RI app shows verifiable vaccination status: Generates trusted secure QR code

(App download links at end of article.)

RI has updated and renamed its “401Health” app (previously “Crush COVID RI”) for Google Android and Apple iOS, the office of Gov. Daniel McKee announced today. The main purpose of the update is to add support for displaying the user’s vaccination record via a securely trusted QR code, which can be read by another app, the SMART Health Card Verifier, also available for both Android and iOS. The updated app continues to support previous features such as maintaining a private diary that the user can choose to share with contact tracers should that be necessary, links to schedule tests and vaccination doses, and access to display published statistical data about the COVID-19 situation in the state.

The two components, the record holding app and the verifier app, depend upon cryptography to assure the record comes from a trusted issuer, such as the State of Rhode Island, and has not been tampered with or modified. The system is similar to how web browsers handle sensitive information, such as credit card numbers for on-line purchases. In theory a QR code record could be printed out onto physical paper to be scanned by a verifier, but it is unclear at this time whether the RI apps or web sites will support this in addition to dynamic on-device display.

In order to make this work, RI has joined the SMART Health Card Framework administered by the Vaccine Credential Initiative (VCI), a non-profit coalition of government and non-government health care and technology organizations headquartered from Boston-based MITRE Corporation (formerly “MIT Research”) using an open-source public protocol specification licensed by Boston Children’s Hospital. The Framework is supported worldwide, including in the US, Canada, the UK, Japan, and Israel. The full technical specification details, as with many open-source projects, are publicly downloadable from GitHub.

The Framework is only a set of specifications, and it is up to the SMART Health Card Verifier App, published by the Commons Project, to implement the verification process, scanning and testing presented credentials (a QR code) against the CommonTrust Network’s Registry of trusted record issuers, also maintained by the Commons Project.

VCI publishes a “Code of Conduct” that “expects verifiers to adhere to the following core set of requirements in order to protect and properly interpret SMART Health Cards: Verifiers shall not store SMART Health Cards, or any data included within them, beyond what is required for verification at the time of presentation. Verifiers shall check SMART Health Cards against a list of trusted issuers. Verifiers shall comply with all applicable laws, including the California Consumer Privacy Act.”

According to the Computational Health Informatics Program (CHIP) at Boston Children’s Hospital that licenses and administers the underlying system, “SMART Health Cards contain just the information required to display your vaccination history and/or test status, and the choice to share your Card is up to you. In most cases that means: They contain: Your legal name and date of birth; Your clinical information; Tests: date, manufacturer, and result; Vaccinations: type, date, and location. They should not contain: Your phone number; Your address; Your government-issued identifier; Any other health information.”

The governor’s office said in its statement, “The VCI coalition prioritizes privacy and security of patient information, making medical records portable and reducing healthcare fraud.”

According to the Commons Project, their SMART Health Card Verifier App will “Quickly scan a SMART Health Card to confirm COVID-19 vaccination using the Verifier app at your small business, live music venue, school, or sporting arena. Scanning a SMART Health Card QR code reveals: Whether the SMART Health Card is valid; Whether the issuer is in The CommonTrust Network’s Registry of trusted issuers; [and] Key information on the SMART Health Card (issuer name, vaccine type, dates of vaccine doses, and name and date of birth of vaccine recipient).”

“By embracing the open-source SMART Health Card Framework, Rhode Island joins seven states, numerous countries, and pharmacies such as CVS, Walgreens, Rite Aid, and Walmart that are already utilizing the secure SMART Health vaccination technology for record standardization. The State looks forward to partnering with Connecticut and Massachusetts as they onboard in the coming weeks and months,” McKee’s office said in its statement.

“Rhode Island has administered close to 2 million doses of COVID vaccine and almost 300,000 booster doses, and our neighbors deserve a convenient, safe, and efficient way to access and store their vaccination record,” McKee was quoted in the statement saying. “I have downloaded my vaccination card to my phone and it was very simple. If you haven’t gotten vaccinated yet, it’s not too late. If you haven’t yet, get boosted.”

“We want to make it as easy and convenient as possible for you to securely access your vaccination information,” Department of Health Director Nicole Alexander-Scott was quoted saying in the statement from the governor’s office. “This new app is a great way to verify for others that you have received the critical protection that comes with a COVID-19 vaccine primary series and booster dose.”