COMMISSION IMPLEMENTING DECISION (EU) 2021/2014

18.11.2021 | EN | Official Journal of the European Union | L 410/180 ---|---|---|--- * * * COMMISSION IMPLEMENTING DECISION (EU) 2021/2014 of 17 November 2021 amending Implementing Decision (EU) 2021/1073 laying down technical specifications and rules for the implementation of the trust framework for the EU Digital COVID Certificate established by Regulation (EU) 2021/953 of the European Parliament and of the Council (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (1), and in particular Article 9(1) and (3) thereof, Whereas: (1) | Regulation (EU) 2021/953 sets out the EU Digital COVID Certificate the purpose of which is to serve as a proof that a person has received a COVID-19 vaccine, a negative test result or has recovered from infection for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic. ---|--- (2) | In order for the EU Digital COVID Certificate to be operational throughout the Union, the Commission adopted Commission Implementing Decision (EU) 2021/1073 (2), laying down technical specifications and rules to populate, securely issue and verify EU Digital COVID Certificates, ensure the protection of personal data, lay down the common structure of the unique certificate identifier and issue a valid, secure and interoperable barcode. ---|--- (3) | Many Member States have already announced or have already started to administer COVID-19 vaccine doses additional to the standard primary vaccination series, that is, the vaccination series intended to provide sufficient protection at an initial stage, notably to persons who may not have responded adequately to the primary vaccination series, and are considering ‘booster’ doses for people who responded adequately to primary vaccination. In this context, the European Centre for Disease Prevention and Control published, on 1 September 2021, interim public health considerations for the provision of additional COVID-19 vaccine doses (3). ---|--- (4) | On 4 October 2021, the European Medicines Agency’s Committee for Medicinal Products for Human Use concluded that an extra dose of the COVID-19 vaccines Comirnaty and Spikevax may be given to people with severely weakened immune systems, at least 28 days after their second dose (4). The Committee also evaluated data for Comirnaty showing a rise in antibody levels when a booster dose is given approximately 6 months after the second dose in people from 18 to 55 years old. On the basis of this data, the Committee concluded that booster doses for Comirnaty may be considered at least 6 months after the second dose for people aged 18 years and older. As stated by the European Medicines Agency, public health bodies at national level may issue official recommendations on the use of booster doses, taking into account emerging effectiveness data and the limited safety data. The product information of Comirnaty (5) and Spikevax (6) have been updated accordingly to include these recommendations. ---|--- (5) | To avoid diverging, confusing or technically incompatible approaches among Member States, it is necessary to adopt uniform rules as to populating vaccination certificates referred to in point (a) of Article 3(1) of Regulation (EU) 2021/953 issued following the administration of such additional doses. ---|--- (6) | According to Article 5 of Regulation (EU) 2021/953, a vaccination certificate is to be issued after the administration of each dose, it is to clearly indicate whether or not the vaccination course has been completed, and it is to contain the number of doses administered to the holder. Pursuant to the Annex to that Regulation, a vaccination certificate is to include, as data fields, the number in a series of doses as well as the overall number of doses in the series. Any rules as to how to populate vaccination certificates issued following the administration of additional doses, adopted by means of an implementing act, are to comply with the requirements established by Regulation (EU) 2021/953. ---|--- (7) | Vaccine certificates issued for doses of the primary vaccination series should indicate full vaccination after the completion of the standard primary series even in cases where the later administration of additional doses is recommended. Vaccine certificates issued for additional doses administered after the standard primary vaccination series should indicate the number of doses administered to the holder, as provided for in point (b) of Article 5(2) of Regulation (EU) 2021/953, as well as the overall number of doses within the series, counting the primary vaccination doses as well as any additional doses. ---|--- (8) | Particular attention should be paid to the situation of vulnerable groups who may receive additional doses as a matter of priority. If a Member State decides to administer additional doses only to specific sub-groups of the population, it could consider issuing vaccination certificates indicating the administration of such additional doses only upon request and not automatically, given that Article 5(1) of Regulation (EU) 2021/953 offers Member States the possibility to choose between these two options. As long as additional doses are administered only to a specific sub-group of the