The Health Protection (Coronavirus) (Requirements) (Scotland) Amendment Regulations 2022 and The Health Protection (Coronavirus) (Requirements) (Scotland) Amendment (No. 2) Regulations 2022: equality impact assessment

NHS Scotland Covid App and paper certificate

On 30 September 2021 we launched the NHS Scotland Covid Status App (the "App") for international use. This contains two unique QR codes, one for each dose of the vaccine and since 13 January has included booster doses. This product has been designed for use for international travel and domestic use. To meet international travel requirements it is necessary to include full name, date of birth and details of vaccination to meet EU standards. This version of the App can be used to demonstrate vaccine status in the settings in scope.

On 20 October, the NHS Scotland Covid Check App, which is used by venues to check QR codes, was updated so that when an international QR code is scanned for domestic purposes only a green tick or 'Certificate not valid' is displayed, rather than a person's name, date of birth and vaccination details.

In order to further minimise data display, on 21 October, the Covid Status App was updated to include a domestic page. This option simply shows the person's name and a QR code. When the QR code is scanned by the NHS Scotland Covid Check App it shows either a green tick or 'Certificate not valid' representing someone's vaccination status. The domestic App has functionality to hide or display a person's name. The Privacy Notice can be found on NHS Inform: Personal information we process, How we use your data, Your Rights.

On 13 January the NHS Scotland Covid Status App was updated to reflect the Scottish Government's new definition of fully vaccinated. This means that anyone who has not received the booster dose within 120 days (four months) of completing their primary course will no longer be deemed to be fully vaccinated.

Many countries accept proof of a negative PCR test (valid for 72 hours in line with EU specifications) or recovery status (that you have tested positive for Covid within the past 180 days) as an alternative to vaccination and some countries request a third vaccine (booster) as proof of vaccination for international travel purposes. On 9 December the Covid Status App was updated to include recovery status, third dose of the vaccine and boosters. The paper and PDF certificates were updated to include evidence of an individual's last 2 doses of the vaccine on 13th December. Boosters were added to the app for domestic use on 13th January, boosters will show on the domestic page 10 days after received. Further development work will be required to update further information such as LFD negative test status in a future release of the App. In the meantime, customers can display an SMS (text) or email which records they have received a negative test. There is no QR code within SMS or emails and so they do not need to be scanned by the NHS Scotland Covid Check App. Venues will instead perform a visual check and no data will be retained. Individuals can get an SMS or email by registering the result of their LFD test test on the GOV.UK website.

The latest PHS report[67], published on Wednesday 19 January showed that, as of midnight 15 January 2022, the NHS Covid Status App has been downloaded 2,431,409 times. It is important to note a single user may choose to download the App on multiple devices, so this figure does not represent unique individuals. Between 03 September 2021 (introduction of QR codes) and midnight 15 January 2022, 715,974 paper copies of COVID-19 Status have been requested. This may not represent unique users if an individual requests a second copy (for example if they have lost their paper copy or needed to order a new one to refresh the QR codes after these have been updated). 1,736,949 PDF versions of COVID-19 Status have been downloaded. This provides a measure of the total number of times a new QR code has been generated via PDF. An individual can generate more than one successful QR code so the figure does not represent unique users. We continue to monitor user activity closely.

For those who do not have digital access or would prefer a paper copy, a record of vaccination can still be requested by phoning the Covid-19 Status Helpline on 0808 196 8565. The paper record of vaccination will then be posted to the address that is on the individual's GP records and held on the National Vaccination Service System (NVSS).

When registering an account on the App the user needs to verify their identity. This is for privacy protection as health data is special category data and protected by General Data Protection Regulations (GDPR) and human rights legislation (Article 8 right to respect for private and family life) and so additional safeguards and security measures are required to verify a person's identity before they are given access to their health records. This means users are asked to scan a photo of their passport or driving licence and then to take a live photo of themselves. The software then uses their live photo to compare likeness with the photo in their ID and confirm their identity. There is manual verification for the small number of cases which fail the automatic process. For the limited number of cases where a person's identity cannot be verified in the App, individuals can call the Covid-19 Status Helpline, or use NHS Inform to request a paper Certificate, which will be posted to them.

We continue to keep the ID Verification process under review. This includes consideration of alternative forms of ID that can be uploaded, such as PASS-accredited cards such as Young Scot and UKG issued immigration and asylum cards as an accepted form of ID. Broader use of National Entitlement Cards have been ruled out due to lack of relevant security features on the cards themselves.

Identity verification (IDV) is an important safeguard for people using the App to ensure that only the person themselves is able to access their vaccination record, which is part of their medical record. We carried out an options appraisal which concluded that facial recognition was the option that provided the highest degree of security. IDV information is only used to identify the person and ensure the requester of the Certificate is actually the person holding the device/phone. This data is not retained. Due to the need to develop the NHS Scotland Covid Status App quickly for international travel purposes and against a backdrop of rising cases and pending winter pressures on the NHS in Scotland, which meant the introduction of a domestic Covid Status Certification was likely, it was not possible to develop more than one IDV route for the App's introduction. Work is underway to put in place alternative IDV routes.

In addition the paper and PDF versions of the Certificate were already available for people to use, either if they are unable or unwilling to use the IDV route, so people are not excluded from accessing their medical data. The user pathway for these products is different for these routes, including using information in relation to the person's vaccination that it would not have been easily possible to replicate for the App. In addition paper Certificates are sent to the address the person is registered with at their GP.

Customers can display an SMS (text) or email showing they have registered a negative test. There is no QR code within SMS or emails and so they do not need to be scanned by the NHS Scotland Covid Check App. Venues will instead perform a visual check and no data will be retained. Individuals can get an SMS or email by registering the result of their negative LFD test on the GOV.UK website. If individuals undertake a PCR test they will automatically receive an SMS or email with the results.

The testing option requires people to have access to a standard mobile phone, mobile device or computer with an email address and access to a printer. This does not need to be a 'smart phone' and can be any mobile phone or tablet that can receive text messages or has access to email is sufficient. Test results can be displayed on a mobile phone, tablet or other device, or a paper copy can be printed using a home printer or using a service which provides printing facilities, such as a public library by the individual. In Scotland, it is estimated that 88% of households had internet access in 2019, however this varied by household net income and deprivation. The proportion of internet users reporting that they access the internet using a smartphone increased from 81 per cent in 2018 to 86 per cent in 2019 [68]

For those unable to test themselves, self-test LFD kits can be administered by others (such as a family member, friend, or carer) who can also register the result on behalf of the person they tested if they are also unable to do so. For those unable to display their test results (such as people who do not have a mobile phone) when registering their result they could have it sent to another person's phone, who could then show the result on their behalf.