# Paper-first Vaccination Journey VaccineDiary: Algorithmic Protocol, E-card, Mobile App and Research Papers We present an end-to-end decentralized protocol developed by MIT for the secure and privacy-preserving workflow of phased vaccination, vaccination status verification, and adverse reactions or symptoms reporting. The proposed system improves efficiency, privacy, equity, and effectiveness by augmenting the existing systems such as VAMS, VAERS, v-safe, and IIS. Our solution starts with a Paper-first [Verifiable Credentials specification](https://github.com/Path-Check/paper-cred) for COVID-19 offline testing and vaccination workflows using digitally signed QR Code stickers on paper cards. Due to its physical nature and simplicity, QR codes may be a convenient and nonintrusive modality for some users seeking vaccination while enabling verification of paper-based user-controlled immunization records. The protocol expects the verifier app to be offline and that the user doesn't need anything more than a Paper Card (no electronic devices). All personally identifiable information, contact, and health information are stored on the QR Codes themselves, allowing a user to go through the vaccination procedures in a Peer-to-Peer fashion, without the need to ever transfer the user's information to any centralized, private, or public blockchain system. The proposed system improves efficiency, privacy, equity, and effectiveness by augmenting the existing protocols to work with fully offline information flows. ![Extended Version of the US Vaccination Card with Verifiable Credentials and Selective Disclosure](/files/-MVcFy3-QGsthpI3j3UW) We propose two user-facing solutions: (i) a modified vaccination card that carries digitally signed (QR) codes and a scanner app for health officials for data aggregation, (ii) a mobile phone app for the user that interfaces with existing databases directly. We believe a user-centric design is critical in the micro-planning and last mile issues. ![IDEO's Vaccination User Journey](/files/-MVc7ik8K7F6meofI-kU) The user’s journey is divided into four parts: (i) Digitally enhanced enrollment system for phased vaccination, (ii) A privacy-preserving smartphone app to interface with vaccination sites without revealing any personally identifiable information to centralized servers, (iii) Proof of vaccination in a privacy-preserving and secure manner, (iv) Monitoring and alert systems for adverse reactions that enable users to upload their symptoms in a cryptographically secure manner. In addition, the ecosystem provides the ability to perform data aggregation for analytics without revealing raw data. Want to test? Point your phone's camera here: ![Vaccination Certifiate with PHI for Jane Doe](/files/-MW0K-rsp-6PctXHgY7E) This repository is a compilation of [PathCheck Foundation](http://pathcheck.org)'s efforts to design digital solutions that engage citizens in four core areas — Logistics, Health Outcomes, User-centric impact, and Communication. Our mission is to help public health professionals instantly overcome challenging barriers they encounter as they engage citizens as active participants in digital solutions for fighting COVID-19 and future pandemics. Today, the Vaccine Program at the [PathCheck Foundation](http://pathcheck.org) is focused on creating citizen-centric solutions for the digital management of COVID-19 vaccine distribution, testing, and health verification. Previously the program worked with public health officials as they designed and deployed exposure notification and digital contact tracing solutions. Subsequent initiatives under consideration include surveillance, monitoring, and predictive modeling to better prepare us, as a society, for future pandemics. # Introduction An overview of the vaccination journey Vaccination coordination is facing daunting challenges. Citizens are expected to navigate an array of websites and health authorities are using disconnected health IT systems. Reporting lags by several days. Following up with vaccinated subjects to monitor side effects is difficult. The systems to monitor ineffective batches of vaccines are yet to become mature. Vaccine verifications documents are prone to fraud. We developed a modification of today's vaccination cards to add 4 signed QR Codes to manage the user journey. The separate QR Codes are intended to decouple the health information (PHI) and personally identifiable information (PII) as well as separate the eligibility verification from the vaccination itself. The card dramatically simplifies phased vaccinations, second dose coordination, reporting of side effects, and credentials while allowing fully privacy-centered systems. It also creates data-rich monitoring of vaccination progress while eliminating red tape, privacy concerns, and fraud. It is ideally suited for vulnerable populations, rural areas, labor unions of essential workers, and employers helping their own employees. ## Patient Vaccination Journey The patient journey goes through 3 major stages: 1. Eligibility Check/Scheduling: Vaccination coupon QR codes are distributed to everyone by the appropriate regional vaccination administrator. This can be done either with paper vaccination cards, by SMS, using a website, or downloading an application. The coupon code behaves as a User ID for the entire vaccination flow. 2. User Check-in: At the vaccination site, the patient arrives and their vaccination coupon is scanned and their eligibility and appointment are verified. 