population, persons belonging to that sub-group should not be required to produce the certificate indicating the administration of an additional dose when exercising their right to free movement during the COVID-19 pandemic, and could instead make use of the certificate received following the completing of the primary vaccination series. ---|--- (9) | At the same time, it is important that vaccination certificates issued to persons belonging to such groups following the administration of additional doses also correctly reflect the number of doses administered to them. Firstly, Regulation (EU) 2021/953 gives all persons a right to receive a vaccination certificate, indicating the number of doses administered to them, after the administration of each dose. Secondly, Member States may eventually limit the duration of acceptance, for the purposes of free movement, of vaccination certificates issued following the completion of the primary vaccination series, if scientific evidence becomes available that the protection afforded by the primary vaccination series wanes below a certain level after a certain period. Not giving vulnerable groups the opportunity to obtain vaccination certificates following the administration of an additional dose would require further administrative steps to obtain them when they become more important for their freedom of movement, and could thus result in obstacles thereto. ---|--- (10) | In addition, the rules for populating the EU Digital COVID Certificate should be further clarified. Specific value sets applying the established coding rules should be made publicly available. ---|--- (11) | To ensure the interoperability of the EU Digital COVID Certificate, a common coordinated data structure for the data to be included in certificates referred to in Article 3(1) of Regulation (EU) 2021/953 should be defined through the use of a JavaScript Object Notation (JSON) schema. ---|--- (12) | Implementing Decision (EU) 2021/1073 should therefore be amended accordingly. ---|--- (13) | The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (7) and delivered formal comments on 18 October 2021 (8). ---|--- (14) | In the light of the need for rapid implementation of the amended technical specifications for the EU Digital COVID Certificate, this Decision should enter into force on the day of its publication in the Official Journal of the European Union. ---|--- (15) | The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 14 of Regulation (EU) 2021/953, ---|--- HAS ADOPTED THIS DECISION: Article 1 Implementing Decision (EU) 2021/1073 is amended as follows: (1) | Article 4 is replaced by the following: “Article 4 The governance rules applicable to public key certificates in relation to the EU Digital COVID Certificate gateway supporting the interoperability aspects of the trust framework are set out in Annex IV.”; ---|--- (2) | the following Articles 5 and 6 are added: “Article 5 A common coordinated data structure for the data to be included in certificates referred to in Article 3(1) of Regulation (EU) 2021/953, using a JavaScript Object Notation (JSON) schema, is set out in Annex V to this Decision. Article 6 This Decision shall enter into force on the day of its publication in the Official Journal of the European Union.”; ---|--- (3) | Annex II is replaced by the text in Annex I to this Decision; ---|--- (4) | Annex III is amended in accordance with Annex II to this Decision; ---|--- (5) | the text in Annex III to this Decision is added as Annex V. ---|--- Article 2 This Decision shall enter into force on the day of its publication in the Official Journal of the European Union. Done at Brussels, 17 November 2021. For the Commission The President Ursula VON DER LEYEN * * * (1) OJ L 211, 15.6.2021, p. 1. (2) Commission Implementing Decision (EU) 2021/1073 of 28 June 2021 laying down technical specifications and rules for the implementation of the trust framework for the EU Digital COVID Certificate established by Regulation (EU) 2021/953 of the European Parliament and of the Council (OJ L 230, 30.6.2021, p. 32). (3) https://www.ecdc.europa.eu/en/publications-data/covid-19-public-health- considerations-additional-vaccine-doses (4) https://www.ema.europa.eu/en/news/comirnaty-spikevax-ema-recommendations- extra-doses-boosters (5) https://www.ema.europa.eu/en/documents/product-information/comirnaty-epar- product-information_en.pdf (6) https://www.ema.europa.eu/en/documents/product-information/spikevax- previously-covid-19-vaccine-moderna-epar-product-information_en.pdf (7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). (8) https://edps.europa.eu/system/files/2021-10/2021-0943%20Formal_comments_EUDCC_en.pdf * * * ANNEX I ‘ANNEX II RULES FOR THE PURPOSE OF POPULATING THE EU DIGITAL COVID CERTIFICATE The general rules concerning the value sets established in this Annex aim to ensure interoperability on semantic level and shall allow uniform technical implementations for the EU Digital COVID Certificate. Elements contained in this Annex may be used for the three different settings (vaccination/testing/recovery), as provided for in Regulation (EU) 2021/953. Only elements with the necessity of semantic standardisation through coded value sets