Gartner Research

Digital COVID-19 Vaccine Certificates: The Road to a New Normal

Published: 22 January 2021


Digital vaccine certificates can help business and society reopen, but complexities make a path forward less clear. Executive leaders must understand the landscape, be open to altering plans based on new information and cautiously consider how their own governance frameworks can help solve issues.

With COVID-19 vaccines in rollout phase in various regions globally, the race for applying solutions to aid in return to normal is in full swing. Digital vaccine immunity certificates are one such emerging solution holding great promise. The scale and speed needed to manage vaccination against the virus necessitates technology that can document whether an individual carries antibodies, either from having had the illness or from an inoculation.

At the current pace, it will take years to immunize the planet. Currently demand far exceeds supply. Yet only 64% say they’ll get vaccinated in the next year and epidemiologists are still debating the threshold for of the population with COVID-19 antibodies needed to reach herd immunity — a state that leads to the eventual disappearance of the virus. Given this potentially long-term horizon for living within a pandemic, the public and private sector is forging ahead to create a source of record indicating a person’s COVID-19 immunity.

In mid-January a coalition of large tech and health companies launched the Vaccine Credential Initiative to create a system for storing and retrieving digital records of vaccinations. Participants include Microsoft, Oracle, the Mayo Clinic, Salesforce, Epic, Cerner and all three major airline alliances.In the same time frame, the World Health Organization (WHO) launched a digital health working group to develop a framework and standards for a smart digital vaccine certificate for yellow fever and COVID-19, paving the way to add other vaccines later.

Airlines have already been getting on board with solution trials; Qantas has said that proof of vaccination will be required to take a seat on one of its planes and United and Cathay Pacific began a pilot project in October 2020 on select routes using CommonPass — a QR code that contains COVID-19 testing and vaccination data.

However, obstacles also stand in the way of wide-scale adoption. Executives need to understand the pitfalls as well as the promise to gain clarity for their scenario inputs so they can plan policies if the passports become a reality. Those with a more direct role to play (technology providers, public sector officials, education and societal leaders) can use these considerations to create a roadmap to build out an effective system. Specifically, the following groups all have a stake in understanding how vaccine certificates will be considered and implemented:

  • Business executives looking to be aware of mechanisms that meet the requirements to restart travel and aid in commerce flow

  • Public sector leaders looking to understand or to be involved in public and private sector initiatives, policy and guidance

  • Technology solution providers/vendors looking to develop and implement services or to expand partnerships in this space

  • Consulting or other services supporting this emerging market

  • Investors looking to support companies involved in these initiatives

The WHO first established certificationstandards in 1933 and has issued paper medical passports in some form ever since. They are known as “yellow cards” for the yellow fever immunizations required for entry to many regions including countries in Africa, Asia and the Pacific. Nor is documentation limited to travel. Employers in some industries (e.g., healthcare) have required that employees submit vaccination status for diseases such as measles and rubella and schools have required immunization documentation for years.

Now, though, organizations are forging ahead on digital solutions as a fast and scalable response in order to reopen economies and travel routes — even though global standards don’t yet exist. Estonia announced last year that it would develop a “smart yellow card” based on blockchain technology, China is looking to use QR codes that can be linked to its national identification system and multiple organizations are proposing to link biometric data to track immunity.

With a digital push comes a host of new challenges. For instance, earlier solutions to the COVID-19 pandemic, such as Apple and Google’s contact tracing applications, exposed the difficulty of coordinating a wide-scale digital response. Other attempts at tracking the virus’s spread, like WHO’s “Waze for COVID-19” similarly failed to take off due to lack of widespread use. Singapore’s TraceTogether contact tracing app had more success, but has recently seen trust erode when it was reported that user data was shared with law enforcement.

The timing of a return to “normal” (whatever that will be) is murky: As of December 2020, 61% of HR executives didn’t know when their organizations will resume business travel and 48% weren’t sure when their employees would reintroduce in-person client meetings or conference attendance.

The emergence of vaccines already has some companies readjusting their pandemic scenarios and not always as upside possibilities, such as simplifying a return to the workplace. In fact, almost a quarter of CFOs told us they were adding one or more downside scenarios because of the vaccine. Executives will also need to consider how vaccine certificates could amplify distrust or add an extra step that might slow down a rollout.

Figure 1: Scenario Changes Due to Emergence of COVID-19 Vaccines

Organizations that play a role in the the various aspects of digital vaccine certificates ranging from policy to implementation should work to minimize each of the following uncertainties:

  • Standardization. Who will set the standards? Will there be multiple standards across the globe? What is immunity defined as?

  • Infrastructure. Can existing systems handle the data and security needs of digital certificates? Can these systems be integrated and offer interoperability?

  • Governance. Who will be in charge of the systems and data? How will privacy be protected? How will forging be identified and combatted?

  • Verification. How will people with immunizations or immunity be verified? Who will have access to immunization records? How will that data be confirmed as accurate, not falsified?

  • Buy-in. Will people use the certificates? Will certificates have the support of governments?

