Re: [urn] Request for a Namespace Registration for Unique (Vaccination) Certificate Identifier

[Dirk-Willem van Gulik <[e-mail]>]

On 11 Aug 2021, at 19:41, Peter Saint-Andre <[e-mail]> wrote:
> On 8/11/21 5:25 AM, Dirk-Willem van Gulik wrote:
>> On 11 Aug 2021, at 01:07, Peter Saint-Andre <[e-mail]> wrote:
>>> On 8/1/21 7:37 AM, Dirk-Willem van Gulik wrote:
>> 
>>>> For this reason the design[2] calls for a Unique (Vaccination) 
>>>> Certificate Identifier (UVCI) that uniquely identifies a specific test, 
>>>> vaccination or recovery certificate. 
>> ...
>>> However, the foregoing paragraph seems to indicate that a URN would
>>> identify a test, vaccination, or recovery certificate. That could be
>> ....
>>> administered, etc.) - that is, not one URN per person encapsulating
>>> numerous events in an array or what have you. That also doesn't seem
>>> quite consistent with this later paragraph:
>>> 
>>>> The UVCI pertains to a specific (medical) record about a specific 
>>>> person’s vaccination, test or recovery at event level [1,2]. This 
>>>> record is subject to national legislation and regulation.
>>> 
>>> Could you clarify this aspect?
>> 
>> You are correct - this is wrong and badly written. 
>> 
>> It is an identifier  for a specific assertion (e.g. this person was 
>> vaccinated; this  person was tested) rather than something tied to 
>> the person; it is inside the elements of arrays of such assertions
>> about 'a' vaccination, test or recovery statement*.
>> 
>> We've tried to clarify this in the next version of the draft.
> 
> Thanks for the clarifications.
> 
> As I understand it, the URN identifies a vaccination event, a test
> event, or a recovery event. The URN itself does not associate the
> assertion with a particular person (there is no "person" construct built
> into the URN). For instance, if I get a test, that test is assigned a
> URN. If I receive documentation (physical or digital) of the URN that's
> been assigned and I present such documentation, the assocation comes
> from the fact that I'm the one presenting the documentation. Some other

Yes - -and- the fact that outside the data element(s)_ that the URN uniquely identifiers - there is some PII (name, DoB, but no things such as passport numbers) that is signed by the digital signature that is part of the QR.

So the structure is

      some meta data for the signature, version, etc
      . SIGNATURE over:
	... some issuance/expry(medical)/authority data
        ...... data about the bearer (DoB, Name, Transliterated name in ASCII)
        .... vaccination section
        ...... array of elements
        ......... vaccine used, brand, batch number, medical institution, # of doses, date, etc.
        ......... URN for just this element.
	....  test section
        ...... array of elements
        ......... est used, brand, medical institution, date, etc.
        ......... URN for just this element.
	....  recovery section
        ...... array of elements
        ......... medical institution, date, etc.
        ......... URN for just this element.
So indeed there is no URN for the person - nor is there one for this aggregation of elements. That said - at _this_ time - the only structure issued/permitted by the regulation is that of a SINGLE element with a Single section (Test Or Recovery Or Vaccination).

So it is easy to conceptional associate  or confuse the URN present within the structure with the entire record. 

> system (say, a medical records system) could formally associate that URN
> with some other identifier for me as a person within a given nation or
> region, but that kind of association is out of scope for the URN definition.
> 
> If this is correct, I think we could slightly adjust the wording to make
> it fully clear.

We'll try to update and will sent a version 3 once we have also done the other comments.

With kind regards,

Dw.