that international travelers (largely outside the U.S.) forged, and sold, negative test results. So, the idea has been to create a “digital health credential” on smartphones that is more secure and less susceptible to fraud. 

Of course, this could raise issues, and this might be at the heart of your question. Should we be worried about privacy and surveillance? The software developer, like Healthvana,  claim that the health pass does not share specific details-like where and when a user was tested. In due time, we can hope that members of the public will no longer need to show that they have been vaccinated in order to do everyday things. If they remember to do so, they can then delete the record from their phones.


In the interim, airlines, schools, and employers may need to verify that people actually got the vaccine. And, it could be useful if you want to dine indoors at a favorite restaurant or get admission to say movie theaters and sports events.

If you have children, you will recall that you need to bring a paper certificate with a history of  vaccination records, before they enroll in day-care or school. Today, some doctor’s offices submit those forms digitally. Now it’s looking like you will be bringing the results from the Covid vaccine and other health information on your digital wallet.  It should not be a surprise then  that latest Apple operating system (i0S), is literally  programmed with a health app you cannot delete!