  • Use. How will the certificates be used? For travel? Work? Entertainment? Shopping? Will the uses pass legal scrutiny?

  • Equity. Can people access and manage their digital information? Will some people be left out? Will certificates create social stigmas or exacerbate the digital divide?

  • Usefulness. Will certificates go out-of-date if vaccines don’t provide long-term immunity? Will certificates need immunity information for multiple strains? Will different groups exhibit different levels of vaccine effectiveness?

  • Acceptance. Who will accept certificates? If there are multiple certificates, will some be accepted more widely than others?

  • Unintended consequences. Will digital certificates create greater distrust of vaccines? Will it create extra steps for vaccination? Will people be incentivized to get infected to get a certificate?

Given the above challenges, vaccine certificate stakeholders must establish governance frameworks that allow for the acquisition, equity, verification and sharing of immunization data. For a digital solution to be a success, it must achieve wide-scale user adoption (see Figure 2). The solution should include a:

Figure 2: Wide-Scale Adoption of Digital Health Passports Requires a Convergence of Business and Society ‘Must-Haves’

Additionally, any vaccine certification solution needs a structure for the overall orchestration of people, processes, technology and data.

Building off the 10 success factors for a solution, those involved with creating and managing these digital certificates should adhere to some basic technical standards if certificates are to be widely adopted.

High-level requirements:

  • Enables consent based COVID-19 vaccination records to be accessed in a secure, verifiable and privacy-preserving way.

  • Works across organizational and jurisdictional boundaries and is built on international standards within a secure decentralized infrastructure.

  • Uses trusted and verifiable sources.

  • Generates a secure digital certificate, e.g., QR code.

  • Links to unique identification and demographic data.

  • Lists vaccine manufacturer, dosage information.

  • Documents where the person was vaccinated and who administered it.

While not required for wide-scale adoption, organizations should consider a multi-use functionality solution that can include testing information, given the two- to three-year year time frame of the vaccine rollout globally and the pressing need to reopen and offer assurance that travelers are free of COVID-19.

Data standardization, in terms of what data is acquired, how it’s formatted and how it’s exchanged is critical. Data use agreements may also be required. Any data should have the potential to link with other systems such as medical/health records and Immunization Information Systems.

Organizations can use the following questions to guide discussions around if/how they will use, develop or manage these solutions:

  • What should we be thinking about regarding the use of vaccination passports and health passes?

  • Which solutions exist today and how can we leverage them?

  • How will vaccine certificates and health passes be used in return to the workplace?

  • What innovations could make solutions faster to deploy and use?

  • How can we ensure privacy while still maintaining data accuracy, privacy and security?

  • Where will equity be an issue, and how to reduce any social gaps produced by vaccines or the digital divide?

All this said, requiring a digital vaccine certificate for everyone immunized might scare some people away from seeking a vaccine; they may have concerns over privacy or simply not want to bother with the extra steps involved. Consequently, employers and authorities should give special consideration to policies and education.

Organizations should also be aware of some representative solutions already in use and initiatives. You can reference these to see how solutions work in practice and monitor the progress (or pitfalls) of each of the following:

Will a standard model or models emerge for organizations administering COVID-19 vaccines to make credentials available in a consent based, accessible, interoperable, digital format? Will society accept and use it? Will wide scale adoption be achieved and if so when? The outlook appears promising given such a data driven application could significantly aid in addressing the pressing global problem of returning to normal.

By , Sharon Hakkennes and Steve Shapiro

Recommended by the Authors


“Vaccine Credential Initiative,”Vaccine Credential Initiative

Gartner HR Lessons From COVID-19 Poll, Gartner


Human Resources Research Team

Access Research

Already a Gartner client?

To view this research and much more, become a client.

Speak with a Gartner specialist to learn how you can access peer and practitioner research backed by proprietary data, insights, advice and tools to help you achieve stronger performance.

By clicking the "Continue" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

Gartner research: Trusted insight for executives and their teams

What is Gartner research?

Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.

Gartner research is unique, thanks to:

Independence and objectivity

Our independence as a research firm enables our experts to provide unbiased advice you can trust.

Actionable insights

Not only is Gartner research unbiased, it also contains key take-aways and recommendations for impactful next steps.

Proprietary methodologies

Our research practices and procedures distill large volumes of data into clear, precise recommendations.

Gartner research is just one of our many offerings.

We provide actionable, objective insight to help organizations make smarter, faster decisions to stay ahead of disruption and accelerate growth.

Tap into our experts

We offer one-on-one guidance tailored to your mission-critical priorities.

Pick the right tools and providers

We work with you to select the best-fit providers and tools, so you avoid the costly repercussions of a poor decision.

Create a network

Connect directly with peers to discuss common issues and initiatives and accelerate, validate and solidify your strategy.

Experience Gartner Conferences

Join your peers for the unveiling of the latest insights at Gartner conferences.

©2022 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner’s prior written permission. It consists of the opinions of Gartner’s research organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner research may address legal and financial issues, Gartner does not provide legal or investment advice and its research should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its research is produced independently by its research organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity.