Proof of vaccination

A vaccine certificate is an electronic record of your COVID-19 vaccination, including information about each dose, which can serve as your proof of vaccination. For individuals who are unable to receive the COVID-19 vaccine for medical reasons or who are participants in a vaccine clinical trial, a vaccine certificate can serve as proof of their exempt status. Vaccine certificates are used where proof of vaccination may be required to gain access to certain services or locations.

No. On March 1, 2022, the province lifted proof of vaccination requirements for all settings. However, the province has announced that businesses and other organizations may choose to continue to require proof of vaccination to gain access to their services or locations.

Businesses and organizations that wish to continue to ask for proof of vaccination may decide to verify vaccination status in the same way as they did when it was legally required in Ontario.

When proof of vaccination was required in Ontario, businesses and organizations required individuals to show a vaccine certificate with a QR code in paper form or downloaded to the individual’s smartphone, proving that they were fully vaccinated against COVID-19 (or exempt from vaccination). The vaccine certificate was required to be shown along with government-issued identification to allow the businesses and organizations to verify the identity of the vaccine certificate holder (photo ID was not required).

Businesses and organizations scanned the QR code using the government-issued Verify Ontario app, which displayed the individual’s vaccination status. Access to the premises was permitted where the individual’s vaccination (or exempt) status met the government criteria for full vaccination (or exempt status).

When the province lifted proof of vaccination requirements for all settings on March 1, 2022, the province also announced that businesses and other organizations may choose to continue to require proof of vaccination. Although the province has left the decision to the discretion of businesses and other organizations, these businesses and organizations must continue to comply with Ontario’s privacy laws, if they are subject to them, and other applicable laws and regulations including the federal Personal Information Protection and Electronic Documents Act. Ontario’s privacy laws apply to public institutions, health care providers, children’s aid societies, and other child and family service providers.

In the absence of a government mandate, businesses and organizations that choose to continue to require proof of vaccination will still have to determine whether they have the legal authority to do so. Businesses and organizations may need to seek independent legal advice to ensure that they are complying with privacy laws.

The IPC recommends that businesses and organizations that continue to require proof of vaccination will:

• Consider and confirm the legal authority relied upon for the continued requirement to provide proof of vaccination;
• Not use the vaccine certificate provided by an individual, or the proof of vaccination information it contains, for any purpose other than confirming that the individual is fully vaccinated against COVID-19 or is entitled to an exemption;
• Not retain, record, copy, modify, use or disclose any proof of vaccination information provided by an individual unless the use is solely for the above-stated purpose;
• Only collect, use or disclose as much personal information as needed to achieve the intended purpose; and
• Discontinue the requirement for proof of vaccination when the purpose of curbing the spread of COVID-19 no longer meets the necessity, effectiveness and proportionality test for the specific context in which vaccine certificates are being required.

In light of the ongoing use of vaccine certificates in some circumstances, the IPC understands that the province is continuing to provide individuals with vaccine certificates and continuing to provide the Verify Ontario app for businesses and organizations to use to verify an individual’s proof of vaccination.

For more information about full vaccination status, exemptions, and how to obtain a vaccine certificate visit the government of Ontario’s website.

The original government initiative was mandated under Schedule 1 to O. Reg. 364/20 of the Reopening Ontario (A Flexible Response to COVID-19) Act, 2020. Since this regulatory requirement has been lifted, businesses and organizations that choose to continue to require individuals to show proof of vaccination must determine whether they have other legal authority to do so. Businesses and organizations may need to seek independent legal advice to ensure that they are complying with applicable privacy laws.

The government consulted with the IPC throughout the development of its vaccine certificate program. Our feedback and guidance focused on ensuring that appropriate privacy and security safeguards were considered, both in the original vaccine receipt and with the enhanced QR code vaccine certificate. In addition, our office worked to ensure that the privacy principles set out in the joint statement by the federal, provincial, and territorial privacy commissioners on Privacy and COVID-19 Vaccine Passports were respected.

During the IPC’s consultations with the province, the government assured the IPC that the vaccine certificate program would be discontinued when it was no longer needed to meet the public health purpose of containing the spread of the COVID-19 virus, or, if necessary, would be restricted to specific purposes that continue to meet the necessity, effectiveness and proportionality test for the specific context.

The IPC remains committed to ongoing consultations with the province, as the pandemic and the need for proof of vaccination continue to evolve.

The QR code is part of the enhanced version of the vaccine certificate. It can be downloaded from the government’s proof of COVID-19 vaccination website.  If scanned with the Verify Ontario app, the QR code displays your full name and date of birth (for verification purposes) and your vaccination status.

The vaccination status display is based on a checkmark system (a green checkmark means your vaccination status is "verified,” a red X means the certificate is “invalid” or a yellow triangle, which indicates a technical or other error reading).