are listed in this Annex. Translation of the coded elements into the national language are under the responsibility of the Member States. For all data fields not mentioned in the following value set descriptions, encoding is described in Annex V. If for any reason the preferred code systems listed below cannot be used, other international code systems may be used and advice on how to map the codes from the other code system to the preferred code system shall be put in place. Text (display names) may be used in exceptional cases as a backup mechanism when a suitable code is not available in the defined value sets. Member States using other coding in their systems shall map such codes to the described value sets. Member States are responsible for any such mappings. As some value sets based on the coding systems provided for in this Annex, such as those for vaccine and rapid antigen test coding, are changing often, they shall be published and regularly updated by the Commission with the support of the eHealth Network and the Health Security Committee. The updated value sets shall be published on the relevant website of the Commission, as well as on the webpage of the eHealth Network. A history of changes shall be provided. 1\. Disease or agent targeted/Disease or agent from which the holder has recovered: COVID-19 (SARS-CoV-2 or one of its variants) To be used in certificate 1, 2 and 3. The following code shall be used: Code | Display | Code System name | Code System URL | Code System OID | Code System version ---|---|---|---|---|--- 840539006 | COVID-19 | SNOMED CT | http://snomed.info/sct | 2.16.840.1.113883.6.96 | 2021-01-31 2\. COVID-19 vaccine or prophylaxis Preferred Code System: SNOMED CT or ATC Classification. To be used in certificate 1. Examples of codes that shall be used from the preferred code systems are the SNOMED CT code 1119305005 (SARS-CoV-2 antigen vaccine), 1119349007 (SARS-CoV-2 mRNA vaccine) or J07BX03 (covid-19 vaccines). A value set setting out the codes to be used pursuant to the code systems established in this section shall be published and regularly updated by the Commission with the support of the eHealth Network. The value set shall be extended when new vaccine types are developed and put into use. 3\. COVID-19 vaccine medicinal product Preferred Code Systems (in the order of preference): — | Union Register of medicinal products for vaccines with EU-wide authorisation (authorisation numbers); ---|--- — | A global vaccine register such as one that could be established by the World Health Organisation; ---|--- — | Name of the vaccine medicinal product in other cases. If the name includes whitespaces, these shall be replaced by a hyphen (-). ---|--- Name of the Value Set: Vaccine. To be used in certificate 1. An example of a code that shall be used from the preferred code systems is EU/1/20/1528 (Comirnaty). An example of the name of the vaccine to be used as a code: Sputnik-V (standing for Sputnik V). A value set setting out the codes to be used pursuant to the code systems established in this section shall be published and regularly updated by the Commission with the support of the eHealth Network. Vaccines shall be coded using an existing code in the published value set, even if their names are different in different countries. The reason is that there is no global vaccine registry covering all vaccines in current use yet. Example: — | For the vaccine “COVID-19 Vaccine Moderna Intramuscular Injection”, which is the name of the Spikevax vaccine in Japan, use code EU/1/20/1507, as it is the name of this vaccine in the EU. ---|--- If this is not possible or advisable in a specific case, a separate code will be provided in the published value set. 4\. COVID-19 vaccine marketing authorisation holder or manufacturer Preferred Code System: — | Organisation code from EMA (SPOR system for ISO IDMP); ---|--- — | A global vaccine marketing authorisation holder or manufacturer register, such as one that could be established by the World Health Organisation; ---|--- — | Name of the organisation in other cases. If the name includes whitespaces, these shall be replaced by a hyphen (-). ---|--- To be used in certificate 1. An example of a code that shall be used from the preferred code system is ORG-100001699 (AstraZeneca AB). An example of the name of the organisation to be used as a code: Sinovac-Biotech (standing for Sinovac Biotech). A value set setting out the codes to be used pursuant to the code systems established in this section shall be published and regularly updated by the Commission with the support of the eHealth Network. Different branches of the same Marketing Authorisation Holder or the same manufacturer shall use an existing code in the published value set. As a general rule, for the same vaccine product, the code referring to its marketing authorisation holder in the EU shall be used, as there is no internationally agreed vaccine manufacturer or marketing authorisation holder registry yet. Examples: — | For the organisation “Pfizer AG”, which is an MAH for vaccine “Comirnaty” used in Switzerland, use code ORG-100030215 referring to BioNTech Manufacturing GmbH, as it is the MAH of Comirnaty in the EU. ---|--- — | For the