What seemed so impossible at the beginning of the pandemic is now real: vaccines are here, in record time. They bring much-needed hope to a holiday season shadowed by death and fear.

While authorities work out details for this mass vaccination campaign, though, the public is still waiting for answers to fundamental questions. Who gets the vaccine? Who will know if we’ve gotten it? Will workplaces, schools, or governments demand to see our vaccine records before letting us in? 

You may have heard about using “vaccine certification” or “immunity passports,” analog or digital tools to prove you’re vaccinated. Some experts champion them as a way to get back to normal life, while others warn about privacy risks and the potential for discrimination and abuse. 

These debates are mostly speculative, but underlying issues of privacy, verification, and ethical use aren’t unique to the vaccine. Governments and businesses already use covid-related records every day to make decisions about who can do what. Here’s what we know.

Vaccination records aren’t new, but there will be new ways to use them

There’s nothing revolutionary about needing to prove you’ve had a vaccine. Some countries require evidence of a yellow fever shot before you can clear customs, and many schools will not let you enroll your children in school unless they’re up to date on mandatory immunizations. Official tracking of who gets what vaccine is old news too. National and local governments around the world run registries where doctors send their vaccination records. 

But a lot is happening behind the scenes to expand these uses, some of it very quickly. Governments, airlines, employers, universities, and many other groups are intensely debating how and why people will need to show verified health records.

Some of the terms being thrown around are confusing, like “vaccine passport.” In some scenarios, your records might function like an actual passport—think of arriving at the airport in a new country, pulling out your smartphone, and scanning a digital record of your vaccination or negative test. But those records could also act like a work authorization at your job, or a pass to get into restaurants, bars, and shopping malls. 

Proponents argue that digital health credentials could help us get back to “normal,” but there are lots of roadblocks to making these ideas a reality, both on a medical and technical level.

Immunization doesn’t mean safety

While several vaccines appear highly effective at preventing symptoms of covid-19, we don’t know whether they stop people from catching and spreading the virus asymptomatically. Trials of the Oxford-AstraZeneca vaccine suggested it may limit transmission from asymptomatic carriers, but Pfizer and Moderna’s trials didn’t regularly test participants for the virus if they didn’t have symptoms.

More data is needed to prove conclusively that vaccination prevents you from giving covid-19 to other people, and how long immunity lasts. It’s also important to remember that what’s true for one vaccine may not be true for another. 

Without these crucial pieces of information, vaccination credentials only prove that you received a vaccine on a particular date—not that you do not have and cannot catch the disease. In the meantime, a negative covid test remains the best evidence that you’re not contagious. And since tests are far from perfect, you should still follow public health guidance about limiting spread whenever you can.

Digital records help combat fake information

There is already a booming black market in fake test results that is diminishing trust in printed records and driving demand for cheat-proof digital documents. 

Many governments, as well as airlines and other businesses are trialing or in talks to build “health pass” apps, which let users ask participating labs and health systems to send authenticated test results and other data straight to the app, bypassing verification concerns. 

There are a lot of players in the field, including IBM, the Commons Project, and the Covid Credentials Initiative. They’re coming at the problem from different angles but are ultimately chasing the same goal: let people share required information about their health, while protecting other private information. Yet it’s still too early to rely on any of these for a fast and widespread solution. 

Linking up systems is very difficult

Health-pass makers are mostly focused on test results for now, but any of those technologies could work just as well for vaccine records, if all the systems worked together.

Unfortunately, that’s a much bigger challenge than signing deals with a couple of big testing companies. Connecting any systems across borders means navigating a patchwork of languages, databases, and privacy laws. Even in the UK, where the National Health System maintains a database of vaccine recipients, the government has put any talk of vaccine “passports” on hold. 

Universal vaccine credentials may be close to impossible in the US, where patient data is fragmented across tens of thousands of health-care businesses. Forget digital interoperability standards—a lot of American doctors still rely on fax machines to send records. While most vaccinations are captured in state or local registries, using those databases for digital verification may face both legal and technological barriers.

No one solution will work for everybody

Even if these tools are built, blocking people from ordinary activities on the basis of their vaccination status brings up serious ethical and legal considerations. Screening people by vaccination status is hard when no country has made vaccination mandatory so far, and there are many cases in which people who might otherwise be eligible (for example, pregnant women or those who suffer from serious allergies) are discouraged from receiving the vaccine while more data is gathered.

Some people can’t or don’t want to use smartphones for their medical records, meanwhile. This may be especially true for those hardest hit by the pandemic, including elderly, homeless, and undocumented people. And given the challenges faced even by countries with significant resources, it’s hard to imagine every immunization clinic in the world handing out QR codes with their vaccines. 

Whatever the case, our regular lives are still a long way off

No matter how enthusiastic individuals and businesses are about using vaccination credentials or other verification to return to “normal,” there are many reasons to be skeptical of a high-tech solution. Even if all the necessary layers of digital and analog infrastructure do start talking to one another, we still don’t know whether vaccination keeps people around you safe. 

At this moment, we live in a world with one genuine piece of progress: vaccines created in jaw-dropping time. Vials of it are being packed onto aircraft and trucks that are delivering them to patients around the world. In the meantime, we wait. 

—Additional reporting by Mia Sato.

This story is part of the Pandemic Technology Project, supported by the Rockefeller Foundation.