The NHS App has quietly become a vaccine passport

England’s case numbers are soaring – and so are self-isolation notifications from the NHS Covid-19 app. This so-called ‘pingdemic’ has led some people – including Ryanair chief executive Michael O’Leary – to delete the test and trace app to try and avoid self-isolation notices entirely.

But, there is one app that is being loaded onto many people’s home screens: it’s the NHS App. Downloaded by 10.4 million people and used pre-pandemic to book GP appointments and access medical records, in recent months it has become the de facto digital passport to freedom, containing evidence of a person’s vaccination status, called the NHS Covid Pass.

The NHS Covid Pass – and the app that’s home to it – has quietly become a key tool for people looking to engage freely with society. (As well as being available in the app, you can also request a paper version from the NHS). The government’s own guidance, since England’s remaining restrictions were lifted on July 19, suggests it is “encouraging and supporting businesses and large events to use the NHS Covid Pass in high-risk settings” – and if that’s not enough, it “will consider mandating certification in certain venues at a later date.” From the end of September nightclubs and other large venues where people gather will only be allowed to accept customers who have received both jabs.

It’s a vaccine passport in all but name, and it’s your ticket to freedom. The fact that it’s presented as such may help explain why six million people have downloaded it in the last two months since a feature demonstrating a user’s vaccination status was added. Yet the government has repeatedly flip flopped on whether it would require and introduce vaccine passports, officially saying it had ruled out the idea. Instead, it’s encouraging businesses to press punters and staff for proof of their vaccination status through the NHS Covid Pass.

“As we cautiously reopen, the NHS Covid Pass will enable people to prove their vaccination status when travelling abroad and support venues and businesses to reopen safely, while protecting staff and the public,” health secretary Sajid Javid has said.

If you’re confused how the NHS App (with its included NHS Covid Pass) and the NHS Covid-19 App are different things, you’re not alone. But the reason that the Covid Pass – or vaccine passport, if you will – has been bundled into the generic NHS App alongside your other medical records may be because of the way the two apps are designed, reckons Eerke Boiten, cybersecurity professor at De Montfort University. “The NHS App is built to be extendable in this way, the NHS Covid App isn’t,” he says. “The NHS wanted to extend the Covid App to do a little more notification around venue check-ins, and that somehow got stopped by Apple and Google. It’s probably safe to assume that apps that use the Apple and Google API won’t be allowed to do anything additional in the way of processing of personal information.”

The kinds of data that proof of vaccination – or immunity of some sort – requires is probably why it hasn’t been bundled into the existing contact tracing app, reckons Phil Booth of medConfidential, a pro-privacy medical data lobby group. The NHS Covid Pass can be obtained for use in domestic events by having both doses of a vaccine more than 14 days ago, having a negative Covid-19 test within the last 48 hours, or a proven diagnosis of Covid-19 within the last 180 days that you’ve recovered from. For international travel, the only way to get an NHS Covid Pass is through vaccination. All of that is sensitive medical data. “The NHS contact tracing app doesn’t really know who you are, doesn’t care, and can’t touch your medical records,” Booth says. “However, the NHS app does if you’re using it to access your GP services. And you have to go digging in someone’s medical records to prove whether an individual has a higher bunch of antibodies in their system.”