In its consultations with the Ontario government, the IPC worked to ensure that the enhanced vaccine certificate with the embedded QR code, if scanned with the Verify Ontario app, would not be used for tracking or surveillance purposes, marketing purposes or any purposes other than to verify your eligibility to access the specific business or setting. The IPC recommends  that businesses and organizations that choose to continue to require individuals to show proof of vaccination will not use the information in your vaccine certificate, including the QR code, for any purposes other than confirming that you are fully vaccinated against COVID-19 or are entitled to an exemption.

After March 1, 2022, the provincial government has stated that it will continue gathering high-level, aggregate data to assess the performance of vaccine certificates. This data includes how many certificates are downloaded from the provincial vaccine portal, the number of scans completed by the Verify Ontario app, the date and time of the scans, and the number of positive, negative and invalid scans. The government has informed the IPC that the data will not contain any personal information or geolocation data about the businesses or their patrons. More information about data collection is available in the Verify Ontario app privacy statement.

No. There is a difference between accepting health cards from individuals who voluntarily provide them for identification purposes and requiring individuals to produce their health cards. You can choose to use your health card as your government-issued identification. However, you cannot be required to provide it for this purpose.

For people who do not have a passport or a driver’s licence, a health card may be their only piece of government-issued identification. While health cards can be accepted as identification, a person or organization that is not a health information custodian must not record or copy the health number.

Under Ontario’s health privacy law, only a person or organization that provides a provincially funded health-related product or service can require you to produce your health card.

If there is an error on your vaccination receipt, including in your name or date of birth, contact your local public health unit or the organization where you received a COVID-19 vaccine to request a correction. In addition, you may also wish to contact the Provincial Vaccine Contact Centre at 1-833-943-3900.

You may request a correction to your health records if you have been granted access to the records and you believe they contain inaccurate or incomplete information. The custodian of your health records, such as a doctor, clinic, hospital, or medical officer of health at your local public health unit, must correct your health records if you can demonstrate that your records are incomplete or inaccurate and you supply the correct information.

The custodian might ask you to submit a formal request, in writing. You can either write a letter or fill out a form to request a correction. Once completed, submit the letter or form directly to the custodian. Depending on the circumstances, they have 30 to 60 calendar days to respond to your request.

Ontario’s health privacy law allows a custodian to correct your health records in response to an informal, oral request; but they can ask you to submit your request in writing.

Our office expects businesses and organizations subject to our jurisdiction to impose strict limits and safeguards on how vaccine certificates, and the personal information that supports them, are accessed, downloaded, validated, collected, used, and disclosed. Our office also expects businesses and organizations to comply with all applicable privacy laws.

The IPC consulted with the government to ensure the vaccine certificate contains the minimum amount of personal information necessary. For example, the enhanced QR code version of the vaccine certificate does not include any health card number data and, if scanned with the Verify Ontario app, displays the vaccination or exemption status based on a simple checkmark system.

The IPC encourages businesses and organizations that choose to continue to require individuals to show proof of vaccination to continue to use the Verify Ontario app as a privacy-protective measure when verifying an individual’s proof of vaccination. The IPC cautions businesses and organizations that other QR code-scanning apps may not have been designed with the same standard of privacy protection.

The IPC also recommends these businesses and organizations to follow the same general privacy principles and best practices as were required under the province’s program, and as discussed above.

Many of these concepts are reflected in the joint statement by the federal, provincial, and territorial privacy commissioners on Privacy and COVID-19 Vaccine Passports released in May 2021.

Transparency and accountability are vital to maintaining the public’s trust and confidence in the use of vaccine certificates. The public should know what information is being collected, how it is being used, who it is shared with, and what happens to it when vaccine certificates are no longer required. The government should continue to keep the public informed on the permitted uses of vaccine certificates as long as the certificates continue to be used.

If you believe that your personal information has been handled improperly by a provincial or municipal public sector organization or health information custodian, you can call our office at 416-326-3333, submit a complaint online, or mail a complaint to our office.

Businesses or organizations engaged in commercial activity in Ontario, for example restaurants and fitness facilities, are subject to the federal Personal Information Protection and Electronic Documents Act. If you have concerns about how a business or organization that is engaged in commercial activity is handling your personal information, you can report your concern to the federal privacy commissioner.

If you have concerns about COVID-19 vaccines or would like to learn more about them, contact your local public health authority.

We strongly recommend against posting your vaccine certificate on social media. Your vaccine certificate contains sensitive personal information (your full name and date of birth) and personal health information (your vaccination status). You should protect it in the same way you would protect any other piece of personal identification and never post it online or share images of it with others.

If you are downloading the vaccine certificate to your smartphone, you should make sure that you have a passcode to unlock your smartphone or other means to protect your smartphone from being accessed by someone else. You should store paper copies of your vaccine certificate carefully to protect them from theft, damage, or loss.