w3c-ccg / vaccination-vocab

Vaccination Certificate Vocabulary for usage with W3C Verifiable Credentials

Vaccination Certificate Vocabulary

DRAFT / EXPERIMENTAL VOCABULARY

This specification describes a Linked Data vocabulary for asserting Verifiable Credentials related to vaccination certificates

Related Projects

The terms and definitions used in this vocab were in part inspired by the recent publication from the EU on the eHealth Networks guidelines on proof of vaccination for medical purposes.

Samples

To regenerate the sample W3C Verifiable Credentials that are using the defined vocabulary run npm i && npm run generateExamples

vaccination-vocab's Issues

vendor- and/or vaccine- and/or disease-specific examples should be genericized

COVID-19 and Moderna Biotech and the like should not be hardcoded into example data, any more than real people or real websites or real email addresses or real phone numbers.

All such things should be genericized and anonymized, as I tried to do in w3c-ccg/universal-wallet-interop-spec#61, but that was generated from here, so I'm here.

Add OWNERS

As per https://w3c-ccg.github.io/create_work_item.html

cc @mprorock @tplooker @OR13

Extent Scope of COVID Credential Vocab beyond Vaccination Proofs

Currently, work is being done on an interoperable solution and portable vocab for COVID vaccination proofs that can be implemented across industry sectors and country borders. It is expected that vaccination proofs might be required for getting access to facilities, services or public transport to reduce the risk of COVID infections and super spreader events.

However, is unclear if COVID vaccinated people can further spread the disease or not. For ethical, social and economic reasons, non-vaccinated persons should be offered services to prove that they are not COVID-infected at a given time. Because of these reasons COVID Test Passes (e.g. Lab PCR tests or Antigen Quick Tests) and Immunization Passes shall be added to the mix of required COVID credentials that might be required in a given jurisdiction to get access facilities, services or public transport.

This extension of COVID-related credentials is to avoid the aforementioned positive discrimination against vaccinated persons and to increase safety of facilities, services and events.

Policies and compliance requirements might depend on local regulations. For instance, some countries are discussing to introduce Antigen Quick Tests such as

1. Health Care Professionals Antigen Tests (HCP Antigen Tests)
2. Antigen Quick Tests under Supervision

HCP Antigen Tests are supervised by Health Care Professionals. Whereas Antigen Quick Tests under Supervision can be done in a retail store or at work and are supervised by qualified / trained personnel. These test passes might qualify for a give time frame to access facilities, services and events, aka Test Pass for 24 Hours.

Credentialing solutions for vaccinated and non-vaccinated persons require the introduction of a secure, verifiable test passport that is largely secured against forgery. When introducing such a solution, a balance must be struck between the objectives of speed, scalability, security and privacy. There are multiple implementation patterns to do this.

We suggest to take the above considerations into account and extent the scope of this COVID vaccination proofs to COVID credentials in general and to include further credentials such as PCR, antibody and antigen quick test credentials.

Update to define vaccine codification by { value, codesystem }

Not all sources will be offering pre-mapped vaccination codes to the codes of choice for this vaccination certificate. I'd prefer to leave the task to the verifier to understand source codifications as they have a vested interest in comprehending the codification. This is less effort for the sources, who may then offer the vaccines codified in their 'native' system. For Canada, that is generally the Drug Identification Number, or DIN with a code system as a HL7 FHIR URI. These DINs are resolvable to human-readable content via APIs that are managed by the Canada Gov and the CVC. Our sources of truth for vaccincation records in Canada do not generally store the WHO's ATC code, nor any other code than DIN, with some ICD and/or SNOMED-CT extension codes as exceptions.

Compaction does not compact "vaccine" and "recipient" keys

When compacting a JSON-LD document using this context, the credentialSubject.vaccine and credentialSubject.recipient are expanded. nextVaccinationDate is defined in a similar manner in the context, but does use the short form property name.

Is this intended?

Playground link: https://tinyurl.com/33xxeesz

{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://w3id.org/security/bbs/v1",
    "https://w3id.org/vaccination/v1"
  ],
  "id": "urn:uvci:af5vshde843jf831j128fj",
  "type": [
    "VerifiableCredential",
    "VaccinationCertificate"
  ],
  "description": "COVID-19 Vaccination Certificate",
  "name": "COVID-19 Vaccination Certificate",
  "credentialSubject": {
    "type": "VaccinationEvent",
    "https://w3id.org/vaccination#VaccineEventVaccine": {
      "type": "Vaccine",
      "atcCode": "J07BX03",
      "disease": "COVID-19",
      "marketingAuthorizationHolder": "Moderna Biotech",
      "medicinalProductName": "COVID-19 Vaccine Moderna"
    },
    "administeringCentre": "MoH",
    "batchNumber": "1183738569",
    "countryOfVaccination": "NZ",
    "healthProfessional": "MoH",
    "nextVaccinationDate": "1958-07-17",
    "https://w3id.org/vaccination#recipient": {
      "type": "VaccineRecipient",
      "birthDate": "1958-07-17",
      "familyName": "SMITH",
      "gender": "Male",
      "givenName": "JOHN"
    }
  },
  "expirationDate": "2029-12-03T12:19:52Z",
  "issuanceDate": "2019-12-03T12:19:52Z",
  "issuer": "replace_me"
}

COVID Credential Proposal - COVID 24h Test Pass

We propose to add a COVID Test Pass Credential to the repo.

The following example shall outline how a test pass credential can be structured. The structure is pretty similar to the vaccination proof schema.

