Sept. 25, 2020 -- To know where we’re going during the coronavirus pandemic, we have to know where we’ve been.
And that requires people who have had COVID to help with contact tracing. To try to make that easier, countries and states are turning digital. Smartphone apps allow anyone, whether they have COVID or just worry they’ve been exposed, to detail their movements leading up to infection or exposure. These apps are becoming more and more common, but there are hidden risks and concerns about how data gathered is used and protected.
The hope is that digital contact tracing will avoid the challenges plaguing traditional contact tracing efforts, attorneys at a Network for Public Health Law virtual COVID-19 conference said last week. They emphasized that for contact tracing in any format to succeed, there must be widespread COVID-19 testing and public trust.
The problem with “traditional contact tracing is it’s a labor- and time-intensive process demanding both technical training and interpersonal skill,” says Ross D. Silverman, JD, of Indiana University.
“The process is riddled with holes. It’s slow and passive -- you wait until someone’s tested positive to get the information -- and it relies on human memory to conjure up details over 14 days such as how many people did I stand by in the grocery store and how long was I in that line, whom did I meet with and who did I discuss things with,” says Jennifer D. Oliva, JD, an associate professor of law at Seton Hall University School of Law in Jersey City, NJ.
Also, when people fear they’ll be judged negatively or scrutinized, they tend not to cooperate with live contact tracers, says Oliva. For example, young adults who attended a large party in Middletown, NJ, in July refused to respond to contact tracers’ phone calls after a COVID-19 outbreak.
Digital Phone Technology
More than 40 countries have adopted digital contact tracing technology that works on people’s cellphones to slow the spread of COVID-19, including Norway, Taiwan, Italy, Germany, and Singapore.
While the U.S. lags other countries in adopting digital contact tracing, seven states and Guam have created free contact apps to supplement their traditional contact tracing efforts. Several other states are considering adopting the Google/Apple digital technology, which has raised concerns about equity, privacy, and civil liberties.
The two main types of tracking technology Oliva described are GPS, which uses satellites to find the location of a person’s phone within a limited range, and low-wave Bluetooth, which can detect a person’s location within 30-40 feet.
These tracking apps are also called location and proximity. Although some countries such as Iceland and Ghana use GPS for their contact tracing apps, privacy advocates have raised concerns that the data may not be kept anonymous, which can lead to abuses of civil rights.
“Location tracking is highly invasive because it tracks all your movements such as going to a church, or a birth control clinic and who you associate with,” says Oliva.
It also doesn’t reliably identify when two people are within 6 feet of each other and can transmit COVID-19, writes Oliva in a report by Public Health Law Watch.
As a result, public health authorities and developers prefer Bluetooth tracking for contact tracing because it both detects a person within close range and how long that contact lasts.
Tech giants Apple and Google partnered in April on contact tracing technology now called Exposure Notifications that uses Bluetooth and works on Google Android phones and Apple iPhones. The technology is designed to log a person’s contacts and send them to a decentralized database and work with apps developed by public health authorities.
So far, Exposure Notifications apps are available in seven states: Alabama, Delaware, Nevada, North Carolina, North Dakota, Virginia, and Wyoming, as well as Guam. They can be downloaded from Google Play and the App Store.
“We wanted to help state public health authorities make apps that can notify people of possible COVID-19 exposure in a way that’s more reliable, efficient, and private,” Apple said in a news release.
Google explained how the contact tracing technology works in a blog post. Imagine Bob and Alice have a long conversation within a few feet of each other while their cellphone Bluetooth is turned on. Their phones exchange anonymous Bluetooth identifiers frequently. The technology logs their contact after 15 minutes.
A few days later, Bob tests positive for COVID-19 and reports the result using the public authority app. He consents to uploading his anonymous contacts over the past 14 days. Alice’s phone periodically downloads the anonymous identifiers of people who have tested positive in her region and makes a match with Bob. The system notifies Alice that she has been exposed to someone who tested positive for COVID-19, and she receives information about next steps.
The system is not perfect. Proximity apps tend to over-include people, says Oliva. “They can’t tell the difference between health care workers wearing PPE who come into close contact with patients and people sitting side-by-side on a couch smooching.”
The technology also can’t distinguish when people are separated by walls or driving near each other going in the same direction on highways, she says.
