Considerations for Contact Tracing Location & Health Data Storage

Covid-19 Contact Tracing

Location and health data that gets captured, stored, and analyzed through contact tracing apps may be a key factor in supporting the nationwide effort to return to daily activities following the COVID-19 pandemic. However, this sort of new data gathering comes with privacy, security, compliance, and legal questions.

Contact tracing involves tracking the location patterns of humans so that – as infected individuals are identified – those they may have come in contact with could be identified, alerted, and quarantined. Supported by the Center for Disease Control (CDC) and the World Health Organization (WHO), contact tracing is a crucial part of a three-pronged plan to fight COVID-19 until a vaccine is developed: test, trace, isolate. A highly human-powered effort today, a scholar estimates that the United States will need at least 100,000 workers in contact tracing to keep COVID-19 at a manageable level – more than three times the amount of trained contact tracers today.

Technology to support this human investigative work may involve widespread adoption of contact tracing apps leveraging GPS or Bluetooth to track location data – similar to the Find My app and service provided by Apple Inc. that enables users to track the locations of devices and AirPods. In this use case, however, humans would be tracked and alerted when they come in close proximity to infected individuals. Although location tracking technology already exists, there are privacy, security, and HIPAA compliance considerations to work through depending on how personal health data may be married up with location data. There are also concerns about whether enough people would voluntarily download and utilize contact tracing apps and sensors to make data aggregation statistically relevant for public health officials at community and national levels.

One example of aggregated data was presented by a location and analytics firm which analyzed human interactions within the United States using available anonymous cellular data. They researched and analyzed three factors to come up with a Social Distancing Scoreboard: average distance traveled, visitation to non-essential venues, and decrease in probable human encounters. Overall, the nationwide combined social distancing score came out to be a C-. Researchers from this project stress that the data did not single out any individual person, device, or household and that the company adhered to industry guidelines to ensure individual privacy was not breached and that the report was done pro bono for the greater good.

Moving contact tracing apps forward to support an organized effort to implement the test-trace-isolate methodology poses data management questions, including:

  • Privacy – What contact tracing information is tracked and how is it shared? Would apps be mandated or optional? What about those who don’t want to or cannot participate?
  • Security – What platforms would be used to securely store contact tracing data? Are there cybersecurity risks? How would data protocols support the increased security needed?
  • Data Retention Regulations – How long would contact tracing data need to be stored? Who are the stakeholders responsible for record storage? What is the governing body?
  • Data ownership – Who would own contact tracing data? How would the chain of custody (i.e., viewing and acting on the data) for these records be managed?
  • Legal Considerations – What types of legal issues could arise from this increased tracking of location and health data related to contact tracing? Could workplaces be held accountable if employees claim they were exposed to the virus at their workplace? What other kinds of privacy issues could have legal ramifications?

Many other countries are diving into contact tracing with varying approaches utilizing technology and human efforts. In Europe, the European Commission issued its Guidance to ensure full data protection standards of apps fighting the pandemic. There are many points, and most focus on the opt-in voluntary nature for the app and that there should be no negative consequences for individuals who choose not to use an app. The Commission recommends storing the least personal amount of data, meaning the exact time/place of the contact doesn’t seem necessary and that the app should be automatically deactivated once the pandemic is declared under control.

As scientists, politicians, public health officials, and the general public tune in daily to review the numbers associated with COVID-19, it is even more evident that health data is something that unites people worldwide. With answers to some of these questions, the storage of location and health data from apps supporting the human effort associated with contact tracing may be a key factor in limiting the spread of COVID-19 and Opening Up America Again.

May 21 2020

Ready to learn more?

Contact us today to learn more about our healthcare data management solutions.

First Name *
Last Name *
Email *

Healthcare IT tips, guides, news & more delivered to your inbox

Sign me up