Contact Tracing COVID-19: Exploring Legal and Social Challenges and Strategies for Improvement

This article discusses the most recent federal Centers for Disease Control and Prevention (CDC) recommendations, offering a stepwise approach to successful contact tracing. It also outlines various theoretical and practical approaches to contact tracing, and their pros and cons. In addition, it addresses challenges to contact tracing in the United States due to issues of inadequate public trust in the government and a culture of privacy, as well as Fourth Amendment and privacy law concerns. Finally, this article offers recommendations on how to improve contact tracing and its acceptance by the general public.

The Importance of Accurate Data Collection

Accurate data collection is critical to maintaining a functioning healthcare system, and is of special importance in the field of public health. Government agencies at all levels, private actors, nonprofits, academic institutions, think tanks, and a myriad of other entities rely on accurate and timely data to create and implement thoughtful policies aimed at improving the public health. There is no better example of this than what is happening with COVID-19 in the United States. Data collection and analysis play a critical role in any country’s response to the COVID-19 pandemic, but for a number of reasons, the United States has not been able to adequately obtain and organize the data needed to best respond to this pandemic. Largely, data collection has been occurring through data collected and shared by healthcare institutions and through contact tracing efforts, but for reasons detailed below, these efforts have fallen short of what is needed to isolate the spread of COVID-19 in the community.

Collecting accurate and timely COVID-19 information through contact tracing has been particularly challenging in the United States due to various legal and cultural reasons. There is a lack of clarity around the role of the federal, state, and local governments, inadequate resources, midstream shifts in COVID-19 surveillance practices, and an overarching lack of public trust. There is also a lack of public trust that stems from our society’s deeply rooted culture of privacy, and from specific concerns about the potential for our health information to be used against us. The United States holds highly the importance of privacy rights, as evidenced by the Fourth Amendment to the Constitution and the long history of court jurisprudence upholding these rights, which tries to strike the necessary balance between individual privacy and public health or safety, as discussed below. While the United States maintains a robust network of federal and state health privacy laws -- most notably, the Health Insurance Portability and Accountability Act (HIPAA) -- these laws typically have a variety of exceptions for data in the interest of public health, and do not offer much privacy protection when focused on contact tracing an infectious disease.³ While the risk of exposure of personal health information through contact tracing is very low, if there is not a solid foundation of trust between individuals conducting and responding to contact tracing efforts, it is unlikely to yield the responses necessary to isolate the spread of a communicable disease like COVID-19.

CDC Recommendations for Contact Tracing

The CDC has laid out a four-step recommended process for contact tracing:

• STEP 1: Rapid Notification of Exposure
• STEP 2: Contact Interview
• STEP 2a: Quarantine/Isolation Instructions and Testing Quarantine/Isolation Instructions
• STEP 2b: Assessing Self-Quarantine Support Needs
• STEP 3: Medical Monitoring
• STEP 3a: Monitoring and Isolation Instructions
• STEP 4: Contact Close Out

Step 1 is the rapid notification of exposure, which recommends that a person who has close contact with a patient with a confirmed or probable COVID-19 case be notified of his or her potential exposure within 24 hours.⁴ The CDC recommendations provide that the “identity of the patient or other identifying information will not be revealed, alluded to, or confirmed by the contact tracer, even if explicitly asked by a contact.”⁵ The recommendations provide that contacts may be notified through different channels, including phone, text, email, or in-person (when appropriate). The recommendations include having protocols for contacting those who are deaf or hard of hearing, and for providing culturally and linguistically appropriate communications during contact tracing activities. The CDC also includes the following list of operational questions for health departments to consider in conducting contact tracing:

• Who will conduct contact notification in your jurisdiction? (e.g., case investigators, other public health staff, volunteers, contracted staff)
• How will you collaborate to transfer contact information from one jurisdiction to another to ensure notification of exposure for contacts outside of your jurisdiction?
• How can your jurisdiction incorporate existing or new technology (e.g., mobile apps) into a contact tracer’s workflow to speed up contact notification?
• When is in-person notification needed? Contact tracers expected to perform in-person notification need appropriate training on infection prevention and control practices and must obtain any necessary personal protective equipment (PPE) prior to conducting in-person activities.
• Will contact tracers be asked to notify a client’s household contacts/known contacts, or will the client be asked to make these notifications?
• How will notification of exposure be handled for minors?
• If an entire household is exposed, will there be one point of contact for the household or separate contacts for every household member?
• How will a contact tracer follow up with a contact if the client makes the notification?
• How will you work with employers when many contacts are within a work setting?

