Health Surveillance — The Control-Grid Component
Health surveillance is the component with the most sympathetic cover story and the cleanest demonstrated abuse. A health credential is built for an emergency — a pandemic, a benefits system, a continuity-of-care record — and then persists, repurposable, after the emergency ends. The pandemic produced the proof-of-concept everywhere; what varies is whether the infrastructure was dismantled, federated, or kept. Scored in the Convergence Index.
China
China supplied the definitive case that a health credential becomes a control credential. During COVID, the mandatory health-code app gated movement by color status — and in Zhengzhou in 2022, authorities turned depositors’ codes red to block them from physically reaching a bank where their savings were frozen, an explicit repurposing of a health tool to suppress a protest (The Guardian). The capability did not retire with the pandemic; it demonstrated its second use and stayed. No limit, full integration with the identity layer.
European Union
The EU built the cleanest version and then helped globalize the standard. The EU Digital COVID Certificate was interoperable, time-bounded, and largely retired — but its technical model became the seed of the WHO Global Digital Health Certification Network, which adopted the EU system as the basis for a worldwide health-credential standard (European Commission). The bounded national deployment is the good-governance story; the export of the standard to a permanent global network is where the persistence risk re-enters.
India
India is building a permanent national health stack by design. The Ayushman Bharat Digital Mission assigns every citizen a health ID linking records across providers (ABDM) — the health layer of India Stack, sitting on the Aadhaar identity rail. It is framed as continuity-of-care and is genuinely useful for that; it is also a unified, identity-linked health record of a billion-plus people, which is exactly the asset that, elsewhere, got repurposed. Comprehensive and growing; limits are the ordinary data-protection kind under the DPDP Act’s government carve-outs.
United States & United Kingdom
The US has no unified health-surveillance system — and a privacy law with law-enforcement-shaped holes. HIPAA is real protection, but its own text permits disclosure to law enforcement under a range of conditions without patient consent (HHS). After Dobbs, those permitted-disclosure provisions became the live fight over whether health records (period-tracking, out-of-state care) could be subpoenaed in prosecutions. Fragmented, no central system — but the carve-outs are the door, and the data brokers around HIPAA’s edges are the wall with no door at all.
The counter-argument
Health data integration saves lives — unified records prevent fatal drug interactions, speed emergency care, and let a public-health system see an outbreak coming. The pandemic credential, in its bounded form, let societies reopen. The defect is persistence and repurposing: infrastructure justified by an emergency that outlives the emergency, under an identity link that lets a medical fact gate a non-medical outcome. The component scores the surveillance capability; whether it was sunset, federated, or kept is what the “limit” axis tracks. See also payment freezing — Zhengzhou is where the two components met.
Part of the Convergence Index component set. Scored in the interactive index; full cross-country comparison in the convergence table.