A Novel Approach to Contact Tracing

There is a massive effort in the US to curb the spread of COVID-19. But the US has been behind other countries in part because of lack of testing capacity. As testing capacity accelerates, the number of confirmed cases has grown. Singapore and South Korea have flattened the curve more quickly through efficiently identifying cases and exposures and promoting quarantine. This public health strategy, contact tracing, is old but their method is novel. They use phones.

Countries are using Bluetooth or mobility data (eg, Global Positioning System [GPS], cell tower) collected by the phone for contact tracing. One method of contact tracing involves scanning and recording Bluetooth signals from other nearby phones, usually within a 30 feet diameter. The real time data offer a novel means to track proximity and potential interaction with others. Another method for contact tracing involves use of mobility data (often GPS) collected by the phone that allows a digital trail of timestamped locations visited to be easily recreated.

Public health officials can leverage either approach, Bluetooth or mobility, to determine who an infected person may have been in close contact with—and then notify those exposed of possible risk. Countries have taken different approaches in what information they share with individuals identified as being at risk.

On one end of the spectrum is South Korea, where the age, gender, and location history of those infected are disclosed to those who may have been exposed. On the other end of the spectrum is Singapore, where people are only informed that they may have been exposed. Both South Korea and Singapore have been successful in flattening the cure and their use of phone-based contact tracing offers clear potential to better understand how COVID-19 spreads and can be stopped. With increasing interest in using contact tracing in other countries, it is important to understand the potential risks and benefits of use in the US.

Disclosure
During these unprecedented times it is necessary to consider the benefits of disclosure to exposed third parties against the risks of not respecting individual privacy—everyone’s right to control their health information. People are reluctant to share their health information for various reasons, such us harm to one’s reputation, employment problems, and access to insurance.

In the US, health care professionals do not break confidentiality to disclose a patient’s disease status even for communicable diseases like COVID-19 that present a risk to others. One exception is HIV where many state laws encourage or mandate disclosure to public health identities and/or sexual partners. This HIV status disclosure is justified because public health benefits are thought to outweigh the risks to the individual, though this is not without controversy. For COVID-19, one’s personal data (such as age, gender, location, and health status) is shared with others in a public fashion. Yet a discussion about COVID-19 status disclosure does not appear to be happening in many countries where phone-based contract tracing is deployed. In other words, personal data is being shared without the input of people whose information is being shared—in this case those infected.

The current pandemic-related disclosed data can be very sensitive, especially if linked to GPS mobility data collected by phones. Intimate details like where a person sleeps, shops, and even eats can be easily inferred. Later secondary uses of this data can have numerous unintended consequences around employment, social standing, and health insurance coverage. People have already been assaulted because of suspected or confirmed COVID-19—now imagine their home address being shared too. While efforts to deidentify data can be undertaken, history seems to always show that in the near future reidentification is possible. It is assumed that the data are encrypted and secure. But is it? We do not know, key details are lacking.

Legal implications
The legal implications cannot be ignored either; will there be criminal consequences for spreading coronavirus? It may sound fantastical, but in the US there are criminal laws against certain high-risk behaviors that could spread HIV. In Singapore, refusal to share COVID-19 related data requested by the Ministry of Health can lead to prosecution. These consequences have likely led to people avoiding testing or care.

Ethically based solutions offer a path forward. One pathway is to simply ask for consent to collect data. This could be done in multiple ways including an opt-in system (Singapore) or even opt-out in some circumstances. Although Iranian officials used an opt-in system, the consent was displayed in a non-native language or not at all for many users. Regardless of the system, to respect privacy, it is important that the data collected, shared, and where data are stored is clearly explained to users. Alternatively, it could be an opt-out consent, which may be more coercive because people are less likely to change from the default. If an infected person’s consent is required before his or her data are shared, an opt-in system could be more palatable. Another solution is to aggregate data at the community level to examine trends rather than an individual’s data. This does not necessarily preclude obtaining consent. Although less advantageous for contact tracing, storing contact data on the phone of an infected person rather than a centralized database lets that individual decide whether he or she want to share the data with public health officials.

Conclusion
COVID-19 has spurred many changes leading to wider adoption of various technologies to support public health efforts. But even data collected for the greater good such as phone-based contact tracing can have unintended negative or punitive consequences. There is always a risk when sensitive information is collected. Ultimately, US public health officials must weigh these risks against potential benefits in an informed fashion.

Dr Sobowale is a Child and Adolescent Psychiatry Fellow, University of California Los Angeles Semel Institute for Neuroscience and Human Behavior, Los Angeles, CA. Dr Torous is Director, Digital Psychiatry Division, Department of Psychiatry, Beth Israel Deaconess Medical Center, Harvard Medical School, Boston, MA. He is Digital Psychiatry Section Editor for Psychiatric Times.