Coronavirus (COVID-19): vaccine certification update - 23 September 2021

On 8 September 2021 we published a paper setting out proposals for a covid vaccine certification scheme.. This paper provides an update on the how the scheme will operate, following Parliament’s approval of the proposals on 9 September 2021 and further engagement with stakeholders.

Although we are seeing some welcome signs that COVID-19 case numbers are dropping, case numbers remain too high, and we still have a large susceptible population in which cases could increase again. In addition the number of people in hospital and ICU continues to increase.

The winter period ahead will pose significant challenges of increased transmission and related pressure on the National Health Service. (This paper should be considered alongside the State of the Epidemic report, published on 17 September 2021). We remain of the view that action is therefore needed across all sectors to ensure compliance with baseline Covid mitigations. Vaccine certification has a vital role to play as one such measure.

Regulations

Mandatory vaccine certification will be introduced in regulations under the Coronavirus Act 2020 and supported by guidance.  Relevant impact assessments, including an EQIA and BRIA, will be published.

Ministers must review the regulations at least every three weeks to assess whether any requirement in the regulations is still necessary to prevent, protect against, control or provide a public health response to the incidence or spread of infection in Scotland with coronavirus. As soon as Ministers consider the requirements to no longer be necessary for this purpose, they must be revoked.

We are working closely and at pace with sectors to finalise operational guidance for a proportionate, effective and robust scheme for each setting. We aim to publish draft guidance for business in the next few days.

Timing

The scheme will come into force on Friday 1 October (from 5 am). Therefore any events or settings that meet the criteria for certification will need to use certification from 5am on Friday 1 October 2021 onwards, until further notice.

Settings

The scheme will apply in the following higher risk settings:

• late night venues with music, alcohol and dancing 
• live events: indoors unseated 500+ in the audience 
• live events: outdoors unseated 4,000+ in the audience 
• all live events: 10,000+ in the audience 

For live events, ‘unseated’ includes events where some audience members are seated and some standing.

‘Attendees’ means the number of people attending the event.

For multi-day events or events with different time slots – it is the number of people attending on any day or time slot. It does not include staff, contractors, performers or volunteers involved in the delivery of the event

Late night venues with music, alcohol and dancing

By “late night venues with music and dancing” we mean any setting which meets ALL of the following criteria:

• is open at any time between midnight and 0500
• serves alcohol after midnight
• has a dance floor or other designated space for dancing; and
• provides live or recorded music, for dancing

If a venue ceased meeting any of those criteria, it would no longer require to operate with vaccine certification.

We consider this definition to be the most proportionate, following engagement with businesses and business sector organisations, and taking a range of factors, including the public health rationale and the risk of market distortion, into account.

A pub or restaurant that usually stays open past midnight, with music, alcohol and dancing, will be able to choose whether to continue to operate in a similar way to a nightclub, with certification. Alternatively, they can choose to stop the music or close the dancefloor after midnight, and operate without certification.

For venues that meet these criteria, the person responsible for operating the premises will be under a legal obligation to take all reasonable measures to ensure that, after midnight, only customers who are fully vaccinated or exempt are on the premises.

It will be for each venue to determine what measures to put in place, and whether certification should begin from the time the venue opens OR from the time the venue opens its dancefloor and provides music for dancing, based on a range of factors including the venue’s hours of operation and nature of business, Scottish Government guidance and advice from Local Authority officers (such as Environmental Health Officers (EHOs). The legal requirement will be that the business will have taken all reasonable measures to ensure that all people in the premise after midnight are fully vaccinated.

Exemptions and exceptions

The following people will be exempt:

• under 18s
• participants in vaccine trials
• people who cannot be vaccinated for medical reasons and
• people working or performing in the venues

There are a very small number of people in Scotland who cannot be vaccinated for medical reasons. Reasons include those medical contraindications including severe allergic reaction to the range of vaccines and those receiving end of life care.  A final decision has yet to be made although we are working on the medical conditions which would most closely be linked with an inability for a patient to be immunized.  There are a number of conditions which may render vaccination more difficult to attempt or complete – but it is important to be clear that for all but a very few vaccination offers hugely important protections.

We are using the same definition of ‘live event’ as we have used throughout the pandemic, but does not include:

• worship
• funerals, marriage ceremonies or civil partnerships and related post ceremony gatherings
• mass participation events such as a marathon, triathlon, or moonwalk
• a demonstration, protest or picket,
• a public or street market
• an illuminated trail,
• free events in public open spaces with no fixed entry points (for example a free firework display in a public park, or a common riding event, or a march or parade)
• certain business events that individuals are required to attend for work purposes (Only the core, essential business element of the event, including refreshment and meal breaks, will be excepted from certification. Any peripheral reception or function outside the core hours of the event would not be excepted, should it meet the criteria for certification, whether or not alcohol is served.)
• ‘closed door’ business or trade events, not open to the public for leisure purposes, will be excepted from certification, including refreshment and meal breaks during the day. This means that essential business events such as livestock markets will be excepted

Trade events attended by members of the public for leisure purposes, for example wedding fairs and craft fairs would not be excepted. The people working at the event would be excepted (such as exhibitors and venue staff) but certification would be required for the members of the public attending – but only if the event meets the certification criteria.