3. Vaccination Certificate: Once the vaccination is administered, the patient receives another QR code in the form of a sticker. This QR code, a badge, indicates the vaccination was administered providing “proof” of vaccination along with other important information. The 4 QR Codes designed for vaccinations procedures create a possibility of selective disclosure of health information by choosing which one to show at any point in time. ### The Coupon QR Code The distribution of a vaccination coupon signifies the beginning of the vaccination process. When everyone is given a vaccination coupon the fear and anxiety around the vaccination process and when and if someone will be vaccinated is alleviated. By starting the patient journey with the distribution of the vaccination coupon, everyone has more peace of mind with the knowledge that they are on the list to be vaccinated, and that they can play an active role in the process. The coupon only has information about the vaccination phase this user has been approved for and nothing else. ### The Badge QR Code(s) The badges contain information about the vaccination itself. Each badge QR code is a full health record for a single vaccination event, including vaccine brand, dosage, site, etc. It is signed by the vaccination provider and serves as a Verifiable Credential informing that the user in the badge was vaccinated under those conditions. If the User receives multiple doses, there will be one badge per dose. These QR Codes should be shown when the User goes to see their Primary Care Provider or other health care professional needing to see the details of the vaccination procedure(s). ### The Passkey QR Code The PassKey contains personally identifiable information. It's what links all other QR Codes to the person. A hash of the signed PassKey is used as an identifier on the other QR Codes. ### The Status QR Code The Status QR Code contains only one field: vaccinated or not. This QR Code is ideal to use as a check-in credential that verifies the user has been vaccinated, without revealing anymore more information about the vaccine or the user itself. # Benefits and Limitations All you need to know to understand if our solution works for you ## Benefits 1. Easy of Learn and Use: 1. Everyone knows how to work with paper 2. Holders do not have to remember any secrets at all 3. Users carry a minimal additional physical object 4. No electronics, no accounts, no payments 5. Error-proof procedure for any age 2. Trusted: 1. The signed payload is cryptographically protected and thus impossible to tamper 2. Issuers place their public keys on their DNS records, facilitating trust from a known website 3. Observation-proof: Signed cards are bound to a person's ID. An attacker cannot impersonate a user after observing them present a credential 4. Knowledge-proof: It is not possible for an attacker to impersonate a holder by exploiting knowledge of personal details 5. Hack-proof: Nothing a verifier could possibly leak can help an attacker impersonate the user to another verifier 6. Theft-proof: An attacker in possession of a Holder's credentials cannot use them for presentation to another party. 3. Small: 1. Complete QR-code payloads range between 100 and 200 bytes, ideal for low-end and feature phones 2. It is ideal to cheaply transfer the payload via SMS 4. Private with selective disclosure: 1. Users can easily choose which attributes to present and withhold the rest 2. No centralized PII, no exposure to government, private companies 3. No central point of failure 4. No need for PII at the vaccination site or at tracking systems 5. Protection for vulnerable populations 5. Easy to backup: A picture serves as a backup of the code 6. Negligible Cost per User 7. Generalizable: Any record/payload can be created and signed in the same format 8. Modular: Add QR Codes to app/computers for additional features 1. Scheduling, Reminders, Backups, Self-reporting, etc 9. OpenSource Specifications under MIT License ## Limitations 1. Traceability of the QR Codes is possible by colluding verifiers 1. Solutions include generating multiple salted QR Codes to be given away as opposed to one code that is read everywhere 2. Chance of losing the card, losing the data 1. The issuer might have a copy of the event record, but it is not a requirement 2. Apps and pictures of the card can serve as a backup 3. No Revocation of cards/credentials 1. The only option is to remove the public key from the database, invalidating all certificates 4. Card information itself is not encrypted 1. The only information security feature is on the tri-fold mechanism of the paper card # Working Groups Working groups within the Vaccination Program at the PathCheck Foundatio We split our efforts into several working groups. ### Vaccine Journey Design * Brainstorms and proposes new User Experiences for the Vaccination Flow * Performs user studies and publishes specifications and papers around it ### Paper QR URI Specification & Protocol * Design of a compact framework to represent Vaccine Credentials inside QR Codes. * Design and development of payload types * Design and development of a public key issuing database ### Vaccination for Children * Group focused entirely on the Vaccination