How to Prove You're Vaccinated for COVID

You may need to prove your vaccination status for travel or work, or to attend an event. Paper credentials usually work, but a new crop of digital verification apps is adding confusion.

Retired Tennessee farmer Tom Anderson, 75, and his wife Barbara, 65, flew to Egypt in September to celebrate their 25th wedding anniversary on a Nile River cruise. After their plane arrived in Cairo, an Egyptian official demanded to see electronic proof of COVID-19 vaccination shown in a QR code.

“We had our actual (CDC) card, and they said, ‘Where are your QR codes?’” Barbara recalls. “And we said, ‘We don’t know what you are talking about.’”

Adds Tom: “We tried our best to reason with them, and they said, ‘No, you have to have the QR code.’”

Egyptian officials put them back on the next flight out en route to Memphis, where they arrived after 57 hours total for the round-trip travel. Apparently, the Egyptian rules had changed since the Andersons had prepared their paperwork, requiring electronic proof of vaccination.

Their story is an extreme one, but it shows how fluid and inconsistent the task of proving your vaccination status can be in a world where that particular piece of information is becoming increasingly important.

Depending on where you live, you may have to show that you are inoculated to keep your job, eat in a restaurant, attend a concert or ball game, work out in a gym, or travel. So it pays to have your credential at the ready.

The most obvious way to do this is with the CDC vaccination card that vaccine providers typically give out when you get your shot. But many employers and venues are encouraging workers and consumers to use digital verification apps, and some consumers may prefer not to carry their card everywhere, thus the appeal of a digital vaccine “passport” on your cell phone.

However, electronically answering what is basically a simple yes-or-no question has become surprisingly controversial, confusing, and time consuming. That’s because the rules vary by country and by state, with some states refusing to issue or even allow such a credential. Layered on top of that, different firms offer their own versions of COVID-19 vaccination passports.

“The U.S. is a mess, because there isn’t a centralized approach,” says Darren Toh, CEO of AOKpass, a Singapore-based company working with some American companies to verify that employees are vaccinated, as well as with some airlines.

“It’s baffling,” he continues. “The United States seems to be this unique bundle of chaotic people moving at different speeds and in different directions. You can juxtapose it with the EU response, which is quite centralized.”

Some U.S. cities, including New York and Los Angeles, are requiring vaccination for most indoor venues, but in most of the country, figuring out when you might need proof of vaccination is a confusing guessing game. For example, among amusement parks in southern California, Disneyland does not require a vaccine credential or recent COVID-19 tests, but Universal Studios Hollywood, 35 miles to the north, does.

“We’re stuck with this fractured, uneven, confusing system of ad hoc vaccine certifications, and we just have to struggle with it,” says Josh Michaud, PhD, the associate director for global health policy at the Kaiser Family Foundation. “Depending on where you live in the United States, you may have rules against using digital vaccine certifications . . . mostly Republican, mostly conservative states.”

“But for the other states, where it is an option, you do face a slew of different potential options,” he continues. “Once you explain all of that, you basically have confused the hell out of people.”

Given this reality, here are some insights on how to sort through the choices consumers have in order to prove that they are indeed vaccinated.

Having trouble sorting through vaccine verification options? Jump to our situation-by-situation guide, below.

First the good news: Your paper CDC vaccination card works in most places, whether you want to attend a basketball game, go to a concert, or visit a museum.

Chris Beyrer, MD, MPH, a professor of public health and human rights at the Johns Hopkins Bloomberg School of Public Health, carries his paper card in his wallet everywhere but acknowledges that relying on that document alone has downsides. “If you lose it or it’s destroyed, there isn’t necessarily an easy way to get it back,” he says.

Others might not want to carry that pesky card everywhere. Fortunately, a photo of both sides of the CDC card, kept on your phone or printed out, is typically accepted as evidence of vaccination. “In this case, more is more—as many forms of documentation as you can, the better,” Beyrer says.

At present, about 150 million Americans can also access digital proofs of their COVID-19 vaccinations, according to Vaccination Credential Initiative (VCI), a coalition of public and private organizations working on enabling standards for SMART Health Cards—a fancy-sounding term for digital medical records such as vaccine histories. (The records can also be printed out.) Its members include electronic health records companies Epic and Cerner, as well as Microsoft.