organisation “Zuellig Pharma”, which is an MAH for vaccine Covid-19 Vaccine Moderna (Spikevax) used in the Philippines, use code ORG-100031184 referring to Moderna Biotech Spain S.L., as it is the MAH of Spikevax in the EU. ---|--- If this is not possible or advisable in a specific case, a separate code will be provided in the published value set. 5\. Number in a series of doses as well as the overall number of doses in the series To be used in certificate 1. Two fields: (1) | Number in a series of vaccine doses of a COVID-19 vaccine (N); ---|--- (2) | Overall number of doses in the vaccination series (C). ---|--- 5.1. Primary vaccination series Where the person is receiving doses of the primary vaccination series, that is, the vaccination series intended to provide sufficient protection at an initial stage, (C) shall reflect the overall number of doses of the standard primary vaccination series (e.g. 1 or 2, depending on the type of vaccine administered). This includes the option of using a shorter series (C=1) where the vaccination protocol applied by a Member State provides for the administration of a single dose of a 2-dose vaccine to persons having previously been infected with SARS-CoV-2. A completed primary vaccination series shall thus be indicated by N/C = 1. For example: — | 1/1 would indicate the completion of a primary single-dose vaccination course, or the completion of a primary course consisting of one dose of a 2-dose vaccine administered to a recovered person in line with the vaccination protocol applied by a Member State; ---|--- — | 2/2 would indicate the completion of a primary 2-dose vaccination series. ---|--- Where the primary vaccination series is extended, for example for persons with severely weakened immune systems or where the recommended interval between primary doses has not been respected, any such doses shall be encoded as additional doses falling under Section 5.2. 5.2. Additional doses Where the person is receiving doses following the primary vaccination series, such additional doses (X) shall be reflected in the corresponding certificates by increases in the number of doses administered (N) and overall number of doses (C) (resulting in (N+X)/(C+X)). For example: — | 2/2 would indicate the administration of an additional dose following a primary single-dose vaccination course, or the administration of an additional dose following the completion of a primary course consisting of one dose of a 2-dose vaccine administered to a recovered person in line with the vaccination protocol applied by a Member State; ---|--- — | 3/3 would indicate the administration of an additional dose following a primary 2-dose vaccination series. ---|--- Additional doses administered after the completion of the primary vaccination series shall thus be indicated by (N+X)/(C+X) = 1. Vaccination certificates issued by 31 December 2021 shall continue to be accepted even if such certificates follow a different rule for encoding the number in a series of doses or the overall number of doses in the series. To ensure this, technical measures may be taken. Within the legal framework established by Regulation (EU) 2021/953, Member States may take measures to address the situation of vulnerable groups who may receive additional doses as a matter of priority. For example, if a Member State decides to administer additional doses only to specific sub-groups of the population, it can choose, in accordance with Article 5(1) of Regulation (EU) 2021/953, to issue vaccination certificates indicating the administration of such additional doses only upon request and not automatically. Where such measures are taken, Member States shall inform the persons concerned accordingly, as well as that they may continue to make use of the certificate received following the completing of the standard primary vaccination series. 6\. Member State or third country in which the vaccine was administered/test was carried out Preferred Code System: ISO 3166 Country Codes. To be used in certificates 1, 2 and 3. Value set content: the complete list of 2-letter codes, available as a value set defined in FHIR (http://hl7.org/fhir/ValueSet/iso3166-1-2). If the vaccination or test was performed by an international organisation (such as UNHCR or WHO) and no information about the country is available, a code for the organisation shall be used. Such additional codes shall be published and regularly updated by the Commission with the support of the eHealth Network. 