State Legislative Efforts to Enhance COVID-19 Contact Tracing
By Brian Skinner, Esq.
One of the major pre-requisites for states desiring to relax COVID-19 mitigation measures is the ability to identify those who are infected with and exposed to COVID-19 through contact tracing. Contact tracing is a time-honored public health tool used by state and local governments for decades to prevent and control tuberculosis, HIV, and sexually transmitted infections.
In an effort to quickly scale up contact tracing efforts, state legislatures around the country are considering policies to expand their capacity to conduct contact tracing for COVID-19. Policies being considered by states include safeguarding the identity and privacy of those contacted by contact tracers, building an effective and reliable contact tracing workforce, and mandating that no one can be compelled to participate in contact tracing.
Additionally, three states have considered bills to address the use of technology and emerging digital solutions to provide exposure notification. Sometimes referred to as digital contact tracing or proximity sensing, “exposure notification” is a term that refers to technology products supporting otherwise manual tasks involved in both contact elicitation and contact notification. Mobile device application use Bluetooth pings or ultrasound to share information between devices. When information is shared, devices log it as a “contact” given the close physical proximity between the devices. If someone installs an exposure notification app on his or her mobile device and is diagnosed with COVID-19, the logged contacts can be used to communicate with other app users about their potential exposure. Examples of exposure notification tools include the Apple/Google application programming interface, the Care19 app developed by ProudCrowd, and Dimagi’s CommCare platform.
The following is a summary of state efforts to expand contact tracing capacity while also protecting the privacy of those who contacted by contact tracers.
California
In California, AB 660 would require that exposure notification app developers contracted by the state inform users of the authorized purposes of the app and the collected data. Another bill, AB 1782 would require public health entities and businesses offering exposure notification services to allow users to revoke consent for the collection, use, maintenance, or disclosure of the user’s information. A business that provides the services but is not affiliated with a public health entity would be required to disclose its non-affiliation. The bill would also require the encryption of data collected by the contact tracing technology, limit the use of the data as well as the amount of time the data can be maintained, and require reported exposures be verified by a healthcare provider before notifying logged contacts of their potential exposure.
District of Columbia
Evidence that COVID-19 is having a disparate impact of COVID-19 on minority communities caused the District of Columbia to mandate the district’s department of health to set a goal of hiring 50% district residents for contact tracing positions and 25% graduates from district-funded workforce development or adult education programs for case investigator positions (B 23-0757). This policy is intended to break through cultural and language barriers that often lead to health disparities by having a contact tracer workforce that is trusted by and familiar with minority communities.
Iowa
In Iowa, an amendment was filed to H 8322 that would have required that newly hired case investigators and contact tracers meet the cultural and linguistic needs of the populations they serve. The bill was withdrawn before it was voted on.
Kansas
Kansas may have enacted the most comprehensive COVID-19 contact tracing legislation (HB 2016) in June of this year. The law requires the state’s secretary of health and environment to adopt rules establishing contact tracer qualifications and training requirements and mandates regulations for the data collection. The enactment makes contract tracers state or local employees, thus providing them with immunity protections. Date collected by contact tracers may only be used for contact tracing purposes and must be destroyed when no longer necessary. Further, the law prohibits the disclosure of an infected person’s identity makes participation in contact tracing voluntary.
Louisiana
In Louisiana, an appropriations bill (HB1) included a provision that prohibits the department of health from using contact tracing funds if participation by individuals or businesses is mandatory.
Minnesota
The Minnesota legislature considered several bills on privacy, employee rights, and the rights of citizens with regard to participation in contact tracing. The legislature also considered legislation authorizing an exposure notification system.
SF 4500 would have established a COVID-19 testing and contact tracing bill of rights and classify the information collected by contract tracing as data subject to the state’s privacy laws. Another bill, HF 4665, sought to limit the state health department’s ability to require participation in contact tracing.
HF 4579 would have prohibited employers from firing or retaliating against furloughed employees who conduct contact tracing. Although it failed to become law, the intent of the legislation is to ensure that those who temporarily enter the contact tracing workforce remain economically secure.
Finally, HF 164 would have authorized the state’s health commissioner to establish an exposure notification system but prohibit the mandatory use of the system or collection of location data. Employers would be prohibit from requiring employees to install an exposure notification application on their mobile devices or use location information for determining an employee’s risk of exposure to a communicable disease.
New Jersey
In New Jersey, A 4170 would have limited the use of contract tracing data and required the collected data to be deleted no later than 30 days after it is received. The name of third parties to whom data is disclosed would have had to be published online and misuse of data by third parties would be punished.
New York
In New York, bills have been introduced to safeguard the identity and privacy of those contacted by contact tracers, address the disparate impact of COVID-19 on minority communities, establish requirements for the collection and use of emergency health data, and regulate the use of technology for collecting data during the COVID-19 emergency.
Two bills (A10500 and S8450A) would have required information collected by contact tracers be confidential and prohibit its disclosure to law-enforcement without a court order. However, information could be disclosed to healthcare providers for the purposes of documenting the need for sick leave based on an isolation or quarantine order, for third-party reimbursement for healthcare services, and in certain court proceedings.
A10462 would have established enhanced privacy protections for contact tracing data and grant individuals continued control over their information after its collected. And, S8327 would make it unlawful to knowingly disseminate contact tracing information to an unauthorized person.
A10447 and S8362 would require contact tracers hired within New York City to be representative of the cultural and linguistical diversity of the community in which they will work. Similar bills for contact tracers hired within Suffolk and Nassau County were also introduced. (A10567 and S8476).
Finally, A10583-A and S8448B would establish requirements for the collection and use of emergency health data and the use of technology for collecting data during the COVID-19 emergency. The bills require the disclosure of certain information to those who install and use data collecting apps on mobile devices. This includes information about the right to opt-in, the right to privacy, the app’s privacy policy, time limitations for maintaining the data, and the individual’s right to access the data. The bills would also allow individuals to sue for violations of the law.
Ohio
In Ohio, two bills (HB 61 and SB 31) that passed their chambers of origin would declare contact tracing voluntary and not require an individual’s compliance. Both bills require the acquisition of consent from each individual contacted.
Rhode Island
While not legislation, Rhode Island’s health department recently adopted rules requiring businesses and other establishments that wish to reopen or remain open to cooperate with the department in testing, contact tracing, and disease investigation. The rules also require the development of written operation plans that designate a point of contact to work with the state health department on testing, contact tracing, and disease investigation.
In conclusion, it is likely that state legislatures will continue to seek ways to address issues related to contact tracing, especially issues related to the privacy and confidentiality of those participating in the emerging digital solutions used to facilitate contact tracing.
Brian J. Skinner is a former counsel to the West Virginia House of Delegates Committee on the Judiciary and counsel to the West Virginia Senate Minority Caucus. He has over a decade of experience as an adviser to legislators on legal and political issues related to pending legislation; providing research and legal analysis services to legislative committees; and preparing bills, resolutions, amendments, and other documents for the West Virginia Legislature.