“A paper CDC card, as well as a photocopy, is not easily verifiable, can be misplaced, and is subject to forgery,” says Brian Anderson, MD, a VCI co-founder and chief digital health physician at MITRE, a government contractor that works on federally funded research. “Digital vaccination verification tools—like SMART Health Cards—contain a machine-readable QR code that provides for verification, is resistant to forgery, and can be easily re-obtained if a paper or digital copy is lost.”

Yet things become confusing when you try to figure out which digital credential you should use. Unlike a U.S. passport, which is the same for all Americans, a digital credential can come from one of many state or local entities, or dozens of private companies. But unlike regular passports, the vaccination credentials are free to individuals, with government or businesses bearing the cost.

Your first step should be to check whether your state issues COVID-19 vaccination credentials or works with an outside company. Among the states with their own vaccination verifications are New York and California, where 7.5 million residents had downloaded a SMART Health Card QR code as of early November, according to the California Department of Public Health.

VCI currently lists eight states as issuing their own SMART Health Cards. In theory, any state can issue electronic proof of your vaccination, or allow an outside company to do so, because all U.S. states maintain their own vaccine registries, as do New York City; Washington, D.C.; and San Antonio. The CDC maintains a list of links and contacts for these registries, known as Immunization Information Systems.

Los Angeles County and New York City (via Google Play or the Apple Store) also allow the vaccinated to download a credential that they sponsor.

“I’m not sure what the point of this app really is,” one user wrote in a Google Play store review of the NYC COVID Safe app. “You take a picture of your vaccine card and store it locally? You might as well just create a photo directory for your vaccine card. It’s exactly the same thing.” Spokespeople for the mayors’ offices in Los Angeles and New York did not respond to requests for comment.

Apple iPhone users with iOS 15.1 can also download verifiable credentials (as opposed to a simple photo of a vaccine card) to their Wallet or Health app. Google offers a similar feature for Android devices.

As if things were not confusing enough, MyIR, an app working with seven states—Arizona, Louisiana, Maryland, Mississippi, North Dakota, West Virginia, Washington, and West Virginia, as well as Washington, D.C.—announced in late October that digital vaccine credentials were being temporarily suspended (PDF). (Residents of these states can still obtain other digital vaccine credentials.) The problem is that MyIR aggregates data from various states and providers rather than directly on the behalf of each, according to VCI, the group working on standards for SMART Health Cards.

“Chaos is the right word,” says Mike Popovich, CEO of STChealth, which operates MyIR. “There seems to be a push for who controls the credentialing space, which I suppose is natural.”

Once you figure out which options are available in your state, it may take just a few minutes to get set up, but it is also possible that you may have to invest a bit of time to get your digital vaccination certification. State websites typically ask for name, date of birth, and mobile phone number or email address, but each system has its own quirks.

For example, North Carolina’s COVID-19 Vaccine Portal tells users to click ‘Forgot Your Username’ the first time they are accessing the system.

My own initial effort to download New York State’s Excelsior Pass failed, and the website directed me to call the pharmacy where I received my vaccinations. After two calls to CVS and 15 minutes on hold I was able to update the phone number they had on file. Then I logged back in to the Excelsior site and got an error message: “It seems like we’re having some issues behind the scenes preventing us from helping you.” I tried again some hours later and somehow it then worked.

Speaking in general about vaccine certification efforts, JP Pollak, co-founder of the Commons Project, a nonprofit group whose projects include a vaccination credential you can download via Apple’s App Store or Google Play, says, “We’re experiencing a lot of expected growing pains.”

Ramin Bastani, CEO of Healthvana, which provides digital COVID-19 credentials for Los Angeles County, says tiny differences in data can clog up the system. “It’s not a perfect process,” he says. “You may have registered in one particular area, and your name is James, but then somewhere else, you registered your name as Jim for that second shot. So those have to actually be matched in some way.”

I encountered more roadblocks when I tried to obtain additional proof of my COVID-19 vaccinations.