Step 2 of the CDC recommendations address the contact interview, which the guidance says should be conducted by phone, text, or video conference, if at all possible.⁶ The guidance also includes a list of critical data elements that should be included in the form used to collect contact tracing information to “assess symptoms, better characterize their underlying risk for infection, and assess home and social factors that could impact compliance with self-quarantine.”⁷ Step 2a addresses quarantine/isolation instructions and testing quarantine/isolation instructions, Step 2b assesses self-quarantine support needs, Step 3 addresses medical monitoring for those who agree to self-quarantine, Step 3a addresses monitoring and isolation instructions, and Step 4 addresses the closing out the contact, which states that those who have been asymptomatic for 14 days can be notified of their release from the need to self-quarantine.⁸ The CDC recommendations ultimately leave it up to state and local health department officials to “decide how to implement these activities and how to advise specific people, or groups of people, to be tested.”⁹

Effectiveness of Contact Tracing

Multiple clinical studies have now shown that contact tracing is one of the most effective methods to isolate the spread of COVID-19 in the community. To understand the importance of contact tracing, one needs to understand the modes of COVID-19 transmission. The most common mode of COVID-19 transmission is via prolonged exposure to an infected person displaying active COVID-19 symptoms, or to an infected person who is clinically asymptomatic. The other mode of transmission is via shorter exposures to suspended aerosol particles in the air, e.g., being exposed to the air in a room where a symptomatic COVID-19 or an asymptomatic infection carrier had been recently.¹⁰

By finding the recent contacts of an infected person or carrier, contact tracers can identify and isolate those contacts, and prevent them from further infecting other people in the community. This is a very simple strategy, but with large patient volumes, it can become resource and time intensive.¹¹

Person-to-person contact tracing, by a government or healthcare agency in-person tracer, has been the most commonly employed technique to date. But as stated above, it is time, labor, and resource intensive. In addition, it also carries a risk of transmitting COVID-19 to the personnel involved in contact tracing, making it a high-risk job, with the risk of these personnel infecting their own families and communities.

Healthcare facility records can also help identify cases and isolate an infected person’s contacts for the next two weeks to prevent community spread. But this strategy may not pick up people who are asymptomatic and those who do not seek healthcare at a healthcare facility. This would also require the healthcare facility to use its resources to contact and isolate their patients’ contacts, which may not be possible with an overwhelming demand on healthcare facilities that are already lacking sufficient resources to treat high volumes of sick patients.¹²

Another contact tracing strategy involves using a phone app that can keep track of infected people and their close contacts via Bluetooth or Wi-Fi technology. Such apps can provide data to local healthcare agencies, which can isolate close contacts of people with COVID-19 positive status on their app. The issue with this strategy is that some people may not have a smartphone or may not want to install such an app. Most importantly, some people may feel that their phones may be tracked, and may not participate for privacy reasons.¹³

On a more extreme end, in South Korea credit card transactions and CCTV cameras were used to identify people who may have come in contact with a COVID-19 positive person. This may have proven to be an effective strategy, but it requires a vast network of cameras and personnel monitoring of such business and personal transactions. Also, personal privacy laws and societal values about privacy largely prevent the use of such nonconsensual strategies in the United States, especially absent broad public support.¹⁴

COVID-19 Data Collection Challenges in the United States

As the United States continues to face the ongoing spread of COVID-19, states have taken varied approaches to contact tracing to contain transmission. According to the National Academy for State Health Policy, 17 states and the District of Columbia currently use an “in-house” model in which state/local officials lead contact tracing efforts and recruit volunteers as needed. Eight states have contracts with a company or organization, such as a university, to conduct contact tracing; the remaining 25 states employ a hybrid model -- the state leads contact tracing efforts but relies on partners for training and staffing.  California, for instance, employs a partner model in which the local and state health departments lead contact tracing efforts but uses UC San Francisco and UC Los Angeles to train state employees to conduct contact tracing.