7\. The type of test To be used in certificate 2, and certificate 3 if support for the issuance of recovery certificates based on types of test other than NAAT is introduced through a delegated act. The following codes shall be used. Code | Display | Code System name | Code System URL | Code System OID | Code System version ---|---|---|---|---|--- LP6464-4 | Nucleic acid amplification with probe detection | LOINC | http://loinc.org | 2.16.840.1.113883.6.1 | 2.69 LP217198-3 | Rapid immunoassay | LOINC | http://loinc.org | 2.16.840.1.113883.6.1 | 2.69 8\. Manufacturer and commercial name of the test used (optional for NAAT test) To be used in certificate 2. The content of the value set shall include the selection of rapid antigen test as listed in the common and updated list of COVID-19 rapid antigen tests, established on the basis of Council Recommendation 2021/C 24/01 and agreed by the Health Security Committee. The list is maintained by the JRC in the COVID-19 In Vitro Diagnostic Devices and Test Methods Database at: https://covid-19-diagnostics.jrc.ec.europa.eu/devices/hsc-common-recognition- rat For this code system, relevant fields such as the identifier of the test device, name of the test and manufacturer shall be used, following the JRC structured format available at: https://covid-19-diagnostics.jrc.ec.europa.eu/devices 9\. Result of the test To be used in certificate 2. The following codes shall be used: Code | Display | Code System name | Code System URL | Code System OID | Code System version ---|---|---|---|---|--- 260415000 | Not detected | SNOMED CT | http://snomed.info/sct | 2.16.840.1.113883.6.96 | 2021-01-31 260373001 | Detected | SNOMED CT | http://snomed.info/sct | 2.16.840.1.113883.6.96 | 2021-01-31' ’ * * * ANNEX II Section 3 of Annex III to Implementing Decision (EU) 2021/1073 is replaced by the following: “3. General requirements The following overarching requirements shall be satisfied in relation to the UCI: (1) | Charset: only uppercase US-ASCII alpha numerical characters (‘A’ to ‘Z’, ‘0’ to ’9’) are allowed; with additional special characters for separation from RFC3986 (1), namely {'/','#',':'}; ---|--- (2) | Maximum length: designers shall try to aim for a length of 27-30 characters (2); ---|--- (3) | Version prefix: this refers to the version of the UCI schema. The version prefix is ‘01’ for this version of the document; the version prefix is composed of two digits; ---|--- (4) | Country prefix: the country code is specified by ISO 3166-1. Longer codes (e.g. 3 characters and up (for example, ‘UNHCR’) are reserved for future use; ---|--- (5) | Code suffix / Checksum: | 5.1 | Member States may use a checksum when it is likely that transmission, (human) transcription or other corruptions may occur (that is to say when used in print). ---|--- 5.2 | The checksum shall not be relied upon for validating the certificate and is not technically part of the identifier but is used to verify the integrity of the code. This checksum shall be the ISO-7812-1 (LUHN-10) (3) summary of the entire UCI in digital/wire transport format. The checksum is separated from the rest of the UCI by a '#' character. ---|--- Backwards-compatibility shall be ensured: Member States that over time change the structure of their identifiers (within the main version, currently set at v1) shall ensure that any two identifiers that are identical represent the same vaccination certificate/assertion. Or, in other words, Member States cannot recycle identifiers. * * * (1) rfc3986 (ietf.org) (2) For implementation with QR codes, Member States could consider an extra set of characters up to a total length of 72 characters (including the 27-30 of the identifier itself) may be used to convey other information. The specification of this information is up to the Member States to define. (3) The Luhn mod N algorithm is an extension to the Luhn algorithm (also known as mod 10 algorithm) which works for numeric codes and is used for example for calculating the checksum of credit cards. The extension allows the algorithm to work with sequences of values in any base (in our case alpha characters).” ’ * * * ANNEX III ‘ANNEX V JAVASCRIPT OBJECT NOTATION (JSON) SCHEMA 1\. Introduction This Annex establishes the technical data structure for EU Digital COVID Certificates (EUDCC), represented as a JSON schema. The document provides specific instructions related to the individual data fields. 2\. JSON Schema location and versions The authoritative official JSON schema for EUDCC is made available at https://github.com/ehn-dcc-development/ehn-dcc-schema. Other locations are not authoritative, but may be used for preparing upcoming revisions. By default, the current version as set out in this Annex and supported by all countries currently in production is shown under the indicated URL. Upcoming next version, to be supported by a defined date by all countries, is shown under the indicated URL through version tagging, described more specifically in the Readme file. 3\. Common structures and general requirements An EU Digital COVID Certificate shall not be issued if not all data fields can be correctly populated in accordance with this specification due to missing information. This shall not be understood as affecting the obligation of Member States to issue EU Digital COVID Certificates. Information in all fields may be provided using the full set of UNICODE 13.0 characters encoded using UTF-8, unless specifically restricted to value sets or narrower sets of characters. The common structure shall be as follows: "JSON": { "ver": <version information>, "nam": { <person name information> }, "dob": <date of birth>, "v" or "t" or "r": [ {<vaccination dose or test or recovery information, one entry>} ] } Detailed information on individual groups and fields is provided in next sections. 