Trust is everything in life. The most important decisions in life are based on trusting someone or something.
This is especially difficult when trust needs to be established quickly or between two parties that haven’t met before. In this case, keeping the chain of trust is key. Consider forensic evidence at a crime scene, it has to be protected from contamination and tampering at every stage of the investigation, from its removal, storage, examination, and even presentation in court. If you break the ‘chain of trust’ handeling the evidence, it could be inadmissible as evidence.
When we talk about health information, a trending topic nowadays, trust is needed at multiple stages in the data lifecycle, and technology can help to keep the chain of trust intact. Let’s see how that works when we talk about health passports and COVID test results:
- Patient-doctor/surgery trust. First of all the doctor trusts that you are really you! Either because they know you (personally) or you verified your identity when you registered in the surgery or hospital (there is a trusted process for that). From that moment the relationship between doctor/surgery and patient is based on bidirectional trust, some of it is also contextual as the doctor works in an environment where you are not admitted if you are not an authorized healthcare worker. In summary, a doctor trusts the patient is who they say they are and the patient trusts the doctor is the genuine doctor assigned to his/her case.
- Health institution-lab trust. When a patient requires treatment, a test, or vaccination. The procedure is booked or requested using a trusted tool, vetted, or even developed by the Government Health Body (that is the NHS in the UK, a US State, or a regional health system in Europe). There is a triangle of trust created between: the patient information held by the Health Body (including identity); booking information managed by the test center, surgery or the vaccination center, and eventually the lab performing the test. If you require (a PCR test for example), the test center, lab, or the vaccination center don’t need to trust the patient because the trust is already established and it is presupposed to be valid. Goodwill is also considered in this process (we assume a person will not get the vaccine on behalf of another person). That is not always possible in some countries.
- Trust of the Sample. When we talk about tests, the lab must trust that the sample sent by the test center or patient is from the right person because the process as defined by the health institution is trustworthy. The lab doesn’t need to know who the patient is, actually as the trust is already established, the lab must keep track of the sample id and make sure the result is linked to the correct sample, regardless of who the patient is.
- Trust the result of the test or vaccination attestation. The result of the test (or vaccination attestation) is usually sent via secure channels to the surgery or to the testing center that is handling a specific patient. The surgery-test center trusts the results as they come from a trusted lab and were already linked to the patient/sample. It is the same with vaccination. Vaccination centers are trusted so information obtained from them is trusted too.
- Delivery to patients. Finally, the surgery or health institution can create a paper results certificate that can be trusted by a third party (NHS branded paper, doctor name, and signature, lab name, etc.) The problem with this is the certificate is easy to forge or counterfeit. The chain of trust is broken and you need to return to the source to verify it again. The same problem occurs when you send the results or vaccination certificate by email or SMS. They can be copied or tampered with easily and trust in the entire chain is undermined.
Providing results on paper or sending results to the patient by email/SMS, weakens the chain of trust. You could easily create an email account pretending to be a lab and copy and paste the test results of the supposed patient. It is even easier with the SMS as the phone number or the name of the sender cannot be verified by a third party.
In summary, the moment the test result/vaccination record exits the chain of trust created between the health care stakeholders, they cannot be trusted by a third party. The patient will believe the result/record is genuine because they received the result in the context of the chain of trust previously mentioned. But that result cannot be used with third parties because third parties don’t know the contextual chain of trust in which all this occurred.
The solution to this is providing a secure way of delivering and verifying Covid related credentials. The chain of trust as we’ve seen is intact until the result is delivered to the patient. This is the part that needs to be strengthened. How? In my view, the best way is to deliver results/vaccination records is to have a secure digital wallet. The credentials are always delivered to the right person; stored in a bullet-proof wallet and are linked to their identity using facial recognition at the moment the credential is delivered.
By adding an encrypted QR code to the certificate, that anyone can read without compromising the security of the system, will help to multiply and facilitate the use of these credentials in the physical and digital world.
Folio is a natural extension of the ‘chain of trust’ as there is a biometrical link between the patient (part of the chain of trust) and the health records.
Third parties can trust the data inside the Folio wallet because they are the final link in a chain of trust that is kept intact thanks to secured delivery and storage.