Electronic health records system Epic offers vaccination credentials to 64 million Americans through its MyChart system, and that number is set to raise to 100 million next year, according to implementation executive Nick Frenzer. But when I logged on to my account, MyChart showed just one of my two vaccinations. Frenzer later said there was a mismatch between the New York State registry and my healthcare provider’s record.

CVS, Walmart, and other large pharmacy chains also offer digital records from their websites. When I tried to download my vaccination record via the CVS website, I received a “PM2 error” message related to verifying my identity. Rather than invest time in untangling the problem, I gave up.

Adding to the confusion is the politicization of COVID-19 vaccinations and documentation, with 21 states, including Florida and Texas, banning vaccine passports altogether, according to the National Academy for State Health Policy, which maintains a map showing various state mandates and other COVID-related details.

“We are opposed to the idea of a national Green Pass on principle,” says Christina Pushaw, press secretary for Florida Governor Ron DeSantis. “COVID-19 vaccination records are private medical information. Proof of COVID-19 vaccination should not be required to participate in society, and the Green Pass creates a two-tiered society that we do not want to see in Florida.”

Green Pass is a system of vaccine credentials first used in Israel and then adopted in Europe and other countries.

The Florida governor’s office’s stance mirrors the sentiments of many Americans. For example, among Texans, 39 percent in August were strongly opposed to a vaccine passport, with only 33 percent strongly supporting the idea, according to a University of Texas at Austin poll. Some companies involved in COVID-19 vaccination documentation say privately that they have been subject to harassment or threats.

Nonetheless, residents of Florida, Texas, and other states that have banned vaccine passports may still have to prove their status outside their home states, especially when visiting cities with strict vaccine mandates for many public spaces. For example, anyone wanting to visit the Metropolitan Museum of Art in New York City must either show a CDC paper vaccine card or photo of it, New York’s Excelsior Pass, a New York City vaccination record or COVID-19 app, or an official record from outside New York.

What about those without proof of vaccine? “Visitors who cannot display their proof of vaccination are welcome to enjoy the Museum’s virtual offerings,” the museum says.

If you live in a state that does not offer digital credentials, see whether your pharmacy or electronic health system linked to your healthcare provider can provide you with a digital proof. Otherwise, carry your paper card when needed.

The simplest proof of vaccination—the paper CDC certificate—requires the least effort for the individual and may offer the most privacy. “Whoever is more concerned about privacy, going for the option that doesn’t require any scanning of a QR code is better,” says Lucy Yang, community director of the COVID Credentials Initiative. “But from a public health perspective, the options that don’t require verifications of a digitally signed credential are more prone to fraud.”

The cyber security firm Check Point has reported that prices for fake CDC cards have soared to as much as $200 each by early fall amid a boom in demand with the arrival of various vaccine mandates. States such as New York have warned against the use of fraudulent cards, and U.S. Customs and Border Protection has seized shipments of fake cards.

Companies that must verify many credentials often prefer digital COVID-19 vaccine certificates because they are quicker to scan. Some venues, including those used by sports teams such as the Las Vegas Raiders, Seattle Seahawks, Nashville Predators, and Golden State Warriors, have partnered with CLEAR—the publicly traded, for-profit company whose security screening stations you may have noticed in airport terminals. CLEAR is also accepted to prove COVID-19 vaccination status to enter Hawaii.

CLEAR does not have direct access to state vaccination registries, so they ask people to either upload their CDC card and information, scan QR codes issued by the states, or link to a vaccine provider or pharmacy that works with them.

Many healthcare experts think that a unified national system of COVID-19 vaccination credentials akin to the European Union’s Green Pass or similar programs in some Asian countries would be far easier and less confusing. “I think these kinds of small, ad-hoc approaches are likely fraught with problems,” says Beyrer at Johns Hopkins. “This is such a challenge, the way the country is divided among these political lines.”

With so many private companies and government agencies hastily developing digital vaccine credentials, some experts fear these systems will incorporate security and privacy vulnerabilities. What’s more, vaccine apps are typically not covered by federal laws restricting the release of medical information.