3.1. Version Version information shall be provided. Versioning is following Semantic Versioning (semver: https://semver.org). In production, it shall be one of the officially released (current or one of the older officially released) versions. See Section JSON Schema location for more details. Field id | Field name | Instructions ---|---|--- ver | Schema version | Shall match the identifier of the schema version used for producing the EUDCC. Example: "ver": "1.3.0" 3.2. Person name and date of birth Person name is the official full name of the person, matching the name stated on travel documents. The identifier of the structure is nam. Exactly 1 (one) person name shall be provided. Field id | Field name | Instructions ---|---|--- nam/fn | Surname(s) | Surname(s) of the holder. Exactly 1 (one) non-empty field shall be provided, with all surnames included in it. In case of multiple surnames, these shall be separated by a space. Combination names including hyphens or similar characters must however stay the same. Examples: "fn": "Musterfrau-Gößinger" "fn": "Musterfrau-Gößinger Müller" nam/fnt | Standardised surname(s) | Surname(s) of the holder transliterated using the same convention as the one used in the holder’s machine readable travel documents (such as the rules defined in ICAO Doc 9303 Part 3). Exactly 1 (one) non-empty field shall be provided, only including characters A-Z and <. Maximum length: 80 characters (as per ICAO 9303 specification). Examples: "fnt": "MUSTERFRAU<GOESSINGER" "fnt": "MUSTERFRAU<GOESSINGER<MUELLER" nam/gn | Forename(s) | Forename(s), such as given name(s), of the holder. If the holder has no forenames, the field shall be skipped. In all other cases, exactly 1 (one) non-empty field shall be provided, with all forenames included in it. In case of multiple forenames, these shall be separated by a space. Example: "gn": "Isolde Erika" nam/gnt | Standardised forename(s) | Forename(s) of the holder transliterated using the same convention as the one used in the holder’s machine readable travel documents (such as the rules defined in ICAO Doc 9303 Part 3). If the holder has no forenames, the field shall be skipped. In all other cases, exactly 1 (one) non-empty field shall be provided, only including characters A-Z and <. Maximum length: 80 characters. Example: "gnt": "ISOLDE<ERIKA" dob | Date of birth | Date of birth of the DCC holder. Complete or partial date without time restricted to the range from 1900-01-01 to 2099-12-31. Exactly 1 (one) non-empty field shall be provided if the complete or partial date of birth is known. If the date of birth is not known even partially, the field shall be set to an empty string "". This should match the information as provided on travel documents. One of the following ISO 8601 formats shall be used if information on date of birth is available. Other options are not supported. YYYY-MM-DD YYYY-MM YYYY (The verifier app may show missing parts of the date of birth using the XX convention as the one used in machine-readable travel documents, e.g. 1990-XX-XX.) Examples: "dob": "1979-04-14" "dob": "1901-08" "dob": "1939" "dob": "" 3.3. Groups for certificate type specific information The JSON Schema supports three groups of entries encompassing certificate type specific information. Each EUDCC shall contain exactly 1 (one) group. Empty groups are not allowed. Group identifier | Group name | Entries ---|---|--- v | Vaccination group | If present, shall contain exactly 1 (one) entry describing exactly 1 (one) vaccination dose (one dose). t | Test group | If present, shall contain exactly 1 (one) entry describing exactly 1 (one) test result. r | Recovery group | If present, shall contain exactly 1 (one) entry describing 1 (one) recovery statement. 4\. Certificate type specific information 4.1. Vaccination certificate Vaccination group, if present, shall contain exactly 1 (one) entry describing exactly one vaccination event (one dose). All elements of the vaccination group are mandatory, empty values are not supported. Field id | Field name | Instructions ---|---|--- v/tg | Disease or agent targeted: COVID-19 (SARS-CoV or one of its variants) | A coded value from the value set disease-agent-targeted.json. This value set has a single entry 840539006, which is the code for COVID-19 from SNOMED CT (GPS). Exactly 1 (one) non-empty field shall be provided. Example: "tg": "840539006" v/vp | COVID-19 vaccine or prophylaxis | Type of the vaccine or prophylaxis used. A coded value from the value set vaccine-prophylaxis.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) non-empty field shall be provided. Example: "vp": "1119349007"(a SARS-CoV-2 mRNA vaccine) v/mp | COVID-19 vaccine product | Medicinal product used for this specific dose of vaccination. A coded value from the value set vaccine-medicinal-product.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) non-empty field shall be provided. Example: "mp": "EU/1/20/1528" (Comirnaty) v/ma | COVID-19 vaccine marketing authorisation holder or manufacturer | Marketing authorisation holder or manufacturer, if no marketing authorization holder is present. A coded value from the value set vaccine-mah-manf.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) non-empty field shall be provided. Example: "ma": "ORG-100030215"(Biontech Manufacturing GmbH) v/dn | Number in a series of doses | Sequence number (positive integer) of the dose given during this vaccination event. 