Contact tracing has been a controversial topic in the United States during the COVID-19 pandemic. It has increasingly drawn more attention from the media, especially as Apple and Google recently announced a partnership on COVID-19 contact tracing and Apple’s most recent iOS update has a “COVID Exposure Notification” feature. Multiple other technology companies are creating contact tracing applications “apps” and, according to CNBC, Salesforce technology is already being used in 35 states specifically for tracking COVID-19 (https://www.cnbc.com/2020/06/25/coronavirus-35-states-using-salesforce-contact-tracing-marc-benioff-says.html).
One of the purposes of contact tracing apps is to track information from mobile devices in order to provide alerts to those using the app if they have come into contact with anyone who has tested positive for the coronavirus. The app may also provide alerts to health departments for those who self-report a positive testing. Contact tracing is already being used by governments in several other countries around the world as part of the protocol to lessen the risk of spreading COVID-19, especially from people who have traveled to countries which have been hotspots for the virus. Travelers who return to their home country and are required by their government to utilize a contact tracing app may be alerted if someone on the airplane developed COVID-19-related symptoms. They may also be monitored, tracked, or given a risk-level rating and limited to what they can do and where they can go based on their rating.
As many businesses have begun the process of reopening their workplaces, employers may consider utilizing contact tracing apps that have been adapted for the workplace in addition to Occupational Safety and Health Administration (OSHA) and Center for Disease Control and Prevention (CDC) guidelines and recommendations. While proponents believe that appropriate use of contact tracing in the workplace could minimize the risk of COVID-19 without threatening employee privacy, the question remains as to whether the risks and legal implications associated with using contact tracing apps outweigh the benefits.
There are multiple benefits for contact tracing in the workplace. It is possible for a contact tracing app to screen employees regarding travel they have made, symptoms they may have, and contact that they have had with individuals who have tested positive for COVID-19. These apps could even track employee movements while they are in the workplace. With all employees utilizing the contact tracing app, an employer could immediately target certain areas of the workplace that a newly infected employee or an employee with symptoms was in, in order to notify other employees who may have been exposed and disinfect the area so that other employees do not become infected.
However, there are inherent risks involved in workplace contact tracing as well. Beyond the risks of advertisers tracking users, false positive or false negative reporting, and flawed testing, there is concern regarding privacy for employees in the workplace. Even if a contact tracing app does not collect location information or identify individuals, it is possible that the app server could identify IP addresses, which could then identify individuals and their locations. Employers who mandate the use of a contact tracing app, especially on an employee’s personal mobile device, may be creating a high risk of liability for their business.
Considerations for Employers
Employers will need to fully understand the risks associated with contact tracing prior to making a decision to implement it in the workplace. As each contact tracing app has different features, this decision may require assistance from an information technology (IT) professional. The IT professional can find answers to questions such as how information on each app is secured, whether the app developer or vendor will have access to the collected information and be able to share or sell the information, and whether Bluetooth or geolocation data is used to collect the data.
Prior to implementation, employers will also need to:
- Develop a written agreement with the vendor ensuring that the vendor is utilizing secure compliant policies and procedures.
- Know what information will be collected and why and decide what functions of the contact tracing app are needed and how information that is not needed will be discarded.
- Determine how and where the collected information is stored, such as on an employee’s mobile device or on an organization’s server, and how long the information will be kept.
- Ensure that both the app and the storage is safe against hackers and develop a process for what happens if there is a breach.
- Determine which employees already have an employer-owned mobile device, which employees currently use personal mobile devices in the course of their work, and which employees may not have access to any mobile device. Employers should recognize the additional liabilities for employees who are required to install a contact tracing app on their personal mobile devices.
- Make a decision as to whether to mandate usage of a contact tracing app or allow employees to voluntarily opt out of the program.
- Receive each employee participant’s agreement to collect and store personal health information.
- Develop a policy that states exactly how and why the contact tracing is being used as well as procedures for privacy, confidentiality, and protocol to be followed when there is a report of the coronavirus.
Once contact tracing is implemented, employers will want to work in coordination with state and municipal health departments both for contact tracing and for reporting purposes. Employers must also be careful that they do not violate the United States Constitution’s Equal Protection Clause and Due Process Clause, or federal, state, and local disability laws, anti-discrimination laws, privacy or biometric privacy laws, and data breach notification laws.
Finally, employers need to recognize that trust is a big component of making contact tracing in the workplace successful. Employees may be fearful of how their personal information will be used, if they participate. Transparency is vital and employees will need to be provided information on the benefits of contact tracing, how and what information is being collected, how long the information will be retained, who will be able to see the information, how the information will be used, and what rights they, as employees, may have regarding the information that is collected.
For additional information on contact tracing apps in the workplace, please contact us at www.newfocushr.com.
Written By: Kathi Walker, SHRM-SCP, PHR
Sr. HR Consultant
07/13/2020