The Bluetooth apps also only work when people carry their cellphones with them and keep the Bluetooth feature on, which can wear down the battery, says Oliva.
And they can exclude the many people who “don’t own smartphones, especially those who are more vulnerable to COVID-19. Or, they may not have the latest cellphone versions or a digital plan that works with this technology,” she says.
That raises the question of whether enough people would use the tracing technology to be effective. A recent simulation suggests the COVID-19 pandemic can be suppressed with 80% of all smartphone users using the Bluetooth application, or 56% of the overall population. But the American public is unlikely to accept any digital contact tracing mandates, Oliva says.
And a poll by The Washington Post-University of Maryland in late April found that only 3 in 5 Americans would use Apple or Google digital contact tracing apps because of privacy concerns.
For these reasons, the CDC and other public health experts say the role of digital contact tracing is to supplement rather than replace traditional contact tracing.
“Technology can support case investigation and contact tracing but cannot take the place of the staff who interview, counsel, and provide support for those impacted by COVID-19,” the CDC says online.
Widespread adoption is not necessary to have an impact on COVID-19. Even a 15% adoption rate of digital tracing, combined with traditional methods, can mean 8% fewer infections and 6% fewer deaths based on modeling by scientists at Oxford University’s Nuffield Department of Medicine and Google Research.
States have been slow to develop contact tracing apps, and people have been slow to use them. Only 25,000 people in North Dakota, about 3% of the population, had downloaded the state’s app as of early June, according to The New York Times.
Apple and Google announced Exposure Notifications Express this month, saying their goal is to have the broadest reach across the U.S. Unlike the previous version, the technology will be built into the Android and iPhone operating systems.
“Our primary focus right now is on the US. We’re really challenged with how can we speed up adoption of Exposure Notifications Express for the U.S. states,” Dave Burke, Android vice president of engineering, said at a Sept. 1 news briefing.
“As the next step in our work with public health authorities on Exposure Notifications, we are making it easier and faster for them to use the Exposure Notifications System without the need for them to build and maintain an app," Apple and Google representatives said in a statement.
Protecting Privacy and Security
Apple and Google emphasize that they don’t collect or use location data, reveal user identity or location, or reveal the identity of people who test positive, and that app users control the data they want to share, and they have to consent to release it.
That aligns with the CDC’s personal privacy and security criteria for public health departments that use digital contact tracing apps. The CDC also recommends that data be encrypted and stored only locally on a user’s device prior to voluntary sharing with health departments, and that departments have an independent security and privacy assessment that addresses issues of trustworthiness, security, and privacy, and publicly provide results.
Virginia was the first state in the country to design an app (COVIDWise) using the Google-Apple Exposure Notifications technology. “Users can opt in to download and utilize the free app. No location data or personal information is ever collected, stored, tracked, or transmitted to the Virginia Department of Health as part of the app. Users can delete the app or turn off exposure notifications at any time,” U.S. Sen. Mark Warner said in a statement.
Although these decentralized proximity apps ease some privacy concerns, the government’s collection and storage of health data raises other concerns, says Oliva.
“The constitutional and decades-old statutory health data privacy protections that extend to traditional health care actors in the United States generally do not apply to information collected and stored by private entities,” she writes in the Public Health Law Watch report.
For example, the Health Insurance Portability and Accountability Act (HIPAA) applies only to “protected health information,” which is a narrow part of health data and applies only to health care providers, plans, clearinghouses, and their “business associates,” writes Oliva.
HIPAA also allows the use of protected health information for government purposes, including health oversight activities, judicial and administrative proceedings, law enforcement, and limited research activities.
Also, the United States lacks a comprehensive federal health data privacy law that protects the privacy of sensitive information collected and stored by digital contact tracking applications, says Oliva. While members of Congress have introduced three bills to strengthen privacy protections of personal health data, none have passed.
As Congress fails to agree to changes, California has enacted “the most comprehensive state-level data protection regime in the United States,” writes Oliva.
The California Consumer Privacy Act applies to private digital application developers who do substantial business in California. “It creates, among other things, the right to correct data, delete data, and privately enforce statutory privacy violations. The law does not, however, extend to consumers any right regarding de-identified information,” she writes.