4 things to know about the IBM Digital Health Pass

Editor’s note: This interview has been edited for clarity.

Digital health, aka vaccine passports, are a big topic in travel right now.

There are many players in the travel tech space, from the International Air Transport Association (IATA)’s Travel Pass app to the Commons Project’s CommonPass to IBM’s Digital Health Pass.

The latter recently partnered with Amadeus, a global travel tech company, to launch a process to make it simpler to verify traveler’s health credentials. And New York State partnered with IBM this spring to create the Excelsior Pass, which can verify test or vaccination results for New Yorkers.

To find out more about how the IBM Digital Health Pass works, TPG spoke to Greg Land, who leads the travel and transportation sector at IBM, through video chat.

For more TPG news delivered each morning to your inbox, sign up for our daily newsletter!

What is the Digital Health Pass from IBM, and how does it work for travel?

Greg Land: We have an end-to-end solution that includes a digital wallet and a verifier app. One thing that differentiates ours [from other digital health passes] is that ours verifies and authenticates the credential to make sure that it's still valid. What that does for the traveler is, if every traveler can get a QR code, it is a valid credential that they can upload and authenticate, even before they check-in for their flight. You reduce the risk of having any bottlenecks or delays at the airports.

In addition to having that end-to-end solution with a digital wallet and a verifier app, we also have a verifier API. Most airlines don't want to ask the traveler to download a third-party digital wallet. And most of us have gotten very comfortable checking in on the mobile app, picking our own seats and getting a mobile boarding pass. So [the Digital Health Pass] needs to fit in that intuitive flow the traveler is used to. Once a traveler has their QR code for either their test result or vaccine card, they can upload it as part of the regular process between booking and check-in.

There's that point between booking and check-in where you've got to verify your passport information or verify your visa information. This will just be a third document that has to be verified in that process. So that before you even get a boarding pass issued, your health credential would already be confirmed as valid. And if your credential is not valid, for some reason, it'll tell you right then so you'll know before you show up at the airport.

Are there plans to expand beyond airlines and travel?

Land: Before the pandemic, I was part of a task force with the World Travel and Tourism Council, where we were looking at biometrics and digital credentials to streamline processes for travel.

We were already working on global standards and guidelines to implement digital credentials. Then the pandemic happened, and we had to pull in digital health credentials, so that was where the partnership with Amadeus was born. Amadeus was working with us on that same task force, along with many others last summer [and] started working to roll out a Digital Travel ID.

That's when we started working with them to integrate our Digital Health Pass with their Digital Travel ID. Now, once you've got that [it] means you can now match the digital health credential to a passenger's [reservation record] and also match it to the boarding pass. So then the next step is now you just have to attach that to a biometric ID, either a fingerprint or retina scan.

In addition to just scanning a QR code, you can now do a retina scan or a fingerprint [scan] and go through security checkpoints [or] customs and border protection. We were already seeing pilot programs rolled out in Singapore and Australia doing exactly that before the pandemic.

This is all infrastructure that helps move us through that roadmap. I personally believe that we'll see a lot of countries add COVID-19 vaccinations to their visa processes, along with yellow fever and other types of vaccinations that are sometimes warranted. This just digitizes that health information that could then be pulled into digital vaccines (records). It's going to streamline things at airports. It's going to streamline boarding of cruise ships, maybe even check(ing) into hotels.

We have been testing this with arenas; we tested it with Barclays Center, Madison Square Garden and Yankee Stadium. I think it is a step in the right direction for the longer-term roadmap of digital credentials, in general, being used for travel processes.

People on both sides of the digital health passport debate have accessibility concerns. Have there been any high-level conversations around how to make this accessible and equitable?

Land: You definitely have to have equitable access to this for everybody.

[For instance,] if I'm going to the check-in process on my computer at home on a website, and I don't have the ability to import that QR code in a digital fashion, it'll just tell me [to check-in at the airport]. I'll know to give myself enough time to get there and have my piece of paper scanned or reviewed by a check-in agent and authenticated that way.

So you can definitely still make the paper process work for airport arrivals and check-ins and boardings because you have to make it accessible to everybody. And the cruise lines are looking at it from the same perspective. If you look at the segment of people that still predominantly take cruises, they're still doing stuff with fax. And so (we've) worked through the processes with the cruise lines as well, where they're going to have the ability to upload a piece of paper and then verify it and load it into the passenger record.

[Accessibility] is something we've had lots of discussions about. This is definitely a private sector-public sector collaboration because we can bring all the capabilities to the market. But then each government has got to decide how they're going to use these capabilities. Every country is going through those growing pains right now. Even with the EU certificates that are being implemented this month ... I wish they would have gone one step further and just dictated a single platform to be used by all 27 countries. Every [EU] country is rolling out their own mobile app, [but] at least they're using one standard, and the certificates all use the same QR code standard.

How is IBM protecting travelers’ health data from hacking?

Land: We built this with data privacy in mind because we first rolled this out for the healthcare industry to use for managing patient data. We're taking an encrypted token or an encrypted address that says, here's where [a traveler’s] test result or vaccine record is stored. We're simply looking at the information to verify that you meet all the requirements.

We're not passing back any of that patient-level data, and we're not storing any of that patient-level data. The airline doesn't get back to any of the detailed patient information. We don't store any of the detailed patient information -- just think of us as using a network to manage an ecosystem of issuers and verifiers.