Blockchaining the vaccine supply chain – from Vial to Arms to Certs

Estimated reading time: 3 minutes

You may have heard of  Malaysia’s vaccination management system (VMS) which was created to be able to track vaccines that were procured by the government. An oft-overlooked fact about it is that this system was built based on blockchain technology by MIMOS.

MIMOS’ principal researcher Ng Ka Siong, explained that to prevent hoarding and black market selling of precious vaccines, the Malaysian government took it upon themselves to acquire all the vaccines as well as manage its lifecycle all the way up to when it is injected into suitable recipients’ arms.

“The Ministry of Health (MOH) wants to have a way to track the utilisation of vaccines, so as to prevent its wastage and also prevent a vaccine black market.

These boxes are tracked all the way to vaccination centres and knowing the utilisation rate and supply to each centre helps MOH plan where to deliver vaccines to.

“So, we proposed the use of blockchain to track the entire supply of vaccines from the time they are shipped into Malaysia. The system will generate a unique serial number printed into barcode form for each box of vaccine,” Ka Siong said.

Besides identifying the batch of vaccines in the box, the barcode also holds other information for example the type of vaccine and the number of vials that each box should contain. If a box of vaccines needed to be split, new barcodes with different serial numbers would be printed for new boxes.

These boxes are tracked all the way to vaccination centres and knowing the utilisation rate and supply to each centre helps MOH plan where to deliver vaccines to.

Not only that, the supply and delivery of vaccines had to align with the appointments that the mobile app, MySejahtera, was receiving from the public as well as logging and managing these appointments.

Blockchain: check and balance

This check and balance of ensuring supply numbers tally with vaccination numbers ensures there is information robust enough to  generate vaccine certificates that are recognised by the European Union (EU) and other nations.

The MySejahtera mobile app also contains vaccine certificates of vaccinated individuals, which can be presented as a QR code for entry into a premise or country.

 This QR code is digitally signed by the Government of Malaysia and contains a private key with which there is a public key that is distributed to other countries for mutual recognition when the certificate bearer travels to these countries.

Ka Siong said, “You can bring our vaccine cert to many countries and you can be verified on the spot with that digitally signed QR code.”

The vaccine management system also interacts with the pharmacy information system of government hospitals and private clinics. In turn, these healthcare institutions will confirm they have received vaccines allocated to them.

MySejahtera is front-facing the people and managing their appointments with the role of getting them to vaccination centres.

Information stored on the blockchain is difficult to manipulate, and ensures that every vaccine certificate comes with full traceability of the vaccine itself.  The private key used to digitally sign the certs is kept in hardware security modules which in turn are located centrally at the public sector data centre, or PDSA.

Ka Siong was quick to point out the blockchain facilitated the whole supply chain of vaccines and did not store any personal data belonging to MySejahtera users.

That is because there are two parts to the whole mechanism that enables all of this to work. First, is the vaccine management system which manages the supply chain of the vaccine. “MySejahtera is front-facing the people and managing their appointments with the role of getting them to vaccination centres.”

The blockchain only holds personal data (for future reference) that is de-anonymised and could not be tied back to any one person’s identity.