Obligations on the person responsible for operating the premises

Regulations will impose a legal obligation on the business, and on the person responsible for the business or organizing an event, to take all reasonable measures to ensure that only those fully vaccinated or exempt in settings where certification is required are on the premises and to have regard to guidance issued by Scottish Government. Guidance will help support the venue in coming to a decision on what is reasonable.

All businesses will be able to check vaccine certificates either visually or by scanning the 2D barcodes on the certificate (known as QR codes). Businesses will be expected to check as many certificates as they are reasonably able to.

For nightclubs and similar late night settings, and for smaller events, the expectation would be that a 100% check of every certificate should, in most cases, be reasonable. However, when the scheme first comes into force and is new to customers and businesses, we recognize that operators may need to take a graduated approach building up to 100% checks over the course of the first month of operation.  

For large events, organisers will be expected to carry out as many checks as is reasonably practicable, with regard to Scottish Government Guidance, advice from the relevant Local Authority officers and taking into account public order considerations. As with nightclubs and late night venues, however, when the scheme first comes into force and is new to customers and businesses, it may be reasonable to aim for as many checks as possible, with a view to scaling up to a larger proportion of checks over the course of the first month of operation.

What is reasonable should be assessed by businesses on a venue by venue and event by event basis. Each venue and event is unique, with, for example, different footprints and number of entry points. Scottish Government will provide guidance to Local Authorities and EHOs to support businesses or sectors to implement their plans.

We would ask business and EHOs to work with us to develop outline guidance including around the level of % checks deemed workable and robust for venues.  The % would be based on the number of entry/exit points, stewarding requirements and the associated costs, risk of congestion and risk to public order.  We would expect each business to set out and justify its own spot checking regime based on its risk assessment and show that it is taking all “reasonable practicable measures”, on the understanding that this may be scrutinised or challenged by enforcement officers. Guidance around data protection obligations is also being produced.

We will  ensure in regulations that Local Authority officers have the powers that they will need to enforce this scheme in a proportionate, risk based manner.

The regulations will set out that it is an offence for a person to operate premises without taking reasonable measures to restrict entry. We do not propose to impose new legal responsibilities on individuals or to create any new offences for individuals attending the event, but we will keep this under review. It is possible that an individual attending an event who presents falsified information may commit an offence under the existing law.

We would anticipate that as the system beds in and business/customers become familiar with it the number of checks will be increased without significant impact on business.  This will also support a  greater public health benefit over time. As we have seen in other countries we expect that the public and business will adapt quickly.

How the scheme will work

From 30 September people will be able to access the NHS Scotland Covid Status App. This will include a person’s vaccination record in line with the requirements for international travel.  The app screen shows a QR code for each vaccination with a dynamic image that prevents the use of screenshots.

As is currently the case people unable to use the App will be able to request a secure un-editable paper record of vaccination, with enhanced security features such as thermochromatic ink to prevent forgery. This will also have a QR code.

Anyone who already has a paper copy of their record of vaccination with a QR code on it can continue to use that record. In addition the downloadable PDF that is currently available will remain valid for a short period of time.

The staff at a venue subject to the scheme will download the NHS Scotland Covid Check App available via www.covidcheck.scot . This is a free QR code verifier app, to a smartphone or device from the Apple and Google store.  Guidance  on how to use this verifier app, and accompanying privacy notices has been published. Work is underway on a video that shows how the NHS Covid Check app will work and we will soon make this available.

This will be supplemented by guidance which is being developed in consultation with relevant venues/businesses and will be available before implementation.  There will be options for venues to integrate the verifier functionality into their own systems at a later date as the source code is open source.

No personal data is stored on the NHS Scotland Covid Check app.

Venue staff will carry out a visual check or check the customer’s QR code to ensure the record of vaccination is valid.

We are working with other UK jurisdictions to ensure inter-operability across the UK. Guidance will be issued on this, and on what evidence people vaccinated outside the UK will be required to provide, before implementation.

During the course of October, the NHS Scotland Covid Status App will receive an update that will add in additional functions for domestic certification.  In practice, this means that the app will have 2 separate sections – one for use when engaging in international travel which will contain the QR codes currently in use which have been designed to meet international travel requirements. The second section on the app will purely be for Covid Certification for use in domestic settings with an appropriate domestic QR code. This change will make it easier to show more appropriate vaccination information suitable for a domestic setting.

Costs

All software, apps and paper copies of certificates will be free to use.

Businesses will be able to use the NHS Scotland Covid Check App, available via www.covidcheck.scot

Businesses will require a hardware mechanism (such as mobile phones) to verify the certificates. Any additional staffing or infrastructure costs will be met by businesses.

While we do not underestimate the challenges for businesses, it is important to recognise that vaccine certification is intended to be a proportionate alternative to the risk of further periods of closure for higher risk venues particularly as we head towards the winter season where there is potentially more emphasis on indoor events due to the weather.

Security of the Covid certificates generated is critical. Security features on the Covid Status App will include a process (called onboarding) for user identification and verification, using suitable photographic ID (e.g. Passport, Driving Licence), and user email verification. The certificates generated digitally on the App cannot be altered or changed, and will be automatically updated in line with EU requirements.

The security of all Covid certificates is aligned to the same standards used across the other 4 Nations for the generation of Covid Certificates.

As part of the security of all certificates, the QR codes have an expiry date and these dates are clearly displayed on all Covid  certificates. Once expired, users will have to request a further update to the certificate, either via the app or paper-based process. Expiry dates are used as part of the overall security of the system, and to help ensure that information is up to date.