by Maria Wood
The concept of contact tracing is not new, having been used for centuries to halt the spread of disease, with the first known use in the 1500s during the outbreak of the bubonic plague. The practice is now being employed to stop the spread of coronavirus disease 2019 (COVID-19).
While contact tracing is not new, it is labor intensive. Here’s how it works. Once an infected individual reports a positive test to health authorities, a contact tracer—usually an employee of a local health department—interviews that person to find out everyone they were in contact with during the two days before the onset of symptoms or prior to a positive test.
The tracer will then reach out to those people who had been in close contact with the person infected with COVID-19. The Centers for Disease Control and Prevention (CDC) defines close contact as being “within six feet of an infected person for at least 15 minutes starting from two days before illness onset.” The tracer will keep in contact with the people exposed to the virus (estimates are that each case generates at least 10 contacts) and follow up with them every other day to see if they have developed symptoms and advise them of what to do, such as get tested or self-isolate for 14 days. The aim is to prevent further contact between COVID-19 patients and healthy people in order to slow the transmission of the virus.
With cases in the United States approaching 25 million, it’s not surprising that contact tracing requires an army of contact tracers. According to Johns Hopkins Center for Health Security, the United States needs at least 100,000 contact tracers to meet its current need. As of October 2020, the U.S. employed a little over 53,000 contact tracers, with plans to hire approximately 3,500 more. Only Oregon, Vermont and Washington, DC employed enough contact tracers to meet the need in their states, according to Johns Hopkins. As of November 30th, New Jersey employed 3,000 contact tracers.
In this digital age, rather than rely on traditional contact tracing, several states have turned to technology in the form of contact tracing apps for smartphones. These apps, however, have raised concerns over data privacy, as well as accuracy.
How do the apps work?
In April 2020, tech giants Google and Apple teamed up to create a contact tracing app for smartphones that uses Bluetooth technology. With Bluetooth, each smartphone contains a unique key or code that doesn’t identify the smartphone owner’s identity or location. When two smartphones are in close contact, as defined by the CDC, the anonymous keys are exchanged. If a smartphone owner tests positive for COVID-19, they report that result to a local health authority through the contact tracing app. With that individual’s permission, the app alerts each person the infected individual’s smartphone exchanged keys with over the prior two weeks. The infected individual’s name is never disclosed; only the unique keys are passed between the two smartphones. A person who has been in close contact with a COVID-19 patient is then advised as to what steps to take, whether to get tested or quarantine.
Contact tracing apps might reduce the time spent on traditional contact tracing; but these tech tools are far from perfect. One problem is that the apps only measure the distance between people, not the circumstances in which they met. For example, one or both may have been wearing protective gear, decreasing exposure. Another hitch with the apps is that, according to estimates, only one in six people in the U.S. own a smartphone, and only a little over half of senior citizens—a large at-risk population—owning one.
Another hurdle is whether enough people will download an app to make it an effective tool in stopping the spread of COVID-19. Researchers at Oxford University have estimated that in order for the app to be effective, at least 60 percent of the population needs to use it. Singapore was the first country to use a contact tracing app, though not with the Apple/Google technology. The app, called TraceTogether, was launched in May 2020 and by November 2020 only 45 percent of Singapore’s 5.6 million residents had downloaded it.
Here in the United States, Virginia was the first state to launch its contact tracing app, called Covidwise, in August 2020. As of November 2020, only 10 percent of the state’s 8.5 million citizens had downloaded it. In the Garden State, COVID Alert NJ was launched in September 2020 and had 260,000 downloads in its first month. Approximately 20 states have launched contact tracing apps; however, no state has reached the 60 percent threshold.
“It’s hard enough to get people to wear masks,” David Opderbeck, a law professor and co-director of the Gibbons Institute of Law, Science and Technology at Seton Hall University School of Law School, says. “Downloading an app on your phone with privacy concerns is a harder sell.”
In September 2020, Apple and Google came together again to launch Exposure Notifications Express (EN Express), which is a pre-formatted version of a contact tracing app that can also work with apps already created by state health agencies. One of the features of the new technology that seems to be making a difference is that states can send out push notifications for users to opt in. The process has also been made easier for iPhone owners. They can just turn on EN Express in their settings with no need to download the app. The new technology seems to be doing better than previous contact tracing apps. For example, California launched its EN Express app in early December. According to its state health department, 13 percent of adults opted in within the first day.