1 for the first dose, 2 for the second dose etc. More specific rules are provided in Section 5 of Annex II. Exactly 1 (one) non-empty field shall be provided. Examples: "dn": "1"(first dose) "dn": "2"(second dose) "dn": "3"(third dose) v/sd | The overall number of doses in the series | Overall number of doses (positive integer) in the vaccination series. More specific rules are provided in Section 5 of Annex II. Exactly 1 (one) non-empty field shall be provided. Examples: "sd": "1" (in case of a 1-dose primary vaccination course) "sd": "2" (in case of a 2-dose primary vaccination series or for an additional dose following a 1-dose primary vaccination course) "sd": "3" (e.g. in case of additional doses following a 2-dose primary vaccination series) v/dt | Date of vaccination | The date when the described dose was received, in the format YYYY-MM-DD (full date without time). Other formats are not supported. Exactly 1 (one) non-empty field shall be provided. Example: "dt": "2021-03-28" v/co | Member State or third country in which the vaccine was administered | Country expressed as a 2-letter ISO3166 code (RECOMMENDED) or a reference to an international organisation responsible for the vaccination event (such as UNHCR or WHO). A coded value from the value set country-2-codes.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) field shall be provided. Example: "co": "CZ" "co": "UNHCR" v/is | Certificate issuer | Name of the organisation that issued the certificate. Identifiers are allowed as part of the name, but not recommended to be used individually without the name as a text. Max 80 UTF-8 characters. Exactly 1 (one) non-empty field shall be provided. Example: "is": "Ministry of Health of the Czech Republic" "is": "Vaccination Centre South District 3" v/ci | Unique certificate identifier | Unique certificate identifier (UVCI) as specified in the https://ec.europa.eu/health/sites/default/files/ehealth/docs/vaccination-proof_interoperability-guidelines_en.pdf The inclusion of the checksum is optional. The prefix "URN:UVCI:" may be added. Exactly 1 (one) non-empty field shall be provided. Examples: "ci": "URN:UVCI:01:NL:187/37512422923" "ci": "URN:UVCI:01:AT:10807843F94AEE0EE5093FBC254BD813#B" 4.2. Test certificate Test group, if present, shall contain exactly 1 (one) entry describing exactly one test result. Field id | Field name | Instructions ---|---|--- t/tg | Disease or agent targeted: COVID-19 (SARS-CoV or one of its variants) | A coded value from the value set disease-agent-targeted.json. This value set has a single entry 840539006, which is the code for COVID-19 from SNOMED CT (GPS). Exactly 1 (one) non-empty field shall be provided. Example: "tg": "840539006" t/tt | The type of test | The type of the test used, based on the material targeted by the test. A coded value from the value set test-type.json (based on LOINC). Values outside of the value set are not allowed. Exactly 1 (one) non-empty field shall be provided. Example: "tt": "LP6464-4"(Nucleic acid amplification with probe detection) "tt": "LP217198-3"(Rapid immunoassay) t/nm | Test name (nucleic acid amplification tests only) | The name of the nucleic acid amplification test (NAAT) used. The name should include the name of the test manufacturer and the commercial name of the test, separated by a comma. For NAAT: the field is optional. For RAT: the field shall not be used, as the name of the test is supplied indirectly through the test device identifier (t/ma). When supplied, the field shall not be empty. Example: "nm": "ELITechGroup, SARS-CoV-2 ELITe MGB® Kit" t/ma | Test device identifier (rapid antigen tests only) | Rapid antigen test (RAT) device identifier from the JRC database. Value set (HSC common list): | — | All Rapid antigen tests in HSC common list (human readable). ---|--- — | https://covid-19-diagnostics.jrc.ec.europa.eu/devices/hsc-common-recognition-rat (machine-readable, values of the field id_device included on the list form the value set). ---|--- In EU/EEA countries, issuers shall only issue certificates for tests belonging to the currently valid value set. The value set shall be updated every 24 hours. Values outside of the value set may be used in certificates issued by third countries, however the identifiers shall still be from the JRC database. The use of other identifiers such as those provided directly by test manufacturers is not permitted. Verifiers shall detect values not belonging to the up to date value set and display certificates bearing these as invalid. If an identifier is removed from the value set, certificates including it may be accepted for a maximum of 72 hours after the date of removal. The value set is distributed from the EUDCC Gateway. For RAT: exactly 1 (one) non-empty field shall be provided. For NAAT: the field shall not be used, even if the NAA test identifier is available in the JRC database. Example: "ma": "344"(SD BIOSENSOR Inc, STANDARD F COVID-19 Ag FIA) t/sc | Date and time of the test sample collection | The date and time when the test sample was collected. The time shall include information on the time zone. The value shall not denote the time when the test result was