Local and state health departments have employed everything from the National Guard to COVID-specific technology for their contact tracing efforts. Notably, Los Angeles County recently developed an app, Safepass, in which users can receive notifications from the Los Angeles Department of Public Health and anonymously alert other users they have been near if tested positive.

Contact tracing apps may mitigate some of the issues traditional forms of contact tracing face. For example, several states and cities are struggling to reach a critical mass of people who have tested positive for coronavirus. Surveys in August 2020 revealed that a quarter of people called by contact tracers in Maryland did not answer the phone and about half of those contacted by public health officials in California’s Inland Empire, Houston, and New Jersey did not respond to calls.¹⁵

While a contact tracing app can ameliorate some of these issues, it is not a perfect solution. It is unclear whether the public will have enough trust in these technologies to actually use them. Most people are acutely aware their user information is constantly collected by the apps, and many are wary of government-sponsored apps that track their location data. Users have concerns about their privacy – how will the data be used? Who will have access to it? For how long? And for what purposes? These concerns may be further amplified in communities of color that have experienced a long history of disparate and even abusive treatment by medical institutions. In order for contact tracing technology to be a viable alternative to traditional modes of contact tracing, public health experts must earn and maintain the public’s trust.

This need for trust is not only limited to contact tracing technology. People who test positive for COVID-19 may be reluctant to provide any information to a contact tracer for similar reasons. As noted above, a large section of those who test positive do not answer contact tracers’ phone calls. Those who do may be concerned with how their information will be used and may fear the potential ramifications of divulging such information.

A positive coronavirus test requires a person to identify his/her contacts and self-isolate. Public health departments cannot reasonably expect a person to self-isolate if doing so puts the individual in jeopardy of losing his/her job or a considerable amount of much-needed income. Moreover, when a person tests positive for COVID-19, social stigma may be attached. Much of the narrative around COVID-19 has focused on individual responsibility -- individuals are expected to take the necessary safety precautions to keep themselves safe by social distancing, wearing a mask, handwashing, and avoiding large crowds. For some, a positive test could signify a lapse in personal responsibility, and informing a public health official of one’s contacts may make some feel as though they were “snitching.”¹⁶ If public health departments rely on unresponsive cases to notify their close contacts, it is doubtful that many will in light of these considerations.

Constitutional Privacy Considerations with Contact Tracing Technologies

There are two main types of contact tracing technologies that have been at the forefront of discussions about how best to contact trace cases of COVID-19: geolocation-based technologies and proximity-based technologies. Geolocation-based technologies use global positioning system (GPS) data to track the physical location of a device, usually a cell phone, to track whether a person has been in frequent or close contact with an individual who has been diagnosed with COVID-19 so that it can identify and notify individuals who may be infected with the virus. Proximity-based technologies generally do the same thing but instead use Bluetooth technology to determine whether a person’s device has been in close or frequent contact with the device of another person who has been diagnosed with COVID-19.¹⁷ Proximity-based technologies do not use location data. These technologies can either be “categorized as centralized or decentralized, meaning that contact history can either be processed centrally, typically by a health authority, or by individual devices.”¹⁸

There are potential Fourth Amendment concerns with some contact tracing technologies, which may explain why there has not been widespread use of them. This is especially true for nonconsensual geolocation-based technologies, which may infringe on the right to privacy in one’s physical location. In Carpenter v. U.S., the Supreme Court invalidated the argument that a criminal defendant did not have an expectation of privacy in location records obtained by the government in a criminal investigation from a cell phone company because the defendant voluntarily provided this information to a third party (third party doctrine), finding the government violated the defendant’s Fourth Amendment rights by obtaining this information from cell phone providers.¹⁹ This kind of identifiable location data would be necessary to track if geolocation-based technologies are used for contact tracing and likely would be found unconstitutional.

