Digital Health Passes in the Age of COVID-19: Are “Vaccine Passports” Lawful and Ethical?

As COVID-19 vaccination rates in high-income countries increase, governments are proposing or implementing digital health passes (DHPs) (vaccine “passports” or “certificates”). Israel uses a “green pass” smartphone application permitting vaccinated individuals’ access to public venues (eg, gyms, hotels, entertainment).¹ The European Union plans a “Digital Green Certificate” enabling free travel within the bloc (see eTable in the Supplement). New York is piloting an IBM “Excelsior Pass,” confirming vaccination or negative SARS-CoV-2 test status through confidential data transfers to fast-track business reopenings.² This Viewpoint examines the benefits of DHPs, scientific challenges, and whether they are lawful and ethical.

Digital health passes offer health and economic benefits until herd immunity is achieved. By allowing a safe return to more normal life, DHPs encourage people to be vaccinated. Digital health passes also allow a gradual reopening of the economy in key sectors such as food, retail, entertainment, and travel. Consumers are likely to rejoin recreational and commercial activities if they are confident doing so is safe. Digital health passes offer a less restrictive means to relax COVID-19 preventive measures such as quarantines, business closures, and stay-at-home orders.

Digital health passes involve considerable scientific and technical challenges, including variable effectiveness by vaccine type, effectiveness in preventing transmission, durability of immunity, and emergence of variant strains. Currently, the overall efficacy of 6 SARS-CoV-2 vaccines, mRNA-1273 (Moderna/NIAID), BNT162b2 (Pfizer-BioNTech), Ad26.COV2.S (Janssen/Johnson & Johnson), ChAdOx1 nCoV-19 (University of Oxford/AstraZeneca), Gam-COVID-Vac/Sputnik V (Gamaleya Research Institute of Epidemiology and Microbiology), and BBIBP-CorV (Sinopharm/Beijing Institute of Biological Products), authorized for use in select countries, ranges from 65.5% to 94.6% in preventing symptomatic COVID-19 based on published clinical trial data. Each vaccine could have variable effectiveness against currently circulating and future SARS-CoV-2 variants. Considerable variability in vaccine effectiveness in preventing symptomatic disease could affect the usefulness of DHPs. If DHPs were limited to only certain vaccine products, it would also exacerbate inequities based on access to particular vaccines.

The duration of protection afforded by SARS-CoV-2 vaccines is uncertain. Coronavirus infections, such as from the 2002-2004 SARS-CoV-1 outbreak, generally afford limited protection for 1 to 2 years.³ Reinfection with SARS-CoV-2 has occurred, albeit rarely. Yet there is limited evidence of vaccine-induced immunity beyond limited follow-up of clinical trial participants. Waning vaccine immunity will be better understood with follow-up of clinical trial participants, along with observational studies. Digital health passes should include dates of series completion to determine expiration once longevity of vaccine protection is better defined.

Scientific uncertainty also exists about the extent to which vaccines prevent acquisition and transmission of SARS-CoV-2. Emerging evidence suggests that vaccines significantly reduce asymptomatic infection and spread.⁴ Nonpharmaceutical interventions should continue until herd immunity is achieved.

Digital health passes also involve technical challenges, including authentication of vaccine status. Unlike most high-income countries, the US has no national immunization information system (IIS), a confidential, secure, population-based digital database that records all vaccine doses. States administer IISs, with variable quality. Vaccination facilities must report vaccine administration to the relevant IIS within 72 hours. Preventing falsification of vaccine status is vital to DHP integrity. School programs already systematically authenticate and enforce immunization status through standardized forms. Companies are also developing technologies to securely validate immunization status.

Governments have power to validate and monitor vaccination status while requiring proof of vaccination for access to certain privileges. International law poses few restrictions on DHPs. The International Health Regulations, signed by 196 countries, grant wide discretion to exercise evidence-based public health powers. Article 31 of these regulations specifically allows governments to require “proof of vaccination or other prophylaxis,” while Annex 7 authorizes yellow fever vaccination certificates for international travel.

In the US, individual states hold primary public health powers. States already condition school entry on proof of vaccination. During the COVID-19 pandemic, states and localities have also required masks and social distancing in certain venues. They similarly could authorize or require DHPs, authenticating vaccination status either through public or private digital platforms.

The president has broad power to require vaccination for entry to airports and federal buildings and land, just as President Biden did for masks. However, a federal DHP system would likely require congressional action, and clear necessity to prevent the interstate spread of infectious diseases. Congress could also allocate funding for state DHPs, even conditioning further COVID-19 relief spending on state adoption of DHPs.

