Let’s talk about the certificate that can prove what’s in your blood to a stranger in another country — and never once asks you.
On the tenth of October the World Health Organization switched on its Digital Health Certification Framework. Plain version: a global standard for issuing, verifying and exchanging health credentials — vaccination status, test results, treatment records — as cryptographically signed certificates any participating country can check in seconds.
Opt-in, country by country. Built on open standards, verifiable credentials, decentralised identifiers. Deliberately no central database. A light implementation path for countries that can’t run the full build. Several European countries and Singapore have already linked their national wallets.
That’s the news. Here’s what it actually is in a life.
Four in the morning at Beitbridge. A truck driver has been in the queue since one, and he’s carrying a folder of paper: a discharge summary printed at a clinic in Polokwane, a lab result with a stamp on it, a photocopy of a photocopy. None of it is verifiable by the officer in front of him. So the officer does what officers do with paper he can’t check — he asks a question that has no answer, and the driver waits, and the queue behind him grows by another hour.
Now the same rail, run properly: the clinic issues a signed credential to the driver’s phone. The border scans it. Done. That is a real, boring, human improvement, and I’m not going to pretend otherwise.
Then picture the other end of the corridor. A patient on TB treatment moves from one province to another. His record doesn’t travel, so he gets tested again — same sputum, same lab, second time — because two systems don’t recognise each other’s results. Duplicate testing isn’t paperwork. It’s a delay in somebody’s treatment and a cost somebody has to eat.
So the plumbing is good. I like the plumbing. But look at what the certificate actually says.
A credential doesn’t say “this person is healthy.” It says “an institution I trust has made a claim about this person.” That’s the whole thing. It’s a statement about you, issued by somebody else, and verifiable without you being in the room. In a laboratory report that’s exactly right — the lab’s signature is the value.
Now swap the subject of the claim from a number to a person’s body, and ask where the person is.
The framework says the patient controls what gets shared. That’s the wallet doing its job. But controlling a share button is not the same as consent you can prove afterwards, and nothing in this rail forces anyone to ask. A border officer scans a credential and moves on. His system doesn’t record that the question was put to you, or that you agreed, or that you agreed only to this, only once, only today. Three months later nobody can reconstruct whether you chose any of it.
That’s the gap, and it isn’t a small one, because health data is the most intimate category we hold. It’s the one where the interesting parts are the parts you’d never post. A system that can verify the claim while forgetting the permission has automated the wrong half.
There’s a second thing sitting inside this, and it’s older than the WHO.
Governance here is national. The rail is global. Every country writes its own rules about who may read what, and enforces them on its own soil. That mismatch is where every surveillance expansion in history has lived: infrastructure with no borders, rules with a border, and a population that has to travel through both.
The people building this know it. The specification carries governance principles and audit requirements, and there’s dual-use language in the documents. But a principle is not a control. On the same day that a legitimate malaria certificate crosses a border in ninety seconds, so does something else — a portability layer that lets a state watch a population’s health at a resolution it has never had before. The certificate is neutral. The hand holding the scanner isn’t.
And then the gate closes from the other side.
Once signed credentials are the norm, the unanswered question flips. Right now the suspicious body is the unverified one in the queue. In two years the suspicious body is the one that can’t produce a credential at all. We did this with email — the moment signing became normal, unsigned mail started landing in spam, and it wasn’t a decision anybody made. It fell out of the standard. Passports went through it, bank cards went through it. A health credential is the first time the thing being verified is not your document but your body. Being unable to prove something about your own body becomes the risk.
Which brings me to the part that matters if you build anything in this space.
Put the permission inside the credential. Not next to it. Not in a policy document that lives in Geneva. Inside the artifact itself: who asked, what they were allowed to see, when, and a revocation that actually fires when you say stop. And design for selective disclosure from day one — prove the test result without shipping the diagnosis, prove the vaccination without shipping the reason you were in that hospital in the first place. A verified credential that leaks a condition is worse than the paper it replaced, because paper never sat in a wallet waiting to be read by six systems you never met.
If you’re on the other side of this — a patient, a driver, a person with a file — you don’t get to write the specification. But you can notice the difference between a credential that exists to help you move and one that exists to keep score. Ask who holds the issuer key. Ask what happens when you withdraw consent. Those two questions separate infrastructure from a leash.
The principle is plain. A certificate about your body should carry your permission and leave you the receipt. Not a checkbox hidden in a clinic intake, not a consent form in a drawer in a building you’ll never visit. A record of what was asked, what was shown, and who did the looking — one that belongs to you, and that you can take back.
Interoperable proof is worth building. It’s just not the same thing as consent. Build both, or you’ve only built the gate.
You’ve got this.