It shall be understood that many test pass attributes are optional (i.e. not required in the respective schema). For instance, an Antigen Quick Test under Supervision might be done in a retail store and was therefore not done by a HCP. Also the level of personalization might vary by country and use case type (air plan flight vs. local restaurant visit).

Example:

{ "@context": [ "https://www.w3.org/2018/credentials/v1", "https://w3id.org/covidcredentials/v1" ], "type": [ "VerifiableCredential", "AntigenTestCertificate" ], "id": "urn:drk:af5vshde843jf831j128fj", "name": "COVID-19 Antigen Test Certificate", "description": "COVID-19 Antigen Test Certificate", "issuanceDate": "2021-02-19T12:19:52Z", "expirationDate": "2021-02-20T12:19:52Z", "issuer": "did:web:www.drk.de:center123:did.json", "credentialSubject": { "type": "AntigenTestEvent", "testCentre": "DRK123, Düsseldorf", "healthProfessional": "n/a", "countryOfTesting": "DE", "testedPerson": { "type": "TestedPerson", "givenName": "HANS", "familyName": "MUSTERMANN", "gender": "Male", "birthDate": "1973-05-18" }, "testResult": "negativ", "antigenTest": { "type": "Antigen Test", "disease": "COVID-19", "productCode": "09417125702", "medicinalProductName": "SARS-CoV-2 Rapid Antigen Nasal", "marketingAuthorizationHolder": "Roche" } }, "proof": { "type": "Ed25519Signature2018", "created": "2021-02-18T23:00:15Z", "jws": "eyJhbGciOiJFZERTQSIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..vD_vXJCWdeGpN-qKHDIlzgGC0auRPcwp3O1sOI-gN8z3UD4pI0HO_77ob5KHhhU1ugLrrwrMsKv71mqHBn-dBg", "proofPurpose": "assertionMethod", "verificationMethod": "did:web:www.drk.de:center123:did.json#z6MkiY62766b1LJkExWMsM3QG4WtX7QpY823dxoYzr9qZvJ3" } }

Add codification vaccine drug product identifier vs. generic ATC code identifier

The batch or lot number goes with a unique product (by identifier), not a vaccine classification like the ATC Code that describes the archetype or generic name of the vaccine (e.g. "COVID-19" being J07BX03) - often synonymous with the disease(s) being tackled. Rather than conflate generic concept codes with product identifiers, I would suggest creating a section in the VC called 'vaccine' that includes a product name, manufacturer and an identifier { value + code system } and disease. In addition, then use ATC Code or more generically another code system { value, system, name } to describe the disease(s) or generic name of the vaccine. The Lot number is part of the event data, but it must refer to a product not an archetype vaccine.

Example: In Canada, every approved product is assigned a Drug Identification Number. It must be paired with the Lot Number (sic batch Number) to provide a tractable administration of that vaccine/drug. Then you may want to convey the disease or generic name of the vaccine and that could be done with ATC Codes, ICD codes or commonly with SNOMED CT codes. Letting the audience know what code system is used for both the generic/disease(s) and the vaccine product would be useful.

As a principle, it would be my preference to let the verifier figure out the mapping form the source code system to their favourite target code system and relieve a burden from the issuing authority to map their source data to a specific code system in anticipation of a specific verifier's needs.

Remove Gender as PII

Gender, non-clinical as an attribute for personal identity is proving to be a weak and contentious identity attribute. For the context of vaccination records, the addiiton of gender could be misinterpreted as clinical gender, and may limit the gender codifications available. These limitations could impact the rights and freedoms of the individual to express their gender identity as they choose to. Gender is an old-school identity attribute and should be removed, or allowed to be omitted. It has no more or less value than offering hair colour.

Update Vaccine Terms to include ICD Codes

The WHO has an existing API endpoint that uses ICD-11 Codes to classify vaccines for certain conditions.

ICD API

ICD Vaccine documentation

ICD Api github examples

One more win we get by using ICD-11: the entire api already returns RDF or JSON-LD. See Content Negotiation for the format.

So the context here should at the minimum add a new term for ICD-11-Code and ICD-11-URI.
Additional suggestions for new terms to add to the context include older version of ICD:

• ICD-10-Code
• ICD-9-CM

Find replace schema.org http -> https

Schema for this VC

The current spec does not have a credentialSchema property. Can we add this please so that implementors can validate that any vaccination VC they receive conforms to the schema.

A related issue concerns other properties such as Terms of Use, or Evidence. What if an issuer wishes to include these properties as well? Can we have a schema definition that allows for these optional additions?

Update LICENSE.md to W3C License

As per https://w3c-ccg.github.io/create_work_item.html

Please find an example of it here: https://github.com/w3c-ccg/workitem-process/blob/main/LICENSE.md

Model omits dateOfVaccination

I am not seeing dateOfVaccination in the examples. This is a recommended value based on the WHO, and is material to the data about the administration event itself. Might be selectively redacted but the records include dates.

Address new work item questions (missed when work item was approved)

@tplooker when we approved this work item, we missed asking you to complete the new work item questions from 2.1.4: https://w3c-ccg.github.io/workitem-process/. I've copied them below for your convenience. Would you address these questions and add their answers to the repo readme? This helps folks unfamiliar with the project quickly understand what it is. Thank you.

1. Explain what you are trying to do using no jargon or acronyms.
2. How is it done today, and what are the limits of the current practice?
3. What is new in your approach and why do you think it will be successful?
4. How are you involving participants from multiple skill sets and global locations in this work item? (Skill sets: technical, design, product, marketing, anthropological, and UX. Global locations: the Americas, APAC, Europe, Middle East.)
5. What actions are you taking to make this work item accessible to a non-technical audience?