Earlier this year, Hong Kong was hard hit by the fifth wave of COVID-19, which affected daily life—increasing the risk of infection as people returned from aboard, and multiple businesses being negatively impacted. Under the premise of preventing and combatting the epidemic, the introduction of the Vaccine Pass was a key initiative that helped safeguard public health and safety—not only affording protection for every citizen in Hong Kong, but also helping the economy to get back on track.

The OGCIO team fully appreciates the overall anti-epidemic strategy and resolutely believes that the implementation of the Vaccine Pass is conducive to building an immunity barrier in the community and at the same time, is effective in breaking transmission chains as early as possible in the event of an outbreak; thus providing greater protection to the public.

The biggest challenge OGCIO faced in devising the implementation details was the consideration of the needs among different stakeholders, including the public and scheduled premises owners, while at the same time making the system as user-friendly as possible—so everyone could easily adopt it. During the implementation period, OGCIO continued to take on board the views of users and continuously refined the system and stepped up education efforts to ensure that the public understood and adhered to the arrangements.

A positive user experience is the key to any system’s success, and OGCIO achieved this through the use, and subsequent refinement, of the “LeaveHomeSafe” App to support the implementation of the Vaccine Pass. Over 8.2 million downloads of the “LeaveHomeSafe” App have been recorded and over 130,000 public and private premises have supported the arrangements. Members of the public are already very accustomed to scanning the “LeaveHomeSafe” venue QR code upon entry to scheduled premises. The development team further enhanced the “LeaveHomeSafe” App and user experience by enabling users to save different vaccine pass QR codes to be automatically displayed after users scan the venue QR codes to facilitate easy inspection by premises operators or law enforcement officers. OGCIO also developed a QR Code Verification Scanner (the Scanner) mobile app to help premises operators conveniently scan the vaccine pass QR codes presented by visitors and record their visit. The Scanner has enabled the public to access scheduled premises in a convenient and efficient manner—using just one single mobile app. To minimise disruption to scheduled premises, the Scanner also incorporates an automatic and continuous scanning function and a clear audible alert of the validity of the vaccine pass QR code so that premises staff can continue to perform other duties during the scanning process.

The Vaccine Pass leverages the latest technology to protect personal privacy during the QR code scanning process and, at the same time, enhances the tracking of any confirmed cases. The Scanner leverages hashing algorithms to record and “hash” each visitor's vaccine pass QR code data—encrypting the information so it cannot be recovered. This is a widely adopted approach in the information security sector, and security is further enhanced in the Scanner with digital signature technology deployed to verify the validity of each QR code.

To achieve a simple, smooth and efficient scanning process, OGCIO specifically designed a QR code using high-security encryption method known as “Elliptic Curve Digital Signature Algorithms” (ECDSA). The ECDSA is based on the Elliptic Curve Cryptography (ECC) encryption algorithm with much shorter key lengths than the more commonly used RSA and Digital Signature Algorithm (DSA)—while affording the same level of protection. To track close contacts of confirmed cases, the hashed data of visitors from each specific timeframe stored in the “LeaveHomeSafe” App is uploaded according to the instructions of the Contact Tracing Office (CTO) for rapid comparison with the database under the Centre for Health Protection to accurately identify visitors and their contact information—allowing prompt follow-up by CTO.

To tie in with different stages of the implementation of the Vaccine Pass, OGCIO launched extensive publicity campaigns through various channels including press releases, thematic websites, Facebook pages, YouTube channels and briefing sessions for different industries. Important points were also explained to the public through multimedia channels such as print media, posters, websites and video clips to help the public get used to using the Vaccine Pass to gain access to scheduled premises. Three webinars were organised in collaboration with the Food and Environmental Hygiene Department (FEHD), to explain in an innovative and interactive way the technical details of the Vaccine Pass, recommend tools, give operational demonstrations and address any questions from the participants.

The first phase of the Vaccine Pass was rolled out smoothly in February 2022, and OGCIO immediately prepared for the second and third phases. The Scanner was designed to automatically update the rule settings for checking visitors’ QR codes according to the requirements of different stages of the vaccination programme. Given that the requirements would need to be adjusted in regard to the latest changes of the epidemic situation, necessary updates to the Scanner required a fast and flexible approach. When the fifth wave of the epidemic was at its peak, the Government adjusted the scope of the Vaccine Pass and advanced the implementation date of the third phase to facilitate an early and effective response to the epidemic and, at the same time, encourage vaccination.

The OGCIO team was well prepared for such strategy adjustments, and added a registration function to the Scanner—enabling it to keep track of updates of the hundreds of thousands of scanner devices in use across the community—facilitating timely reminders for updates. Apart from solving technical problems, the OGCIO team is also required to take into account other challenges faced by venue operators, such as the additional cost of installing the Scanners, which could prove a burden for some small businesses. In light of this, the Scanner app was designed to be compatible with different mobile devices and could be used to scan with either front or rear cameras on such devices to provide greater flexibility in deployment. The team tested dozens of mobile phones (old and new) and tablet devices of different brands on the market to ensure compatibility and that the scanner app ran smoothly.

During the implementation of information systems, some degree of teething problems is inevitable, especially for applications that affect the daily lives of millions of people. For example, when an update of “LeaveHomeSafe” was launched in May 2022, a seemingly minor technical error on the part of the service contractor caused issues for a number of users. The previously saved vaccine pass QR codes were found to be missing after updating the app. Although the OGCIO team had already taken prompt follow-up action and launched a revised version within just a few hours, some members of the public were affected upon entry to scheduled premises. To assist those members of the public in need, the OGCIO team quickly established a dedicated “LeaveHomeSafe” hotline—2626 3066 and swiftly strengthened its frontline support staff resources to directly address public enquiries and give them advice on the use of the Vaccine Pass, as well as downloading and storing vaccination records and the QR code for recovered patients. During the initial implementation of the third phase of the Vaccine Pass, the hotline handled several thousand enquiries daily, almost all of which could be resolved immediately, and helped the public smoothly adapt to the arrangements.

OGCIO will continue to strive to provide timely technical support in the prevention and fight against the epidemic and will strive to ensure smooth operation of all anti-epidemic initiatives and systems for the convenience of the public and to safeguard the health of every Hong Kong citizen.