Decentralised Vaccine Passports and Australia’s COVID-19 Legacy

During the COVID-19 pandemic, proof of vaccination moved from paper documents and workplace email attachments to phones. Travellers began checking digital health credentials, while venues in Sydney and Melbourne used QR codes to manage entry and public-health requirements. The experience exposed a practical problem: people needed a convenient way to prove eligibility without handing over their medical history to every café, stadium or airline.

The COVID-19 pandemic prompted the creation of decentralised vaccine passport apps, offering one answer to those pressures. Instead of keeping a health record on a single government database, these systems let people hold a signed vaccination claim and share a limited result with a verifier. Terms such as digital immunity certificate, verifiable credential and decentralised identity describe related approaches, although their privacy properties depend on the design rather than the label.

For Australia, the lesson is not that every paper process should become a blockchain application. It is that sensitive proof should be easy to present, hard to misuse and removable when it is no longer needed. Any local rollout would have to fit federal privacy and digital-identity rules, state health law and the expectations of a population that became fluent in QR check-ins during the pandemic.

From Paper Certificates to Verifiable Credentials

Before 2020, vaccination evidence often arrived as a card, a clinician’s note or an entry in a paper register. The pandemic compressed years of anticipated change into months. International certificates, domestic vaccination records and employer screening tools became routine, and each generated familiar complaints: clipped photographs, mismatched names, lost PDFs and uncertainty about which document counter staff should accept.

A decentralised vaccine passport app changes the transaction. A health worker signs a vaccination event; the holder stores a credential in a mobile wallet or phone; a verifier reads a QR code or receives a selective disclosure token. The result can show a particular status, such as vaccination completed, without exposing unrelated diagnoses, dates of birth or a full vaccination history.

These systems are not simply paper certificates in an app. Their defining feature is selective presentation: the holder chooses what to disclose, and cryptography helps prove that the issuer approved the claim and that it has not been altered since. A blockchain or distributed ledger may support that process, but signature verification and disciplined data handling matter more than the technology label.

Why Decentralisation Became Attractive

Centralised portals were easy for agencies to operate, but every additional check could widen the attack surface. When one account contained travel history, vaccination details and identity attributes, a data breach could affect millions of people. Moving signed claims to the holder’s device reduces duplication: the issuer keeps the authoritative record, while the person carries only the credential needed for a transaction.

The appeal became clearer as countries reopened unevenly. A global death toll report tracing the Delta wave illustrates the scale of disruption that travel rules were trying to contain. Verifiable records offered airlines and border agencies the prospect of a common artefact to inspect without repeatedly requesting personal health information.

There was also a resilience argument. A signed credential can be checked against an issuer’s public key or a suitable trust list, even when a traditional database is unavailable. That does not make a phone immune to loss, fraud or exclusion; it separates the right to prove a fact from the right to control the underlying medical record.

Comparing Credential Models

Health officials evaluating these options need to compare trust, convenience and failure modes rather than treat decentralisation as a universal upgrade. A strong design often combines a conventional clinical database, signed digital credentials and reliable fallback procedures.

Credential model	Where trust sits	What the verifier receives	Main advantage	Main limitation
Centralised portal	Agency database and user account	A record returned by the service	Familiar administration and straightforward revocation	One breach may expose many records
Decentralised credential	Issuer signature and holder-controlled wallet	Selected attributes and proof of authenticity	The holder controls each disclosure	Key recovery and revocation require careful design
Paper or static document	Trusted issuer or inspection process	A document checked by trained staff	Works without connectivity or a specific app	Forgery, inconsistent checks and slow updates

Centralisation is not automatically unsafe, and decentralisation is not automatically private. A well-run agency portal can use strong access controls, while a poorly designed wallet can leak metadata through ordinary app permissions. The relevant questions are whether a verifier receives only necessary information, whether consent is meaningful, and whether a person can correct or withdraw an inaccurate claim.

A hybrid is often the most realistic path: clinical data remains with the authorised issuer, credentials are placed under the holder’s control, and border or workplace systems retain narrowly governed revocation channels. That balance can serve a vaccination centre and an international departure lounge without giving either the same access.

