A digital “Yellow Card” for securely recording vaccinations using Community PKI certificates

Abstract

The Yellow Card or carte jaune is a paper booklet in a standard format set by the World Health Organisation in which a person’s vaccinations are recorded by healthcare officials. Numerous initiatives are striving to create both digital vaccination records and new digital identities for people with little or no official documentation; i.e. “low doc” persons. Yet there is no globally agreed model for identity, nor any standardized way to establish identity. Nevertheless, field workers today are able by and large to establish the bona fides of Yellow Card holders with adequate certainty for the paper-based system to function most of the time. This paper contends that vaccinations should be digitized without introducing new identity systems, since a lack of formal identification is obviously not preventing Yellow Cards today. This paper describes a new digital Yellow Card, deployable on most regular mobile phones, in which public key certificates represent vaccinations and other credentials, vouched for by officials or field workers. The design has practical benefits for the digital engagement and privacy of low doc persons. It also shows how traditionally hierarchical public key infrastructure can be deployed without dictating identification protocols to communities, thus avoiding some of the controversies that plague this technology. The PKI security function can remain centralized while certificate issuance is decentralized, which leaves community organizations free to carry on their business as usual.