4 Questions to ask before any implementation of QR Codes for Covid Lab Reports

Rajesh Soundararajan
Jun 08, 2021
5 min read

A simple checklist for implementation

Ask yourself these 4 Questions

In our last post, we wrote about Integrating document security into COVID Test Reports and the integration challenges faced by Laboratories & Laboratory Information Systems (LIS) because of the surge in workloads.

Once we agree upon using QR codes and have crossed the first hurdle of figuring out the integration method depending on the systems and processes in use at the laboratory end, we get the next common question: “What implementation are options available”? There are four different questions to be answered to figure out the implementation option of QR codes for document security and verification.

   Verified By Authorised Apps Vs. Any QR Code Reader

```
   Offline Vs. Online Verification
```
```
   Cloud Vs. On-Premise
```

   All Covid Reports Vs. Travel Reports

1. Verified By Authorised Apps Vs. Any QR Code Reader

This is a crucial point - whether one wants universal scanning, which the name suggests is the ability for the QR code to be scanned with any QR code reader or if the scanning needs to be limited or done by authorised apps only. Universal scanning has its advantage, as people can use any QR reader on their phones. However, there is one significant disadvantage: the inability to build security in such QR codes. There is a high possibility of QR phishing. Moreover, many of these generic readers capture very sensitive personal data about the user, which is a privacy and security risk.

Scanning via authorised apps provides a simple solution that delivers the desired verification but is remarkably high security. A significant advantage of scanning via authorised apps is maintaining the privacy of the patient information and avoiding any legal issues whatsoever. Such an implementation also prevents QR phishing, which is rampant today.

Our recommendation: Go for authorised apps to scan to deliver decentralised verification while providing the highest level of security for your document.

2. Offline Vs. Online Verification

The other significant implementation decision you need to make is if your QR code validation should happen offline or online. Traditionally, online has been preferred for maintaining security, while the offline method is required in air-gapped environments and areas with flaky or unstable or zero internet.

The secure QR code technology works in both offline mode (through a self-contained code which we call PDC or primary data code at Qryptal) and online (through extended data codes or EDC). Offline PDC modes work well with COVID-19 test reports since these reports contain only textual information and are typically valid only for a few days, typically 72 hours. Hence they don’t need to be revoked or modified, which is a feature that EDC codes can handle. But is usually not required for this use case.

PDC codes work in air-gapped environments, for example, at immigration and border control. The verifier does not need to be connected online to check the document’s authenticity. Thus, such an implementation reduces the burden on your validation server. Moreover, the information is directly available on the document itself in both physical and digital format.

Our recommendation: Go for codes that support offline validation of complete details even in air-gapped environments with total security and privacy.

3. Cloud Vs. On-Premise

One of the initial decisions during implementation is whether you need to go for a cloud or an on-premise deployment. If you need the ease and speed of implementation and the ability to scale up and down as often as necessary, you should choose to go for a cloud implementation option. In cloud deployment, you would be relieved of the complexity of managing infrastructure, saving upfront investment in hardware & other costs, and IT personnel and support.

However, there might be situations where you already have a well-established IT infrastructure and personnel to manage any new systems, such as QR code integration. If that were the case, you could choose to go for on-premise deployment and optimise your infrastructure.

Our recommendation: Go for Cloud implementation that helps you start small and scale as per requirements.

4. All Covid Reports Vs. Travel Reports

And finally, one of the critical decisions on implementation that you would have to take is to have QR codes on all COVID-19 test reports or if you want to implement this only on Covid reports needed for travel and other specific purposes.

Today, we observe a constantly changing scenario of the needs of the airline industry and the immigration authorities. With rising cases of fraudulent documents, they randomly ask to look and crosscheck multiple documents to ensure the authenticity of the travellers COVID reports. If all your reports don’t carry the QR code, there is a good chance that some unscrupulous person can take the non QR coded report & modify it to dupe the authorities. Once it is known that all your Covid reports carry your QR (and a secure QR preferably), it is easy for the authorities to verify the authenticity. Hence it is prudent that you ensure QR code across all the documents you generate, rather than limit yourself to specific travel reports.

Our recommendation: Go for the ability to have secure QR on all COVID reports instead of being selective. That way, you maintain consistency while having in-built flexibility to take care of any fresh or changed requirements as you go along.

In summary, the implementation options can be listed below.

A Simple checklist to answer before implementation of QR codes

The Qryptal system offers the flexibility to implement QR codes for Covid reports depending on the answers to the above questions.

The two articles on integration and implementation will help laboratories make their Covid reports verifiable on-demand using QR codes and help their customers comply with the authorities’ requirements.

You may also be interested in -