Coronavirus (COVID-19): mandatory vaccine certification proposals

Overview

COVID-19 case numbers remain high and the winter period ahead will pose significant challenges of increased transmission and related pressure on the National Health Service. (This paper should be considered alongside the latest State of the epidemic report (September 2021).

Action is therefore needed across all sectors to ensure compliance with baseline COVID-19 mitigations, and it is vital to consider further targeted and proportionate measures that can reduce risk further. Vaccine certification is one such measure.

This paper sets out our proposals for a mandatory domestic COVID-19 vaccination certification scheme (“the scheme”) in advance of the Parliamentary debate and vote on 9 September.

We will continue to gather evidence from around the world on certification schemes. This will continue to inform our approach in Scotland. We will also publish a full assessment of the evidence for certification, based on the four harms model that we have used throughout the pandemic, in advance of the scheme coming into force.

Parliament is being asked on 9 September to vote on the principle and broad outline of a mandatory scheme. It will then be required to approve the regulations to be made under the Coronavirus Act 2020.

Aim of the scheme

In line with our strategic intent to ‘suppress the virus to a level consistent with alleviating its harms while we recover and rebuild for a better future', a COVID-19 vaccine certification scheme will aid us in reducing the rate and impact of transmission.

Research evidence indicates that being vaccinated reduces the risk that a person will become infected with the virus, and likely further reduces their risk of transmitting coronavirus. Ensuring only those who are vaccinated attend higher risk venues and events therefore directly reduces the risk of transmission.

Where someone does catch the virus, being vaccinated significantly reduces the likelihood of serious harm or death and in doing so alleviate pressure on the healthcare system.

As a result, certification provides a targeted and proportionate means to reduce risk while maximising our ability to keep open certain settings and events where transmission is a higher risk.

In addition, the need to be vaccinated is expected to encourage the remaining sections of the eligible population yet to be vaccinated to take up the offer of the vaccine.

Scope of the scheme

The scheme will require a person seeking entry to certain venues and settings to show that they have been fully vaccinated. Fully vaccinated means vaccinated with a MHRA recognised vaccine in line with the MHRA recommended number of doses for the vaccine used and two weeks has passed for the vaccine to take effect

Initially, the scheme will not permit a negative test result to be offered as an alternative to evidence of vaccination, but this will be kept under review.  At this stage, we do not consider that this would be appropriate and, indeed, could undermine one of the policy aims of the scheme, which is to increase vaccine uptake. Also, it is important at this stage to prioritise PCR lab capacity for Test and Protect purposes and while promoting regular LFD tests is an extremely important aspect of our overall approach, further work would be required on an optimal approach to incorporating testing, including consideration of the appropriateness of self-testing in this context.

We are working with a range of stakeholders to finalise the design of the scheme. These stakeholders include local government, NHS Boards  and businesses/representative organisations in sectors that will be required to implement a certification scheme.

Timing

We intend the scheme to be ready to go live on 1 October 2021. This will give businesses time to prepare and more people to get vaccinated. It will also mean the scheme being introduced at the same time as the permanent digital solution for vaccination certification.

Exemptions

We are proposing the following exemptions:

• under 18s (we will keep the age under review and this is likely to be reduced to 16 once all in the 16-18 age group have had the opportunity to be vaccinated)
• participants in vaccine trials
• people unable to be vaccinated for medical reasons
• employees at venues within scope of the scheme

Medical exemptions

We are developing an exemptions approval process for medical exemptions. This will be finalised and published ahead of implementation.

It is estimated that fewer than 1 in 1,000 people (0.1%) of the population cannot be vaccinated for medical reason (distinct from those exempt due to age or participation in a clinical trial).  Reasons may include medical contraindications such as severe allergic reaction to vaccine and those receiving end of life care.

Work is ongoing with vaccination experts, clinicians, Public Health Scotland, GP representative bodies, Data privacy and NHS Boards to finalise the process that will enable those who need an exemption to receive it as quickly as possible while minimising the additional workload for already stretched NHS services including GPs, and in a way that is compatible with the human rights of those who may be entitled to exemption.

Settings

The scheme will apply only in the following higher risk settings.

• nightclubs and analogous venues
• sexual entertainment venues
• live events: indoors unseated 500+ in the audience
• live events: outdoors unseated 4,000+ in the audience
• all events: 10,000+ in the audience

For live events, ‘unseated’ includes events where some audience members are seated and some standing. ‘Attendees’ means the number of people attending the event. For multi-day events or events with different time slots – it is the number of people attending on any day or time slot. It does not include staff, contractors, performers or volunteers involved in the delivery of the event.

The scheme will be kept under regular review, with three weekly Parliamentary reviews. Any proposed changes to the settings of venues in which certification would apply will be brought back to Parliament for approval.

