We’re still at the point in this pandemic where talking about opening-up feels a bit premature—tempting fate, as it were.

But it’s not only the virus that could be holding things up: there’s also the lack of agreement on global standards to record, share and verify data about an individual’s health status that would accompany any major easing of travel, within or between countries.

“If you’d asked me this 12 months ago, I would have thought that it would have been fixed, that we would have worked out how to restart, travel, return to work, return to play and live events by now,” says Darren Toh, CEO of AOKpass. “We haven’t. Now what’s emerged is a very scattered field of providers.”

This fragmented market is perhaps understandable. For one thing health data—whether you’ve been vaccinated, whether you’ve had COVID already, whether you’ve been tested—touches on serious privacy issues, which are often handled differently by different jurisdictions.

And then there’s the links in the chain, from the labs testing patients, to the public and private sector entities administering vaccines, to restaurants and workplaces that want to prevent spread of COVID in their facilities, to the airlines wanting to onboard and offload passengers quickly while at the same time ensuring they all comply with requirements of the host country and any destination they may be heading for. Fashioning a solution for all, even within a country, is not as easy as it looks.

Lessons from a city-state

One model is Singapore’s. The country has leveraged its close relationship with the tech community to build an ecosystem which it hopes will dovetail as smoothly as possible with those of other countries, and hopes may be adopted by them.

Simon Gordon, chief commercial officer of Singapore-based Accredify, says that when he and his CEO Zheng Wei Quah started last year it was clear that the government’s biggest headache was a relatively straightforward one: how to speed up the process of issuing certificates to (mostly) migrant construction workers who had contracted COVID but were no longer infectious.

Those holding such certificates, called discharge memos, could then return to work. By digitising and automating as much of the process as possible, Simon said they helped speed up the process. In doing so they noticed another problem: despite the low levels of travelers, officials at immigration checkpoints in Singapore were struggling with having to manually inspect paper-based COVID-related medical records or diagnostic reports.

That led them to work with GovTech, the government’s digital services agency, and others to help build HealthCerts, a verifiable open-source standard for COVID-19 pre-departure test (PDT) and vaccination certificates. In February the government mandated all clinics in Singapore providing PDT services to issue certificates in the HealthCerts format.

Singapore has made all the underlying technology open source, and hopes other countries will adopt it. But whether or not that happens, it has already provided the ground for an ecosystem of supporting players. On the one hand, more than a dozen companies are providing issuance services to labs and clinics, either helping them issue digital certificates compliant with the HealthCert standard, or issuing them on their behalf.

Then there are companies providing verification services to governments, aviation tech providers and airlines so they can easily check a HealthCert certificate’s validity via a QR code.

The ecosystem has to some extent bifurcated, between issuance service and verification services. While Accredify has focused on the former, another Singapore company, Affinidi, has focused on the latter, building what it calls a ‘universal verifier’ that can verify most standards of digital pass.

Taken together, these services resolve much of the chain, from issuing a test or vaccination record through to the final destination being able to easily verify and authenticate, without compromising privacy.

But expect more parts of the eco-system to be carved out, as the landscape evolves. For example, there are services providing digital wallet for individuals to store their HealthCert certificates, again built on software that the Singapore government has open-sourced.

As usage grows, it’s likely there are more spaces that will require some extra layer or service. Scott Wong, a Singaporean clinician-innovator, notes that health credentials based on PCR testing, while highly accurate, can be labour intensive and may take hours to process, which limits their utility in some situations.

Scott says the answer is in parallel self-testing using the Antigen Rapid Test, or ART. His newest service, via a progressive web app called ART Buddy, has been responsible for collecting the results of some 10,000 users a day, initially among Singapore’s foreign construction worker community, who mostly stay in dormitories in special zones. The application is now available on the MOH website as a guide for ART testing and he is now working with the country’s Armed Forces.

Indeed, while most of the attention on COVID passports has been on international travel, which still involves relatively small numbers of people, opening up the domestic economy may well be a bigger area of activity. Accredify, for example, has also launched a service to solve some of the operational pain points around testing 10s, 100s, or even 1,000s of employees. Such approaches offer scale in terms of helping large organisations manage testing and verifying results, usually within a single country.

But working across borders requires a different kind of scaling. AOKpass, for example, partners with International SOS, an international medical and logistics provider, giving them access to some 90,000 accredited labs around the world. When an International SOS client needs to deploy its workers and the lab needs assistance, AOKpass would onboard the lab and provide the credentials necessary for the team to travel. Earlier this month it oversaw the testing and issuing of credentials to a charter flight of passengers and crew from South Africa to Mongolia on behalf of Rio Tinto.

These are early steps. Countries and regions are pursuing different paths in the issuance and verification of credentials, and show few signs of consolidating—what AOKpass’ Darren Toh calls a “moving feast of different approaches, different technical frameworks and different operational frameworks”. While Singapore’s HealthCerts uses a blockchain model to verify the integrity of a certificate, for example, the European Union uses a public key infrastructure, or PKI. And the privacy standards of each are quite different.

Add to that the tendency of some of the larger pass solutions to focus on a specific area—travel, say, or verification over issuance—then it’s inevitable that the ecosystem will diversify as gaps and needs appear. That means that part of AOKpass’ business, for example, is building rails that enable interoperability between the two systems.

It also means that in this constantly evolving landscape AOKpass has to also customise its service and product. “AOKpass looks different in every jurisdiction,” says Darren. “It may be that we have servers that operate only in the EU for EU based-operations, and a Singapore-based service which conforms to the Singapore requirements. So it’s another level of complexity which is required to scale at a global level.”

What this means for clinical labs

What’s clear is that just as COVID is not going to vanish any time soon, so this ecosystem of services around requirements, standards and jurisdictional difference is going to grow as the space matures. For labs, there are positives and challenges.

A reluctance to invest in the technologies to issue, store and verify health credentials is going to decline the longer the pandemic lasts. It will eventually be in everyone’s interest to recognise and adapt to the growing complexity of travel between and within countries at different stages of the pandemic. This means that governments and international organisations will be urged to prioritise agreement on standards, of credentials and processes.

The ecosystem of digital health players will likely expand and the purveyors of technological solutions will recognise the need to work more closely with the medical community—including labs—to build services that take into account the broad spectrum of IT adoption. AOKpass, through its partnership with International SOS, has adapted its services to cater to this, and so includes a workflow for the very low end that requires only an app stored on a smartphone.

Similarly Simon of Accredify says his service can integrate with a clinic’s Laboratory Information Management System or, if the lab doesn’t have that, it can upload to the company’s web portal. Prior to all this, Accredify would build templates depending on the lab’s own clients’ needs—the data fields and tests required for a Chinese citizen visiting Japan, for example.

This fragmentation of the market, from a country’s requirements and standards, to the solutions which don’t address the full spectrum of possible needs, is likely to push most clinics into working with an external provider to handle this complexity. It is simply going to be too much for all but the most advanced labs to be able to handle. At the same time, Scott Wong’s ART Buddy is also a possible vision of the future: where rapid testing at scale may become the norm.