produced. Exactly 1 (one) non-empty field shall be provided. One of the following ISO 8601 formats shall be used. Other options are not supported. YYYY-MM-DDThh:mm:ssZ YYYY-MM-DDThh:mm:ss[+-]hh YYYY-MM-DDThh:mm:ss[+-]hhmm YYYY-MM-DDThh:mm:ss[+-]hh:mm Examples: "sc": "2021-08-20T10:03:12Z" (UTC time) "sc": "2021-08-20T12:03:12+02" (CEST time) "sc": "2021-08-20T12:03:12+0200" (CEST time) "sc": "2021-08-20T12:03:12+02:00" (CEST time) t/tr | Result of the test | The result of the test. A coded value from the value set test-result.json (based on SNOMED CT, GPS). Exactly 1 (one) non-empty field shall be provided. Example: "tr": "260415000" (Not detected) t/tc | Testing centre or facility | Name of the actor that conducted the test. Identifiers are allowed as part of the name, but not recommended to be used individually without the name as a text. Max 80 UTF-8 characters. Any extra characters should be truncated. The name is not designed for automated verification. For NAAT tests: exactly 1 (one) non-empty field shall be provided. For RAT tests: the field is optional. If provided, shall not be empty. Example: "tc": "Test centre west region 245" t/co | Member State or third country in which the test was carried out | Country expressed as a 2-letter ISO3166 code (RECOMMENDED) or a reference to an international organisation responsible for carrying out the test (such as UNHCR or WHO). This shall be a coded value from the value set country-2-codes.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) field shall be provided. Examples: "co": "CZ" "co": "UNHCR" t/is | Certificate issuer | Name of the organisation that issued the certificate. Identifiers are allowed as part of the name, but not recommended to be used individually without the name as a text. Max 80 UTF-8 characters. Exactly 1 (one) non-empty field shall be provided. Examples: "is": "Ministry of Health of the Czech Republic" "is": "North-West region health authority" t/ci | Unique certificate identifier | Unique certificate identifier (UVCI) as specified in the vaccination-proof_interoperability-guidelines_en.pdf (europa.eu) The inclusion of the checksum is optional. The prefix "URN:UVCI:" may be added. Exactly 1 (one) non-empty field shall be provided. Examples: "ci": "URN:UVCI:01:NL:187/37512422923" "ci": "URN:UVCI:01:AT:10807843F94AEE0EE5093FBC254BD813#B" 4.3. Recovery certificate Recovery group, if present, shall contain exactly 1 (one) entry describing exactly one recovery statement. All elements of the recovery group are mandatory, empty values are not supported. Field id | Field name | Instructions ---|---|--- r/tg | Disease or agent from which the holder has recovered: COVID-19 (SARS-CoV-2 or one of its variants) | A coded value from the value set disease-agent-targeted.json. This value set has a single entry 840539006, which is the code for COVID-19 from SNOMED CT (GPS). Exactly 1 (one) non-empty field shall be provided. Example: "tg": "840539006" r/fr | Date of the holder’s first positive NAAT test result | The date when a sample for the NAAT test producing a positive result was collected, in the format YYYY-MM-DD (complete date without time). Other formats are not supported. Exactly 1 (one) non-empty field shall be provided. Example: "fr": "2021-05-18" r/co | Member State or third country in which test was carried out | Country expressed as a 2-letter ISO3166 code (RECOMMENDED) or a reference to an international organisation responsible for carrying out the test (such as UNHCR or WHO). This shall be a coded value from the value set country-2-codes.json. The value set is distributed from the EUDCC Gateway. Exactly 1 (one) field shall be provided. Examples: "co": "CZ" "co": "UNHCR" r/is | Certificate issuer | Name of the organisation that issued the certificate. Identifiers are allowed as part of the name, but not recommended to be used individually without the name as a text. Max 80 UTF-8 characters. Exactly 1 (one) non-empty field shall be provided. Example: "is": "Ministry of Health of the Czech Republic" "is": "Central University Hospital" r/df | Certificate valid from | The first date on which the certificate is considered to be valid. The date shall not be earlier than the date calculated as r/fr + 11 days. The date shall be provided in the format YYYY-MM-DD (complete date without time). Other formats are not supported. Exactly 1 (one) non-empty field shall be provided. Example: "df": "2021-05-29" r/du | Certificate valid until | The last date on which the certificate is considered to be valid, assigned by the certificate issuer. The date shall not be after the date calculated as r/fr + 180 days. The date shall be provided in the format YYYY-MM-DD (complete date without time). Other formats are not supported. Exactly 1 (one) non-empty field shall be provided. Example: "du": "2021-11-14" r/ci | Unique certificate identifier | Unique certificate identifier (UVCI) as specified in the vaccination-proof_interoperability-guidelines_en.pdf (europa.eu) The inclusion of the checksum is optional. The prefix "URN:UVCI:" may be added. Exactly 1 (one) non-empty field shall be provided. Examples: "ci": "URN:UVCI:01:NL:187/37512422923" "ci": "URN:UVCI:01:AT:10807843F94AEE0EE5093FBC254BD813#B" ’ * * *