Definition of nightclubs

Nightclubs were not previously defined in the COVID-19 regulations, so the dictionary definition applied.  However, there is now a need to define nightclubs and other analogous venues, as behaviours that were previously prohibited are now allowed in wider parts of hospitality (for example, after midnight alcohol, loud music, dancing, and close contact for long periods). We are working with stakeholders to finalise a definition that will ensure the intended public health benefit, but not result in market distortion or displacement.

Public services

We have been clear that certification will not be a requirement for public services or other settings that people have no option but to attend, such as retail. There will also be exceptions for premises being used for certain purposes, including worship, protest and certain business events that individuals are required to attend for work purposes. 

The scheme will apply only to people attending the relevant premises/event as customers – it will not apply to those working or performing at the premises/event, as they will be working under health and safety guidance and specific mitigations set by their employer.

How the scheme will work

The detail of the scheme will continue to develop in a way that takes account of the view of businesses in relevant sectors. However, it will broadly work in the following way:

People will be able to access the NHS Scotland COVID-19 Status app. This will include a person’s vaccination record in line with the requirements for international travel.  The App screen shows a QR code for each vaccination. 

As is currently the case people unable to use the app will be able to request a secure un-editable paper record of vaccination, with enhanced security features such as thermodynamic ink to prevent forgery. This will also have a QR code.

The staff at a venue subject to the scheme will download a free QR code verifier app to a smartphone or device.  This will be available for download in week beginning 13 September. Detailed guidance is being developed for venues on how to use this verifier app, and the guidance will have accompanying privacy notices. The guidance will be developed in consultation with relevant venues/businesses.  There will also be options for venues to integrate the verifier functionality into their own systems as the source code is open source.

Venue staff check will check a customer’s QR code to ensure the record of vaccination is genuine.

As indicated earlier, there will also be a process to allow a person who cannot be vaccinated for medical reasons to show a document confirming that they are exempt.

Under 18s will be exempt. As with other, already existing age based entry conditions, a venue might ask for proof of age.

We are working with other UK jurisdictions to ensure interoperability across the UK as well as considering how evidence of vaccination for people from outwith the UK can be verified.

During the course of October, the App will receive an update that will add in additional functions for domestic certification.  In practice, this means that the app will have 2 sections – one for international travel which will contain the 2D barcodes currently in use which have been designed to meet international travel requirements - and which will be useable for domestic settings from 1 October - and one specifically for domestic settings which will contain a single 2D barcode, confirming an individual’s COVID-19 status as valid.

Regulations

Mandatory vaccine certification will be introduced in regulations under the Coronavirus Act 2020 and supported by guidance.  Relevant impact assessments, including an EQIA and BRIA, will be published.

Ministers must review the regulations at least every three weeks to assess whether any requirement in the regulations is still necessary to prevent, protect against, control or provide a public health response to the incidence or spread of infection in Scotland with coronavirus. As soon as Ministers consider the requirements to no longer be necessary for this purpose, they must be revoked.

Offences and enforcement

We propose that the regulations will be drafted to impose a legal obligation on the person responsible for operating the business or venue to ‘take all reasonable measures’ to restrict entry only to those fully vaccinated (unless exempt). We are also considering whether there is a need for offences with regard to the misuse of certificates by individuals.

We will publish guidance to help set out what ‘reasonable measures’ would be proportionate in different settings (for example, what is proportionate on entry to a nightclub of 200 people may not be proportionate – or possible – in an event crowd of 60,000).

Operational detail for each setting and sector

We are working closely and at pace with sectors to finalise a proportionate, effective and robust scheme for each setting before implementation. There are a number of operational and logistical issues which we are working through together.  The sector-specific detail will be published in advance implementation.

Costs

All software, apps and paper copies of certificates will be free to use.

Businesses will be able to use an app free of charge to scan the codes used on all certificates. Businesses will require a hardware mechanism (such as mobile phones) to verify the certificates. Any additional staffing or infrastructure costs will be met by businesses. While we do not underestimate challenges for businesses, it is important to recognise that vaccine certification is intended to be a proportionate alternative to the risk of further periods of closure for higher risk venues.

Security

Security of the COVID-19 certificates generated is critical. Security features on the App will include a process for user identification using suitable photographic ID, and user email verification. The certificates generated digitally on the App cannot be altered or changed.

The security of all COVID-19 certificates is aligned to the same standards used across the other 4 Nations for the generation of COVID-19 Certificates.

As part of the security of all certificates, the 2D barcodes (known as QR codes) have an expiry date and these dates are clearly displayed on the PDF downloads and paper copies. Once expired, users will have to request a further update to the certificate, either via the app or paper-based process. Expiry dates are used as part of the overall security of the system, and to help ensure that information is up to date.

Related items

• download the NHS Scotland Covid Status app or get a paper record of your vaccine status from NHS Inform
• businesses and event organisers vaccine certification scheme guidance
• customer vaccine certification scheme guidance