flow of Children and early teens. ### Boost Vaccine Diary App for users A diary app for users to: * Check user's eligibility * Load their coupons * Make vaccination appointments * Display reminders from Public Health * Capture vaccination credentials * and symptom reporting ### Veriscan App for Vaccination Teams in the Front Line * User coupon scan - validity and schedule check * Badge generation and badge printing - access to Bluetooth QR code printer, or delivery via user SMS or Mobile App if applicable * Status generation and status printing * Integration with FHIR / IIS / EHR and other reporting systems as required. ### Bluetooth-based Checkin Protocol * A protocol to check the health status of hundreds of users at the same time. * Ideal for large events and venues ### Check-in Application for Business * For organizations, businesses, and other parties to scan and verify proof of vaccination from Paper, SMS, or Mobile App vaccination cards ### Issuing Credentials Portal * Public and private key management solution * Revocation and distribution of keys ### Scheduling Systems * Omnichannel appointment system * Web, SMS, App, and Paper QR Cards integration ### Vaccination Dashboard * Tracks vaccinations per zipcode * Symptom reporting * Prediction and Analytics ### Supply-chain Dashboard * Link to state vaccine allotment fulfillment (direct read) * Show site-specific and manufacturer-specific doses administered * Show site-specific follow-up dosing with interval bins * Show site-specific population demographics based upon coupon usage and badge generation # FAQ ## Is the Vaccine app a replacement for existing CDC or state systems? No. Systems such as VAMS/VAERS/V-Safe/IIS/IZ. are important in wide ranging COVID-19 vaccination efforts. Our proposed app would provide an alternative method for vaccination that is privacy-sparing, efficient, and equitable while serving as a supplemental source of vaccine monitoring information. ## How will this interface with VAMS/VAERS/V-Safe/ IIS/IZ? What changes are required? Vaccine diary, second-dose, and health status alert, and informational features of our proposed app would be independent of existing systems. The input of vaccination information upon administration of a vaccine and side effect/efficacy reports are two areas with potential for integration with government systems. To verify and record vaccine administration, vaccination clinics or governments would need to provide signed QR codes that can be printed/copied by pharmacies or by users. This QR code would have information regarding the lot, manufacturer, and dosing of a vaccine which can then be verified by others with the appropriate digital key. For interoperability of symptom/side effect reports, state or federal systems will need to allow the pseudorandom identifier associated with a user to be used for data identification purposes rather than PII such as name, address, etc. This is already part of the PPRL (privacy-preserving record linkage) protocol for VAMS and IIS. ## If you don't have PII, how can a doctor get in touch with the user? Doctors and public health officials can contact users regarding pertinent information about their specific vaccine lot and other important details via app-mediated push notifications and contextual alerts. This is similar to ‘recalls’ in auto-parts, food safety, toys, etc. ## What difference will it make? Wouldn’t everyone be vaccinated anyway? The emphasis is on privacy, equity and efficiency. Significant chunks of the population still exhibit vaccine hesitancy and many may be unwilling to receive a COVID-19 vaccine. This app aims to potential barriers to vaccination by protecting data privacy, creating a convenient, streamlined user experience, and providing multiple vaccine-related functionalities in one platform. We also believe decentralized data can be used for a broad range of public health research. ## Is this app primarily a vaccine passport or verifiable credentials? This app does support vaccine verification while also including modules surrounding eligibility confirmation, dose scheduling and reminders, health assessments and symptom reporting, and providing users with push-notifications and contextual alerts. ## How will you reach marginalized and low-resource communities? We have also proposed state-produced physical vaccine cards that can be used for many of the functions of our app solution. This enables a privacy-focused solution for vaccination. Please see a thorough explanation in section 6. ## Why should user trust such apps? The app is developed using open-source code and open standards. Similar to the exposure notification apps, the app does not request any PII. ## Why do centralized systems including VAMS and VAERS require so much PII and HPI? PII including name, date of birth, and contact information is primarily used for user identification, contact, and record-keeping. Health information is stored to determine eligibility for vaccination based upon exclusion criteria and to track the interactions between various medical conditions and vaccination. Other personal information might be used for aggregate analysis and statistical purposes regarding equitable distribution among diverse populations. Our app-based approach addresses each of these functions without the use of PII. Identification of an individual for record-keeping is