Dissecting Alberta’s Vaccine Passport

By Joel Magalnick

Since Halloween’s coming in a few weeks, and all of the scary decorations are going up in our neighbourhoods, let’s talk about another frightening story: the rollout of Alberta’s vaccine passport. Just don’t call it a passport.
As any of us who has any desire to enter a restaurant or attend an Oilers pre-season game knows, we need this documentation of our vaccination (or a recent negative Covid test) to be allowed a seat. The rollout, as has been reported in several sources, has been confusing and not consistently applied. 

That’s a situation that can be scary, especially for the frontline workers required to enforce the regulations. Adding to that burden is the not-a-passport passport itself. Prior to the implementation of the current passport, Albertans attempting to retrieve their records had to wait more than an hour just to log in to the AHS website! Thankfully, the new system is lightning fast. Unfortunately, there’s little else good about it.

I put together this little case study for my user experience design students at MacEwan in the days following the passport’s release, which I’ll share with you as well. I won’t get into the visual design of the passport, but usability and the interface are key. 

Image source: albertavaccinerecord.ca and alberta.ca 

You can’t access the link to the passport download site, albertavaccinerecord.ca, from the Alberta.ca homepage—you’ll have to dig down two pages and toggle open a menu before you find it. I’d be willing to lay down money that nothing on Alberta.ca got as many hits as that page, so why bury it?
​
I got a look at the site a day before it went live, when it was in a “beta” phase (as much as you can do beta testing in two days), and I was wary. Was this some other entity that might be phishing for my data? We should be concerned that this provincially sponsored site isn’t a part of Alberta.ca. 

What protocols are in place to protect valuable personal health information?

I’ll admit that the thought behind the calendar plugin for selecting birthdate was nice. Typically when one of these datepickers gets dropped into a webpage, it defaults to the current date. Most of us weren’t born yesterday, so having to navigate back decades is a royal pain. Setting the default to 1980 was a nice touch to hit a broad swath of the population.

From there, however, things start to get ugly. Here’s the view from my phone:

Who can read this? Certainly not the bouncer who has to quickly scan multiple spots on each passport such as name, birthdate, and two vaccine dates. And it’s a PDF! What do you do with that on a phone? I took a screenshot, saved it to a new album in my photos, and turn my phone 90 degrees whenever someone needs to look at it. Not optimal.

And that brings up a much more important question: Would my technophobic 70-something father-in-law who has trouble figuring out how to silence his ringtone have the knowledge to go through all of those steps? Accessibility matters.

Far more useful would be a vertical view with a button to download or save in an image format like jpg or png with the most relevant information in boldface, kind of like this:

A few days after the release of this scary passport, local entrepreneur and developer Kyle Richelhoff built an app that generates a QR code where anyone enters a business utilizing the Restriction Exemption Program could scan and get the necessary information. Kyle told skeptical members of the Edmonton Startup Slack group that the app isn’t HIPAA compliant or tamper-proof, but he did his best to protect user information by not storing or logging data. “This puts the trust solely on me,” he wrote in a response to questions. 

While the idea and execution were solid, in looking at it from the perspective of the bouncer, I would want to know that I’m looking at this data from a trusted source. Anyone can make a web page and link it to a QR code. Though the app worked and got some early news coverage, it is no longer providing actual records. 
​
Which leaves us where we started. Unfortunately, as plenty of people including my coworkers and students have discovered,  the passports are not tamper-proof either. Anyone with a laptop and Adobe Acrobat can quickly forge anyone’s record. Now that’s scary.