How vaccine status data will flow to state check-in apps

Services Australia has provided the clearest picture yet of how Covid-19 vaccination certificate data will be incorporated into state and territory government QR code check-in apps.

As the states under lockdown prepare to open up, all states and territories have agreed to integrate an individual’s record of Covid-19 immunisation history into the apps that have become commonplace.

Queensland, Tasmania and the NT use a version of the ACT’s Check In CBR app, while NSW, Victoria and SA have built the functionality into existing service delivery apps. WA uses its own SafeWA app.

While there is still a question mark over how standalone apps – which store only a person’s name and phone number – will fit into this approach, NSW will become the first to trial the functionality next week.

The state will begin a pilot with up to 500 people in regional areas to test the functionality before a full-scale rollout, though the feature is not expected to be ready for when NSW begins to open up.

Data will flow from the Australian immunisation register, which was updated earlier this year in preparation for a projected 30-fold increase in demand.

During a senate inquiry hearing into the federal government’s Covid-19 response, Services Australia deputy CEO of transformation projects Charles McHardie said the vaccine status would be confirmed using a token.

“What we do behind the scenes is we create what’s called a soft token,” McHardie told the committee on Thursday.

“So it’s a security token that uses public key encryption for security that we then pass from Services Australia across to Service NSW.

“And then in the backend what it does to your record is then basically says that that customer has been immunised.”

The individual’s health identifier – the unique number used to identify an individual for healthcare purpose – will also be “put in” by Services Australia, as well as a “few other bits of information”.

“So there’s a rendition of the vaccination certificate that will sit in each of the state-based apps that looks exactly the same as ours, but there’s also a QR code authentication feature,” McHardie said.

Medicare app for consent

McHardie said the consent process for “sharing” the vaccination status with the state and territory governments would take place in the federal government’s Medicare Express Plus app.  

The process will be similar to how individuals go about storing the certificate in either their Apple or Google digital wallet, which also involve providing consent to having the data stored in that way.

“As we complete our integration with the states, we’ll have additional areas for you to be able to share that vaccination history with, so it’ll have a list of the jurisdictions,” he said.

“So [in NSW] you select NSW, a consent statement then comes up on the screen and that allows the customer then to provide consent that they’re going to provide various parts of their information - so their personal information and some of their vaccination history - with the state,” he said.

“So it’s up to the customer then, they either consent or they don’t."

If a customer consents, when they check into a business or venue “they get a green tick”, whereas if they haven’t provided that consent they won’t.

While NSW will be the first state to access vaccine certificate data through its state-based app, McHardie said systems integration testing was underway with each jurisdiction.

“That testing is underway. Whether the jurisdictions actually take up that functionality and turn it on will be up to them,” he said.

“So we’re providing the capability… but it’s completely up to the states how they will deploy the capability.”

McHardie added there had been a preference for a “state-based approach” because of the differences in public health orders and the fact that QR codes check-ins are controlled by the states.

International travel

From November, Services Australia is also planning to use the Medicare app to generate an internationally recognised vaccine certificate when an individual wants to travel overseas.

McHardie said users would be asked to input some passport information, which will then be packaged up with the Covid-19 elements of the vaccination and sent to the Passport Office in real-time.

The Passport Office would then put a digital visible seal (VDS) that is recognised by the International Civil Aviation Organisation onto a certificate that would appear “straightaway” in the Medicare app.

“Now, that visible digital seal allows verification by third-party applications and indeed, if you go to the Apple or Google store you can already download what's called the VDS-NC, which is a reader that can be utilised for those VDS certificates to prove that that vaccination certificate is valid,” McHardie said.

“So that can be used at departure gates… wherever it may be utilised as the borders start to open up.”