performed using a pseudorandom identification number rather than name or date of birth. Previous health information can be inputted into the app for exclusion determination where it is not stored. As soon as the app determines eligibility for vaccination information shared in these questions will be deleted. Symptom and adverse event reporting can be performed either anonymously or with personal information that might lend insight into vaccine and medical condition interactions. All demographic information can be anonymized and aggregated for reporting. ## What if the user does not have a smartphone? We expect users seeking a privacy oriented approach to vaccination to use a physical card containing a digitally-signed QR code from the government. ## What is PathCheck and what role can it play? PathCheck is a nonprofit organization originating in Dr. Ramesh Raskar’s lab at MIT. PathChck is the world’s largest open source, open standards nonprofit organization for COVID-19 and innovates across a broad array of problems stemming from the pandemic. PathCheck was the first organization to launch an EN app for contact tracing in COVID-19, successfully partnering with 6 US states and territories. ## What is MIT SafePaths? What is its role? MIT SafePaths is a set of standards protocols and algorithms and open-source tools. The project on vaccination protocols is led by Ramesh Raskar at Trusted Pandemic Tech and MIT Media Lab, Sanjay Sarma at MIT Auto-ID Lab and Anna Lysyanskaya at Brown University. # Videos & Demos A collection of our latest presentations on the solution ## [Introduction to Paper-first Vaccination](https://youtu.be/9Tx8LH7Mp18?t=91) by Ramesh Raskar ![Paper-first Vaccination Solutions by Ramesh Raskar](/files/-MVcAA455hCYDHaMirWT) ## [Overview of All PathCheck Solutions](https://youtu.be/9Tx8LH7Mp18?t=374) by Tony Rose ![Overview of All PathCheck Solutions by Tony Rose](/files/-MVcB-0qg5EPdmNEeIXk) ## [User Journey Demo](https://youtu.be/9Tx8LH7Mp18?t=2131) by Vitor Pamplona ![Full Demo from Paper Cards to Dashboards](/files/-MVcBs8WgfHI5rvWc1_b) ## [Design Considerations](https://youtu.be/Mr_jF7MSMbQ) by IDEO's James Smalls: ![Design Considerations by IDEO's James Smalls: https://youtu.be/Mr\_jF7MSMbQ](/files/-MVc81uPlGvkWg1oPKiT) ## [Boost App Demo](https://youtu.be/5KRJF9AxDwk?t=124) by Vitor Pamplona ![PathCheck Boost App Demoonstration by Vitor Pamplona: https://youtu.be/5KRJF9AxDwk ](/files/-MVc9-yHRhmxy0sDrkXv) # Trifold Card Design Selective Disclosure of Verifiable Credentials on Paper Here we present an Eligibility, Immunization, and Health Passport card utilizing four digitally signed QR code stickers. These stickers are simply QR codes printed onto adhesive labels that can then be attached to a user’s physical card (watch the [presentation](< https://youtu.be/Mr_jF7MSMbQ>) by IDEO's James Small on the design). Our solution is intended to decouple the health information and personally identifiable information (PII) thereby separating the eligibility of the vaccination from the distribution of it. The idea is similar to the QR code on the back of a driver's license. It is tamper-roof, the QR sticker cannot be reproduced by anyone else as the state's cryptographic private key is a secret. And the resident simply carries this physical driver's license which can be scanned by law enforcement or other purposes. ![An Extension of the US Vaccination Card for Covid-19](/files/-MVmE8IQsntb6IgsB8Fa) ## A Verifiable Coupon is the SSN of the Vaccination Journey To accommodate the several-stage vaccination policies that countries have begun to employ, cards will be distributed containing one digitally signed Coupon QR code (i.e. in a similar way the US sends voting ballots). The Coupon is a pre-vaccination registration and can be used for scheduling and eligibility verification systems. By allowing Vaccinating teams in the front lines to scan a verifiable QR coupon, the workflow eliminates data entry and input errors in the system. Reading and verifying a coupon happens completely offline. The vaccination team does not need access to the internet to complete their procedures. After the vaccination, the same app that reads the coupon from the user, signs, and prints two QR stickers: the Badge with complete PHI and the Status that simply shows 1 variable, vaccinated or not. This certifies that the coupon holder has taken a vaccine and can be used to safely enter some venues that might require proof of vaccination. The badge also allows the user to upload adverse side effects with authentic dose information. ## Selective Disclosure and Privacy by Design The Trifold design allows users to show which information they want to disclose at any given point in time. If they open the left wing of the card, they will show their health information: the coupon and the badge. If they open the right wing of the card, they will show their contact information and a flag that represents their vaccination status. When they open both, they see all the information, through the QR codes and through the manually written records in the center. ![Selective disclosure offers privacy and control to users](/files/-MYodk-jUC8E9-fzCLw0) ## Ready to Print and Use The card can be printed in regular Letter format and fold it down to create the trifold mechanism. ![](/files/-MYodeCotI1B7yJRRgV_) ![](/files/-MYodzkiNPuSnwneZFXI)