Government DHPs must navigate constitutional and civil rights constraints. While the Supreme Court grants public health agencies wide discretion, it is more protective of First Amendment freedoms, including religion, speech, and assembly. The Court has struck down COVID-19 public gathering restrictions as applied to houses of worship. The Court would likely subject government-run DHPs to high-level scrutiny if they prevented unvaccinated individuals from attending religious services or infringed other constitutionally protected rights.

The private sector has a particular interest in ensuring that employees and customers are vaccinated because it facilitates a return to social and commercial activities. Businesses could rely on government-run or proprietary DHPs. The Equal Employment Opportunity Commission (EEOC) issued guidance on SARS-CoV-2 vaccinations, which applies to any vaccine “approved or authorized by the Food and Drug Administration,” suggesting that employers could require vaccinations even under an Emergency Use Authorization.

The EEOC allows employers to require SARS-CoV-2 vaccination to return to the workplace, thus ensuring employees do “not pose a direct threat to health or safety.”⁵ Employers also can use DHPs for proof of vaccination. Businesses can require employees to “provide proof they have received a COVID-19 vaccination.” Requiring proof of vaccination, moreover, does not violate the Americans With Disabilities Act or the Genetic Information Nondiscrimination Act. However, employers should caution employees “not to provide any medical information as part of the proof.”

Digital health passes also would be unlikely to violate privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA). Employers typically are not “covered entities” under HIPAA. Digital health passes could actually be advantageous because they provide proof of vaccination without sharing any other medical information.

Although employers may require proof of vaccination, they must abide by civil rights law. Thus, employers, whenever possible, should afford persons with disabilities “reasonable accommodations,” such as through telework. Similarly, employers should provide reasonable accommodations to individuals who hold a “sincere religious belief, practice, or observance.” Some states are considering prohibiting private-sector use of DHPs, but courts may decide whether they have the legal authority to do so.

As long as there is supply scarcity, DHPs would unfairly exclude individuals who cannot access vaccines. Yet once everyone can gain access to vaccines, there is a strong ethical justification for DHPs designed to create safer environments to work, shop, recreate, and travel, as they represent a less restrictive alternative to current public health measures.⁶ Unvaccinated individuals have no right to impose risks on others, thus impeding a return to normal activities. Digital health passes therefore must be fully and equally available to all members of society, including the most disadvantaged people. Individuals who cannot be vaccinated for medical reasons also should not be excluded from DHP privileges. Consideration should also be given to granting exemptions for genuine religious or conscientious objections.

Health disparities based on race have been a persistent challenge. Black and Hispanic individuals in the US have had significantly lower uptake of SARS-CoV-2 vaccines compared with the overall population.⁷ Racial minorities’ historic distrust of the health system should not disqualify them from economic and social opportunities. Governments should amply fund community-based outreach to encourage vaccine uptake.

Governments or airlines could soon introduce “vaccine passports” to facilitate international travel. Yet requiring proof of vaccination as a condition of travel would unfairly burden most low- and middle-income countries, which may lack adequate doses to fully vaccinate their populations for several years. Approximately 70 countries have not even begun vaccination campaigns, including most sub-Saharan African nations. COVAX, the global vaccine facility, aims to vaccinate only 20% of lower-income populations by 2022. Compounding the unfairness, high-income countries have contributed to supply scarcity by signing advance purchase agreements with vaccine companies. High-income countries could help ameliorate inequities through funding and donating vaccine doses to COVAX while building manufacturing capacities in low- and middle-income countries, including technology transfer.⁸

Digital health passes could become an important vehicle for a rapid return to commerce, recreation, and travel. To ensure their success, they must be scientifically well grounded and the least restrictive alternative. Above all, DHPs must be administered equitably, ensuring that everyone has a fair chance to return to a normal life.

Corresponding Author: Lawrence O. Gostin, JD, O’Neill Institute for National and Global Health Law, Georgetown University, 600 New Jersey Ave NW, McDonough 568, Washington, DC 20001 (gostin@georgetown.edu).

Published Online: April 7, 2021. doi:10.1001/jama.2021.5283

Conflict of Interest Disclosures: Dr Shaw reported speakers bureau participation for Pfizer prior to 2020. No other disclosures were reported.

Additional Contributions: Daniel A. Salmon, PhD, MPH, Institute for Vaccine Safety, Johns Hopkins University School of Public Health, contributed to the research and writing of this Viewpoint. He received no compensation for his contribution.