eHealth and COVID-19
The European Commission and the EU countries have defined a common approach for uniform and interoperable proofs of vaccination (vaccination certificates). The Commission and the EU members have also worked together for efficient contact tracing and warning apps.
EU Digital COVID Certificate
A EU Digital COVID Certificate is a digital proof that a person has been vaccinated against COVID-19, has recovered from COVID-19 or has a test result. The EU Digital COVID Certificate is therefore a name used to collectively refer to 3 types of certificates: vaccination, recovery, test.
As vaccination efforts are progressing in EU countries, vaccinated people need to receive proofs of vaccination, also called vaccination certificates, that are useful in healthcare situations, especially if a person uses services of different healthcare organisations, possibly in different countries.
In addition, they are useful for travel purposes in some EU countries that have established specific travel rules for vaccinated people. The European Commission and the EU countries have adopted guidelines on verifiable vaccination certificates. These guidelines aim to support interoperability of vaccination certificates and establish a minimum dataset, including a unique identifier.
Some Member States have established specific travel rules for people that have recently recovered from the COVID-19 disease. Instead of a test or vaccination certificate, such persons can be requested to present a recovery certificate.
In order to support interoperability and acceptance of recovery certificates issued by different EU countries, the eHealth Network has published guidelines on COVID-19 citizen recovery certificates, establishing a minimum data set for them.
Certificates for test results
Concerning certificates documenting test results, the Health Security Committee has adopted a common standardised set of data to be included in COVID-19 test result certificates. Test results are commonly requested by EU members as part of their free movement related arrangements, in order to prevent further spread of the virus and its variants.
Trust framework and detailed technical specifications
The eHealth Network has published detailed technical specifications describing mechanisms for the mutual recognition and interoperability of vaccination, test and recovery certificates (formats and trust management, gateway, 2D barcode, applications, public key certificate governance). In addition, detailed technical structure and value sets to be used in the contents of the EU Digital COVID Certificates are available. Reference implementations are available and have been published as open source.
The technical specifications have been officially adopted as a Commission Implementing Decision (EU) 2021/1073 of 28 June 2021.
Work has been conducted by the eHealth Network in collaboration with EU agencies, the Health Security Committee, the World Health Organization and other institutions. Further work is being conducted for the further deployment of the EU Digital COVID Certificate system in Member States. Collaboration with third countries and international organisations is continuing with the goal of enabling international interoperability.
The system is currently in use in all EU and EEA countries. Also Switzerland is participating to the system. However, also other countries may join the infrastructure after the adoption by the Member States of an implementing act (a so called equivalence decision). Such equivalence decisions are country-specific.
An equivalence decision establishes that COVID-19 certificates issued by a third country in accordance with standards and technological systems that are interoperable with the trust framework for the EU Digital COVID Certificate and that allow for the verification of the authenticity, validity and integrity of the certificate, and which contain the data set out in the Annex to the Regulation (EU) 2021/953 are to be considered as equivalent to certificates issued by Member States in accordance with the EU Digital COVID Certificates Regulation, for the purpose of facilitating the holders’ exercise of their right to free movement within the Union.
The process for joining is described in the Third Country COVID certificate Equivalence Decision Checklist complemented by three Annexes (Evaluation Checklist, Technical Procedure, Application Form). See also additional information on the recognition on EU-DCC and data protection.
- Datasets and value sets:
- Value sets
- JSON Schema for EU Digital COVID Certificates
- eHealth Network guidelines on verifiable vaccination certificates - basic interoperability elements
- Guidelines on COVID-19 citizen recovery interoperable certificates - minimum dataset
- A common standardised set of data to be included in COVID-19 test result certificates (adopted by the Health Security Committee)
- Interoperability of health certificates - Trust framework
- Detailed technical specifications for EU Digital COVID Certificates:
- Volume 1: formats and trust management
- Volume 2: EU Digital COVID Certificate Gateway
- Volume 3: 2D Barcode Specifications
- Volume 4: EU Digital COVID Certificate Applications
- Volume 5: Public Key Certificate Governance
- EU DCC Validation Rules
- Validation of EU Digital COVID Certificates in the context of air transport
- DCC anomaly capture process, best current practice
- Open source reference implementations (ongoing work)
- Template: paper version of the EU Digital COVID Certificate
- Third Country COVID certificate Equivalence Decision Checklist
- Additional information on the recognition on EU-DCC and data protection
Contact tracing and warning apps
Mobile contact tracing and warning applications can help reduce the spread of the SARS-CoV-2 and support the gradual lifting of confinement measures by:
- informing citizens if they have been in proximity of persons infected by the virus (for more than 15 minutes within less than 2 meters) and
- encouraging citizens to inform their health authorities and ask for support
The European Commission and the EU countries have set up an EU-wide system to ensure interoperability – a so-called ‘gateway’.
This allows Europeans to:
- travel with one single app within the EU, and
- be warned if they may have been exposed to COVID-19 through prolonged proximity to or close contact with someone who is infected
Contact tracing apps are voluntarily installed by citizens and are based on Bluetooth proximity technology that does not enable tracking of people’s locations.
These apps alert people who have been in close proximity to an infected person for a certain duration, so that they can take necessary actions to protect themselves and the people around them, for example, by self-isolating and getting tested. In this way, the infection transmission can be rapidly interrupted.
Nevertheless, app users’ privacy and data must be safeguarded. The national authorities will deactivate the apps at the end of the pandemic, and users are free to uninstall it at any time.
How does the interoperability system work
Users will only need to install one app and will still be able to receive an alert, even if they travel abroad. The gateway server will efficiently receive and pass on random identifiers between national apps thereby keeping the amount of data exchanged to a minimum.
Going forward, more and more European countries will get the opportunity to join the gateway by linking their national contact tracing and warning apps to the system, and by doing so, exploiting the full potential of such apps to break the chain of coronavirus infections across borders and to save lives.
To support the joint controllers in complying with their obligations under Article 35 of the GDPR, the European Commission has prepared a document providing information on the European Federation Gateway Service that can be used by the Member States as a component of their respective own Data Protection Impact Assessment for the exchange of personal data via the gateway. In order to protect the security of the processing of personal data, the part of the document describing implemented security measures is not disclosed.
Toolbox and interoperability guidelines
EU countries, supported by the Commission, adopted an EU toolbox on 16 April 2020 to use mobile applications for privacy-preserving contact tracing and warning in response to the coronavirus pandemic. On 13 May 2020, the EU countries, with the support of the European Commission, adopted interoperability guidelines for approved contact tracing mobile applications in the EU and on 30 June 2020 a set of technical specifications.
A key principle of the guidelines is that users should be able to rely on a single app wherever they are in the EU. The interoperability gateway service links national contact tracing apps’ backend, which ensures that apps work seamlessly in different EU countries. The modalities for the processing in the gateway are defined in the Commission’s adopted Implementing Decision.
- Press release: Coronavirus - EU interoperability gateway goes live, first contact tracing and warning apps linked to the system
- How tracing and warning Apps can help during the pandemic
- Mobile contact tracing apps in EU Member States
- List of National Joint Controllers
- Press Release: EC starts testing interoperability gateway service for national contact tracing and warning apps
- Questions and Answers: a common approach for safe and efficient mobile tracing apps across the EU
- Guidance on data protection
- Common EU toolbox for Member States
- All guidance and technical documents produced by the eHealth Network