The health pass, and its most visible form, the QR code - digital version on the TousAntiCovid application or on a loose sheet - have become precious passes since June 2021. But above all, they are sacred "gruyères" for Doctor Jérôme Barrière, who recently discovered during an appointment that one of his patients was accompanied by a positive person.
“Basing everything on individual responsibility, there are holes in the racket,” breathes the doctor.
If this contaminated person was able to pass the door of his office, it is because his health pass was valid.
The information surprises even in the ranks of doctors, even more than six months after its entry into force in France: the pass, compulsory to go to the restaurant, to the cinema, and in all establishments and gatherings where the mixing of the public is “at risk”, remains active even if its holder tests positive for Covid-19.
User details, name of the vaccine, number of doses, date of the last dose… All of this so-called “static” data is contained on the QR code.
“When we scan the vaccine code, we retrieve the vaccine information, but without querying the database”, underlines a medical biologist with Le Parisien.
“At the server level, the vaccination (VAC-SI) and test results (SIDEP) databases are independent,” continues the expert.
These two files cannot intersect according to the law of May 11, 2020, recalls the Secretariat of State for Digital.
Problem for some doctors, it is possible to have a negative patient on Monday, then positive on Tuesday who will just have to present his negative test on Monday to go to the restaurant.
Two exceptions
The only cases in which the health pass can nevertheless be deactivated: if the positive person has himself scanned his test in the TousAntiCovid application.
For 11 days, the QR code is then inactive.
But here again, there is a parade: by presenting only your vaccination code during a check, the light turns green.
“From a health point of view, deactivating the QR Code is not recommended because there is a risk that vaccinated people will stop being tested in the event of symptoms or doubt, so as not to lose their pass”, specifies again the State Secretariat for digital.
Second scenario: some QR codes are however deactivated because fraudulent, and identified by the TAC Verif control application used in all places where you have to present your health pass.
A box "where you can store all your tests and traces of vaccine"
“The main hole in the racket of the application is therefore that it is not a real-time certificate of its Covid status, but a box where you can store all your tests and traces of vaccine.
We assume that it is linked to a fear of the executive of censorship by the Cnil, already that it was not easy just for SIDEP, or the constitutional council, ”points out the biologist.
"Everything relating to health data is sensitive", confirms Hicham Bouali, European technical director of One Identity, a specialist in identity and access management. “Today, we have a QR code for vaccination, another for the test. Now, do we want to continue this separation, or have a single QR? Today, what interests establishments is whether our health pass is valid or not.
With the vaccination pass adopted this Sunday, it will be necessary to be able to justify a complete vaccination status to access leisure activities, restaurants and bars, fairs or interregional public transport.
A negative test will no longer suffice, except to access health facilities and services.
Asked about a possible change in the functioning of the pass, the Directorate General of Health (DGS) did not respond to our requests.