With respect to proximity-based contact tracing technologies, it is less clear whether these types of programs would violate any existing privacy rights, although the American Civil Liberties Union (ACLU), among other organizations, has expressed concerns over the potential impact that proximity-based contact tracing technologies could have on the right to privacy in the United States.²⁰

Recommendations

1.   Develop Clear Obligations for Accurate Reporting

COVID-19 has played havoc with public health, education, and the economy. With so much at stake, COVID-19 contact tracing data must be accurately reported. The chain of responsible data reporting starts with an ill individual and is passed on to the healthcare provider/healthcare system, testing labs, public health officials, and higher state and federal officials in the CDC.

There needs to be clear guidelines for data reporting, with an emphasis on accuracy at all levels of this chain. The CDC and specific state guidelines should address the timeliness of reporting, data security, and ease of access for public health officials that draw action plans based on this data.

2.  Use Contact Tracing Techniques that Facilitate Building Community Trust

In order to build trust, contact tracers must be culturally representative of the surrounding community. Institutions responsible for contact tracing should identify the primary languages spoken in their jurisdiction and ensure adequate staffing. The CDC recommends that contact tracers become familiar with the community’s perception of illness, methods of disease prevention, and experiences with the healthcare system.²¹

To address community distrust and misconceptions about contact tracing, jurisdictions must develop clear and consistent messaging explaining the nature and scope of contact tracing. A successful public relations strategy will include information on confidentiality and educate community members on what to expect if contacted. For example, messaging should clearly state which information a contact tracer will and will not request and indicate the modes of communication contact tracers will utilize. In addition, contact tracing institutions should identify common concerns a community may have about contact tracing and develop a communication strategy that addresses those concerns.²² For example, community members should be assured that information gathered through contact tracing will not be used against them. Finally, successful messaging should address perceived stigma surrounding COVID-19.

While the success of contact tracing depends on the individual’s responsibility to disclose, the state also has the responsibility to create conditions that facilitate disclosure. Larger systemic protections, such as job security and guaranteed healthcare, should be built into the process. Individuals will be less likely to participate in contact tracing if a positive COVID status will increase their healthcare insurance premiums,²³ or put their livelihoods at risk.  

3. Enact Robust Safeguards to Facilitate Widespread Use of Proximity-Based Contact Tracing Applications

Because of the concerns about dissemination and abuse of private health, location, and social information, any technology-assisted contact tracing program should use proximity-based and not geolocation-based technologies. However, there are still some remaining concerns with proximity-based contact tracing that need to be addressed in order to ensure that individual privacy is adequately protected. The ACLU has published a white paper addressing the necessary steps to protect privacy while using technology-assisted contact tracing. The basic principles laid out by the ACLU are as follows:

Not displacing non-technical measures
Voluntary
Non-punitive
Built with public health professionals
Privacy-preserving
Non-discriminatory
Minimal reliance on central authorities
Data minimization everywhere
No data leakage
Measurable impact
Have an exit strategy
Narrowly-tailored to target a specific epidemic
Auditable and fixable
Sustainably maintained²⁴

Any national or statewide proximity-based contact tracing program should be based on these principles to ensure adequate protection of the right to privacy.

4.  Incentives for Compliance with Contact Tracing

For jurisdictions experiencing issues with contact tracing responsiveness, consideration should be given to using small incentives to improve response rates. New research from the National Academies of Science, Engineering and Medicine has found that providing small incentives (even as little as $2-$5) for contact tracing responses has increased response rates.²⁵ Other in-kind incentives like masks, hand sanitizer, or delivery of food and other grocery supplies may also be an effective tool in increasing response rates.²⁶

Conclusion

Contact tracing is one of the most important tools available to reduce the spread of a highly contagious disease like COVID-19. In the United States, although contact tracing has been an effective and successfully used tool, there is still a lot of room for improvement.  There are a number of reasons that contact tracing may be more challenging in the United States than in some other countries, most notably a lack of public trust in the government and a culture of privacy. However, there are available strategies that can be used to improve the success of contact tracing efforts in this country. Based on the most recent data, developing clear obligations for accurate reporting and using contact tracing techniques that facilitate building public trust can effectively remove some of these social and local/state-level barriers to successful contact tracing. Enacting robust safeguards to facilitate widespread use of proximity-based contact tracing technologies and using incentives for compliance with contact tracing will likely further improve contact tracing outcomes in the United States. Since most of the current contact tracing data on COVID-19 is limited to the last 12 months, further research is warranted to develop newer strategies and guidelines for effective contact tracing in the United States in the future, and to prevent further spread of this illness that has caused significant social and economic turmoil around the globe. 

