https://voluntarily.atlassian.net/browse/VP-1894
To enter a school site a volunteer must have a current COVID-19 vaccine certificate. (NZ COVID Pass). This is not optional under current (Traffic light) settings.
The Voluntarily Platform should aim to pre-validate volunteers to avoid inviting people who would not be permitted to attend and help to streamline any onsite processes.
Each school will probably have its own onsite procedure for scanning and checking the pass including:
Volunteer shows QR code on mobile or paper copy - scanned by mobile app and compared to volunteer’s ID.
Staff manually view the NZ COVID Pass - trusting it and comparing name to the volunteer/visitor.
The design of the NZ COVID Pass means that full confidence that the holder has been fully vaccinated occurs only if the the pass:
contains a data record that validates against the NZ govt signature public keys.
has not expired or been invalidated due to key changes
shows a name and dob that correspond to independent photo ID held by the visitor. e.g. Drivers Licence.
Manually viewing the pass is apparently allowed but this obviates any security and would only make sense if the pass holder had been previously fully verified. e.g a returning visitor or staff member.
Existing identity Verification.
Voluntarily.nz already provides mechanisms to validate the identity and police check status of potential volunteers. These are carried out with the support of a third party software service (CloudCheck) The identify verification process
Identity status is shown using icons on the website associated with a person’s username. A shield is shown with a popup hover box indicating the status e.g. email-verified. identity-verified etc.
When a opportunity has a specific requirement e.g. verified status, vaccinated status then volunteers are not given the option of volunteering on the site unless they have matching or better status. In addition the status of offering volunteers should be shown to the requestor/asker to allow them to confirm such status even if it is not set as mandatory.
In the case of schools events an NZ Covid Pass would only be required for volunteers attending in person and not for remote/video contributions hence the status is not generic to all school events - only those that are using in person volunteers.
NZ COVID PASS - Getting a pass
On completing vaccination a person can visit https://mycovidrecord.health.nz/ Here they have to register and login to gain access to their vaccination status.
The registration process requires signing up for a MyHealth account with the Ministry of Health
This account requires a validated identity. which is achieved either by providing identity documents (Passport, Drivers License) during the sign up process or by already having a validated RealMe Account
This online verification may be considered a high barrier to entry - its a complex process that requires showing documents to a mobile phone or laptop camera, or visiting a Post Office with documents. Many people will choose not to do this. However, as the covid pass is required to gain access to many events and venues we might reasonably expect our volunteers to have already taken this step. They will recognise the same process when we validate their identity.
Once signed in the person can view their vaccination status and request a pass. The pass is not downloaded - it is sent by email as a PDF attachment.
People can also request a copy of their pass on the phone 0800 222 478 and receive a physical (paper) copy to be sent in the mail. Pharmacies that are providing COVID-19 vaccinations can also help you request and print a My Vaccine Pass.
The pass looks like this. The QR code decodes to a JSON object containing name/dob, expiry and some metadata.
Pre Validating the NZ COVID PASS
We can use the existing validation records to hold the vaccination status for a volunteer. To obtain the status we must view in some form the NZ Covid Pass. Currently there is no centralised API available to check a status so the only option is to somehow read the pass via the Voluntarily website.
Reading via the camera
To read by the camera the website would need to run client side javascript that can
gain permission to access the camera
start the camera
prompt the person to position the QR code on the screen
capture the image and send for validation.
The Vaxx.nz group (walt, ilya etc) have a prototype web based validator. However there are problems.
iOS wallet display of the QR code is too small to read
error/fail rate is high.
Reading the PDF directly
To read the PDF the person can drag/drop or attach their pass to their profile. This can be uploaded in the same fashion as their avatar photo. On the server side we can open the PDF and try to identify the QR Code.
We should be able to find the image in the PDF ( or it is an entire image)
There’s a chance that the QR content is also placed in the PDF metadata. - check using a reader.
Cut and Paste from screen.
Similar to reading the Pdf but using screen tools to capture the qr code to the paste buffer and paste onto the website. - we recieve just an image stream. but complicated for the user.
Add Comment