Australia’s Rules for Digital Health Proof

Australia already had legal and technical building blocks before the pandemic. The My Health Records Act 2012 established a national framework for health information, the Privacy Act 1988 governs many organisations handling personal information, and state and territory legislation governs public-health records. The federal Digital ID Act 2024 adds a framework for digital identity services, but a vaccine credential should not be treated as an unrestricted digital identity.

State implementation matters. New South Wales, Victoria and the Australian Capital Territory each used vaccination certificates during periods of restricted activity, while Queensland and South Australia approached border and venue rules differently. A national app would need common standards for identity matching, consent, expiry and revocation, while leaving clinical verification with the relevant state health authority.

Australia’s COVIDSafe app was central to the pandemic’s contact-tracing effort and later hosted access to the government’s International Travel Certificate. Its history illustrates the limits of a single national approach to sensitive mobile data, supporting narrow collection, voluntary participation and clear retirement of systems that do not earn trust.

Government buyers can require security assessments, supplier exit plans and interoperability with systems such as My Health Records. Procurement should avoid locking people into one wallet or preventing a legitimate document from being supplied when an app fails. Transparent audits and plain-language notices are essential because confidence in a credential depends on trust in the institution behind it.

Travel, Work and Everyday Australian Life

The most visible demand came from travel. During the pandemic, airlines and border authorities needed consistent evidence, and travellers in Sydney, Brisbane and Perth negotiated changing testing and vaccination rules alongside ordinary check-in queues. Domestic flights also became a common setting for checking credentials, even when international restrictions were stricter.

Workplaces and hospitality created different demands. A small café in Melbourne or a large event venue in Sydney may need to confirm a status quickly rather than inspect a long medical record. This is where QR-based verification fits existing habits: many Australians had already scanned check-in codes, and venues knew how to post instructions and manage a queue when a phone cannot connect.

Local providers were active in this space. Australian health-application developers and identity firms experimented with wallets, e-certificates and integration services, while pharmacies and general practitioners became important sources of reliable vaccination data. The market lesson is that a credential is only one part of the service; issuer integration, customer support and recovery after a lost handset determine whether it works.

Risk information must travel with the credential. Reports of a new Southeast Asian variant showed how quickly local outbreaks could affect international travel policy. A passport should therefore carry clear validity and issuer information, while policies determine whether a particular status is accepted. The document proves a fact; it does not decide the risk.

Privacy, Security and Usable Design

The word decentralised can obscure a basic security requirement: the holder must know what the app does with their data. In a credible design, a vaccination event is signed by the authorised issuer, the app does not need a continuous location feed, and a verifier receives a bounded response. Devices should use encryption and strong authentication, while cryptographic keys need secure creation, storage and recovery.

Usability is equally important. Clear status screens, accessible text, local-language support and an offline fallback can prevent accidental disclosure and wrongful exclusion. The Chartres Cathedral light study demonstrates how deliberate visual framing can reveal an intricate building without concealing its structure. Credential interfaces need the same discipline, showing the issuer, validity and purpose before a person shares anything.

Independent governance can strengthen these controls. Publish the credential schema, test the verifier, disclose retention rules and involve privacy, health and disability representatives in review. Australians who cannot use a smartphone, read English comfortably or meet a digital-identity standard must retain a dignified alternative. A system that works only for the digitally confident will widen gaps rather than remove them.

Building a Trusted Australian System

Australia does not need a new identity system for every public purpose. A focused approach would begin with defined cases: international travel, aged-care admission, workplace safety or access to a large event. Each has a different need for detail, so minimum disclosure should be written into the rule rather than inferred from whatever an app can technically reveal.

The next step is an interoperable trial involving state health authorities, national standards bodies, airports, healthcare providers and consumer advocates. Participants should test lost phones, changed surnames, incorrect records, revoked credentials and temporary internet outages. Results, including security findings and failure rates, should be public. That makes the rollout evidence-led rather than a faith-driven technology programme.

Existing infrastructure should anchor the work. A person could obtain a signed credential from a clinic or authorised pharmacy, store it in a familiar wallet, and prove it through a verifier used by airlines or venues. My Health Records can remain the clinical source where appropriate, while state health and privacy laws and the federal Digital ID Act set the guardrails. Success would mean accurate verification, fewer manual checks and a clear remedy when the system is wrong.