Google is working on a tool in Android capable of natively storing its vaccination certificates or test results. In short, it would be an alternative solution to TousAntiCovid to store your health pass.
What is “API Passes”?
Passes API, or API for Passes, is a tool developed by Google to save and use loyalty cards or boarding cards in a digital wallet. It could be the card from your supermarket or sports store, or it could be a plane ticket. The tool, which also offers to manage loyalty programs, is aimed at clubs, businesses, airlines, and banks.
With the coronavirus pandemic, the Passes API is evolving towards functionalities relating to the medical field. Indeed, it is a question of opening the API Passes so that the health pass can be stored there, whether it is a certificate of vaccination against Covid-19 or a negative test result. This is what the company states in a blog post published on June 30, 2021.
What information is stored?
Since it is a question of recording information relating to the vaccination of an individual (or the result of a test for infection with the coronavirus), the section must accommodate not only personal data, but also medical information: First and last name of the patient, date of birth and date of the injections, if it is a vaccination. The type of treatment will also be informed.
More technical and administrative information is also included: the identity of the manufacturer of the treatment (for example Pfizer-BioNtech), the authority issuing the certificate or the batch code, useful in the event of a hypothetical complication. This information is presented both in a format readable by a person, but also encoded in a QR code which can be read with a suitable reader.
What are its characteristics ?
According to Google, the use of the API Passes as a receptacle for the sanitary pass first allows the mobilization of an existing technical solution, requiring only a few adjustments. The section includes features for storing and sharing the health pass, and uses a shortcut on the smartphone’s home screen. Finally, measures exist to secure access to this health pass.
” A lock screen is required to store a Covid certificate on a mobile. This is for added security and to protect the user’s personal information. When a user wishes to access their Covid certificate, they will be asked to enter the password, PIN code or the biometric method configured for their Android mobile. “Writes the American company.
The tool does not need a connection. It is stipulated that ” the information contained in the user’s Covid certificate is not shared by Google with its various services or third parties and is not used for targeting advertisements “. The storage is local, which means that you will have to duplicate the certificate yourself, if necessary, on your other devices. Google claims to make no copies of it.
What advantages for the API Passes?
On paper, adapting the API Passes to the health pass has two big advantages:
- First, it relies on a native solution in Android, which does not require you to install any third-party application. The information can be integrated directly into Android, provided you have at least version 5 of the operating system, which has been available since 2014, and you have a Play Protect certified device.
- The other advantage is that this solution offers a globally standardized approach. Given the size of the Android ecosystem, we are talking about three billion devices in circulation, according to the latest statistics communicated by Google at a conference held in mid-May. For some countries, this may save the need to develop a dedicated application.
This process might remind you of something: this is exactly what happened in 2020 when Bluetooth contact tracing emerged. Several countries around the world have opted for the tool designed jointly by Google and Apple, including in Europe with Germany, Italy, the United Kingdom, the Netherlands, Switzerland, Ireland or the Country -Low. France, she had opted for a national protocol.
What about France?
Google’s tool is optional. Each country will do as it sees fit, but the tools are there: “ developers from healthcare organizations, government agencies and organizations authorized by public health authorities to distribute Covid vaccines and / or tests will have access to these APIs to create a digital version of information relating to vaccines or Covid tests “.
Will France be interested in API Passes for the health pass?
Nothing is less certain: first, because this solution is not yet available in France, nor anywhere. It must first be deployed soon in the United States, then in other countries, not named. Then, because the reasons of digital sovereignty which kept Paris away from the tool designed by Google and Apple concerning the tracing of contacts by Bluetooth should play again.
In addition, the tool imagined by Google would not be really useful, because France already provides its own “digital vaccine portfolio” via the TousAntiCovid application. This includes a section called “My notebook” in which you can save your test and vaccination certificates, with your personal and medical information, and the corresponding QR code.
It should be noted that it is also not mandatory to use TousAntiCovid to manage your test and vaccination certificates. These are available in PDF format on the Health Insurance website, in the personal account of each individual. They can then be printed to have them on paper or stored on the smartphone, either always in PDF or via a screenshot.
And at Apple?
If Google’s approach makes it possible to cover 80% of smartphones in circulation in the world – this is the market share that Android has in mobile phones – what about the remaining 20% with Apple and iOS? The Cupertino company is also involved in this field, according to documents consulted by Patently Apple and SecureIDNews. Nothing has yet been launched, but Apple can technically store health passes locally and securely, via the Secure Enclave and Wallet.