“Paper proof of vaccination raises fewer concerns, as does a digital photo of a paper card displayed on a phone screen,” the Electronic Frontier Foundation wrote in an August article. “Of much greater concern are scannable vaccination credentials, which might be used to track people’s physical movements through doors and across time.”

Kaliya Young, an expert on digital identity verification working on the COVID Credentials Initiative, is also concerned that the rush to digitize important documents—including health cards and electronic driver’s licenses—will result in faulty designs.

“I’m happy about the digitization—just not happy about the failure to be discerning in those choices pushed by health IT people who don’t care about privacy pushing static QR codes like SMART Health Cards,” she says. Young says static QR codes can easily be copied by anyone who has access to them, and perhaps used by someone who is not the owner. “We will be stuck with bad systems that have baked within them privacy-infringing defaults.”

The Electronic Frontier Foundation experts are also concerned that a company such as CLEAR could combine vaccination details with other personal information. “There is no logical limit to how centralized digital identifications like those created by CLEAR might spread into our lives by facilitating proof of vaccination, and with it new vectors for tracking our movements and activities,” the EFF team wrote in the August article mentioned above.

CLEAR spokesman Ken Lisaius says, “CLEAR does not sell or rent member information. Safety and security are at the heart of everything CLEAR does.”

One company, iProov, has developed a vaccine credential that relies on facial recognition technology. “Without it, a visitor would have to present a vaccine card and a form of ID, and wait while the door-person squints at them to see if the names match, and then at the person to see if they match the photo ID, a process that takes time and effort for everyone,” says Andrew Bud, iProov’s founder and CEO. “With face verification, they just present their card or QR code to the camera, look at it for an instant, and then walk on through.”

Privacy advocates have often expressed concerns about facial recognition, but to date the iProov vaccination verification system is not being used in the U.S., Bud said, and would be used only on a voluntary basis in any case.

The bottom line is that sorting through COVID-19 vaccination credentials involves some time and hassle. Find out whether you can get a vaccine credential through your state, the pharmacy or clinic that administered the vaccination, or your electronic health record system. Then find out what proof businesses require where you live, including activities such as going to the movies, visiting a museum exhibition, or traveling. And keep in mind that the rules today may be different next week.

Airline travel: Airlines must verify their passengers’ vaccination status for international routes, and different carriers offer the option of their own preferred digital verifications. American Airlines uses the VeriFLY app for this list of countries and Delta offers Delta FlyReady. United has its Travel-Ready Center. But you can usually use your paper CDC card for travel, as I have for the past half-year without issue.

The CDC guidelines for international travel start with the following warning: “Do not travel internationally until you are fully vaccinated.”

Employer verification: If your employer requires proof of vaccination, it will detail which documents they accept and how to submit them. Ford Motor Co., which recently announced a vaccine mandate for most of its workers, is collecting digital scans or photos of the CDC card, a spokeswoman said. Federal workers can submit a wider variety of documentation.

Venues: As highlighted throughout this article, different museums, concert halls, and other venues have different rules, and may sometimes be mandated by local rules in cities such as New York or Los Angeles. For example, the Getty Villa Museum and Getty Center in the Los Angeles area require vaccination proof or negative test and advance reservations; the Rock & Roll Hall of Fame in Cleveland does not ask for vaccination proof but requires advance online ticket purchase. The buildings of the Martin Luther King, Jr. National Historical Park in Atlanta are temporarily closed because of COVID-19.

“At this point it’s important for people to check with destinations well in advance to see what sort of proof is required,” says Pollak at the Commons Project. “We’re seeing requirements ranging from paper CDC cards to pictures of CDC cards to requirements for specific apps or QR code formats.”

Lining up your vaccine credentials is worth the effort because two years into the pandemic, COVID-19 is not expected to disappear overnight.

“I think that there’s going to be an ongoing need for this for quite a while as the pandemic is nowhere close to being done,” says Michaud at the Kaiser Family Foundation. “It might be something that we have to contend with here in the United States, at least for another year or so. And depending on circumstances, maybe even longer.”

Adam Tanner

Adam Tanner is a Consumer Reports contributing editor. He is also the author of “Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records” and an associate at Harvard's Institute for Quantitative Social Science.