What about privacy?
Collecting health data even in an effort to stop the spread of COVID-19 has run into legal questions regarding protecting personal health information. Google and Apple stress the app will safeguard each individual’s privacy by not divulging locations and only allowing health agencies to use the data. The app is also voluntary and smartphone users can delete it at any time. Nevertheless, many are hesitating to download the apps because of fear their health information will end up in the wrong hands or possibly used against them.
Public reluctance to use a contact tracing app might be its biggest obstacle, according to a Washington Post-University of Maryland poll conducted in April 2020. The poll found that three out of five Americans say they are either unwilling or unable to download an app. Among smartphone users, about half said they would use a contact tracing app. When it came to which organization would better protect privacy, smartphone users expressed more trust in public health agencies and universities than tech companies.
Professor Opderbeck, who specializes in cyber security and technology law, says the country must balance the need to end the pandemic with legitimate privacy concerns.
“We absolutely for public health reasons have to do this, but it’s very invasive,” he says. “Even privacy advocates realize for public health reasons there are some compromises we’re going to have to make.”
To persuade more people to use a contact tracing app, Professor Opderbeck suggests there should be a national standard that sets out a technical model on encryption, meaning who has access to the data, and how long it is stored. The data would only be used for public health purposes, and the apps would be deleted when the pandemic ends, he says.
Lawmakers in Washington have introduced several bills specifically designed to address privacy issues raised by contact tracing apps. Senator Maria Cantwell of Washington and Senator Bill Cassidy of Louisiana introduced the Exposure Notification Privacy Act in June 2020. The bill would mandate app providers collect only the minimal amount of data needed for contact tracing, make participation strictly voluntary, and create strong security measures. A federal law would replace state statutes on data privacy, which sometimes differ. California, for instance, has a strict data privacy law. At press time, the bill had yet to be referred to a Senate committee for review.
What does the Constitution say?
Jennifer D. Oliva, a law professor at Seton Hall University School of Law who specializes in health law and policy, wrote a chapter titled, Surveillance, Privacy, and App Tracking, which was published in a 2020 report produced by Public Health Watch. In the report, titled Addressing Legal Responses to COVID-19, Professor Oliva writes that the Constitution “does not expressly recognize a right to information privacy.” However, she noted that the U.S. Supreme Court recognized a “qualified right to health data privacy” in the 1977 case of Whalen v. Roe, which involved a New York state law requiring all prescriptions for controlled substances with the potential for abuse be recorded in a central database. Physicians challenged the law on the basis it violated Fourteenth Amendment rights for “nondisclosure of private information.”
The U.S. Supreme Court rejected that argument. According to Professor Oliva, the Court recognized “individuals have Fourteenth Amendment privacy interests in their health data” so long as the data is shielded by the health agency.
Professor Opderbeck says that people shouldn’t look to the Fourth Amendment, which outlaws unlawful searches and seizures by the government, for health data protection. Since the app provider collects the data, and not the government, “in most cases it’s not going to be a constitutional issue,” he says.
Currently, the Health Insurance Portability and Accountability Act (HIPAA) sets out a set of guidelines on safeguarding health data. It details which entities are covered by the act, such as health insurers, and what qualifies as protected health information. Again, information collected by a contact tracing app might not be covered under that legislation.
“Mere location data that you were in the vicinity of someone who later reported symptoms might not be protected health information under HIPAA,” Professor Opderbeck says. “Health care providers are covered entities, and business affiliates of health care providers are covered entities. But companies making contact tracing apps might not fall under either of those categories.”
Professor Opderbeck views contact tracing apps as a supplement to traditional contact tracing methods. He says such apps could work as part of an overall national response.
- Which method of contact tracing do you think is more effective—a contact tracer that is human or a contact tracing app? Explain your answer.
- Would you download a contact tracing app? Why or why not?
- Whom would you trust to protect your data, a tech company like Google or Apple or a government public health agency? Explain your reasoning.
statute — legislation that has been signed into law.
This article appears in the winter 2021 issue of The Legal Eagle.