Endnotes

1. Dr. Habib and Ms. Moller would like to thank Hayley Penan, the Chair of the American Bar Association (ABA) Health Law Section’s COVID-19 Task Force, for her time, endless support, guidance and resources to make this publication possible.
2. Johns Hopkins, Coronavirus resource center, https://coronavirus.jhu.edu/ (last accessed Dec. 13, 2020).
3. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) P.L. No. 104-191 (1996).
4. Centers for Disease Control and Prevention, Contact Tracing for COVID-19, https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html#anchor_1590011966.
5. Id.
6. Id.
   
7. Id.
   
8. Id.
   
9. Id.
   
10. Wiersinga, W.J. et al., Pathophysiology, Transmission, Diagnosis, and Treatment of Coronavirus Disease 2019 (COVID-19): A Review, 324 JAMA 782-793 (2020).
    
11. Id.
12. Breeher, L. et al., A Framework for Sustainable Contact Tracing and Exposure Investigation for Large Health Systems, 95 Mayo Clinic Proceedings 1432-1444 (2020).
13. Abeler, J. et al., COVID-19 Contact Tracing and Data Protection Can Go Together, 8 JMIR Mhealth Uhealth, e19359 (2020).
14. Korea Centers for Disease Control and Prevention, Contact Transmission of COVID-19 in South Korea: Novel Investigation Techniques for Tracing Contacts, 11 Osong Public Health Research Perspectives  60-63 (2020).
15. Khazan, O., The Most American COVID-19 Failure Yet, Atlantic (Aug. 31, 2020), https://www.theatlantic.com/politics/archive/2020/08/contact-tracing-hr-6666-working-us/615637/.
16. Holder, S., Contact Tracing Is Having a Trust Crisis, Bloomberg (Aug. 12, 2020),  https://www.bloomberg.com/news/articles/2020-08-12/why-are-americans-so-uneasy-about-contact-tracing.
17. Centers for Disease Control and Prevention, Digital Contact Tracing Tools, https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/digital-contact-tracing-tools.html.
    
18. World Health Organization, Digital Tools for Contact Tracing, https://apps.who.int/iris/rest/bitstreams/1279465/retrieve.
19. Carpenter v. U.S., 585 U.S. ___ (2018).
20. Granick, J., Apple and Google Announced a Coronavirus Tracking System. How Worried Should We Be?  ACLU (Apr. 16, 2020), https://www.aclu.org/news/privacy-technology/apple-and-google-announced-a-coronavirus-tracking-system-how-worried-should-we-be/.
21. Centers for Disease Control and Prevention, Contact Tracing: A Community Engagement Checklist for Health Departments, Coronavirus Disease 2019 (COVID 19) Factsheet, https://www.cdc.gov/coronavirus/2019-ncov/downloads/php/open-america/Contact-Tracing-Community-Engagement-Checklist.pdf.
22. Notably, refugee, immigrant, and migrant (RIM) populations may have concerns that divulging personal information to a contact tracer could negatively impact their immigration status or even result in deportation. See CDC, Specific Groups (Refugee & Migrants) COVID-19 (Coronavirus Disease) (Dec. 4, 2020), https://www.cdc.gov/coronavirus/2019-ncov/php/rim-considerations.html.
23. McDermott, D. et al., 2021 Premium Changes on ACA Exchanges and the Impact of COVID-19 on Rates, Kaiser Family Foundation (Oct. 19, 2020), https://www.kff.org/private-insurance/issue-brief/2021-premium-changes-on-aca-exchanges-and-the-impact-of-covid-19-on-rates/.
24. Gilmore, D.K., Principles of Technology-Assisted Contact-Tracing, ACLU (Apr. 16, 2020), https://www.aclu.org/report/aclu-white-paper-principles-technology-assisted-contact-tracing.
25. Bassett, M.T. &  Hout, M., Encouraging Participation and Cooperation in Contact Tracing: Lessons from Survey Research, Nat’l. Acad. of Sciences, Engineering, and Medicine (2020).
26. Id.