In March 2020, many educational institutions ended their semesters or converted to hybrid online courses due to the rising threat of COVID-19. Many educational leaders believed that the problem would be contained by the time students returned for fall semester. Unfortunately, August saw the country still locked in an ongoing public health battle and the hope of a viable vaccine was still months away. Therefore, college campuses across the country made the decision to utilize digital contract tracing to help mitigate and prevent the spread of COVID-19 to those returning students.
January 13, 2021 Feature
How Technology and Data Privacy Law Have Become Part of College Reopening Plans
By Titus Nichols
Various institutions utilized wireless technology and smartphones to enable robust contact tracing programs on their campuses. However, the idea of using someone’s smartphone to keep track of their medical status raised concerns among many watchdog groups. Their concerns focused on the privacy of students being respected and vigorously guarded while simultaneously participating in their respective institution’s contact tracing programs.1 Public health and personal privacy should not be a binary choice and, thus, academic institutions have relied upon location-tracking technology as well as federal privacy laws to protect not only their students’ health but also their privacy.
Academic leaders were mindful of the COVID-19 statistics while determining their reopening plans. In August, more than 5,000,000 citizens tested positive for the disease, while 170,000 had lost their lives to this novel virus.2 By October, those numbers would rise to 8,000,000 and 225,000 respectively.3 Additionally, college campuses posed a unique challenge because many young people are in close proximity to each other for long and repetitive periods of time. Thus, campus leaders and their respective health departments had to develop a system of information sharing that would not disrupt these unique and closely knit communities.
What Is Contact Tracing?
According to the Centers for Disease Control and Prevention (CDC), contact tracing is a key strategy in identifying and stopping the transmission of COVID-19. It works by identifying confirmed individuals that have come in immediate contact with others and working to interrupt disease transmission. This includes asking suspected individuals and their contacts to isolate and to voluntarily quarantine at home.4 However, due to the sheer number of cases and the speed at which the virus passes from person to person, manual contact tracing has not proven to be effective. Therefore, digital contact tracing and exposure notification has become the more effective tool in the contact tracing process.5 The use of such technology has augmented public health authorities’ efforts by allowing them to quickly notify people who may have been exposed to a person with COVID-19, including asymptomatic individuals.
What Is Digital Contact Tracing?
Digital contact tracing has existed as a concept as far back as 2007, when it was utilized to detect individuals who had contracted Severe Automated Respiratory Syndrome (SARS).6 Recently, many countries have deployed smartphone apps to facilitate digital contact tracing due to their ability to quickly and remotely determine whether a person has been in contact with an infected person. The University of Oxford’s Big Data Institute conducted a simulation that found that in a city of one million people, the widespread distribution and usage of a smartphone app could result in fewer days of self-isolation and quarantine.7
Through the use of smartphone apps, public health authorities have found success in using GPS and Bluetooth technology in facilitating digital contact tracing. GPS technology works by tracking individuals through cell phone networks. Tower network-based location tracking has the advantage of eliminating the need to download an app. However, interference can cause some GPS tracking to be off from 22 to 45 feet.8
Comparatively, Bluetooth technology operates locally on the phone without using a cell tower. Bluetooth technology was designed to have a range of less than 30 feet with a swiftly attenuating signal. Bluetooth works by transmitting anonymous time-shifting identifiers to nearby devices. The receiving devices download these identifiers to a locally stored contact history log on the device, as opposed to syncing with a cloud server or other network device. As a result, the technology effectively tracks the encounters between two devices. In the event of a COVID-19 confirmation, a hospital or similar medical facility would utilize the digital alert feature of the app to notify only the corresponding devices with which a person (or, more precisely, their device) had recently come in contact.9 This approach uses the technology to quickly, yet discreetly, notify potential carriers of the virus.
Some countries experienced controversy when trying to combine the two technologies. Norway, for instance, chose to utilize both GPS location data and Bluetooth protocols in an app called “Smitestopp.” The app operated by uploading user information to a central processor, instead of keeping the information localized on an individual’s phone. The usage of both technologies in such a fashion brought the ire of privacy watchdog groups, including Amnesty International, which referred to the app as “among [the] most dangerous for privacy.”10 Specifically, the constant uploading of a user’s location to a central server created a near live-tracking of the user that posed “a great threat to privacy.”11 Norway’s officials subsequently discontinued support of the app.12 As a result of such privacy concerns, Bluetooth technology has become the preferred method of facilitating digital contact tracing throughout the world.
Here Come the Tech Giants
In April, Apple and Google announced that they were combining their considerable resources to combat the COVID-19 pandemic by creating an opt-in solution based on application programming interfaces (APIs). The collaboration, named “Exposure Notification API,” allowed both Android and iOS operating systems to integrate with COVID-19 digital contact tracing apps designed and supported by various public health authorities.13
The Exposure Notification System functioned by generating a random ID of a user’s device after the use decided to opt in. The IDs shifted randomly every ten to twenty minutes so that a person’s ID could not lead to identifying their location. A user’s phone and the phones around them would exchange the randomized IDs via Bluetooth without the user having to open an app or perform any action. When a user had a confirmed or probable diagnosis of COVID-19 (as defined by the participating public health authority), the framework would identify them as affected and share their diagnosis “keys” to alert other app users of potential exposure. In the event of notification, users would receive further instructions from their public health authority on what to do next.14
How Colleges Have Embraced This Technology
The University of Alabama (UAB) partnered with Google and Apple to create an app called GuideSafe to alert its students that had come in close contact with a COVID-19 confirmation. The app worked by providing notification if there had been a positive COVID-19 confirmation in the past fourteen days. GuideSafe maintained other users’ privacy by only retaining the date of exposure, how long the exposure lasted, and the Bluetooth signal strength between the phones at the time of connection. No other personal information would be recorded or shared.15 When a self-reported and lab-verified positive COVID-19 test occurred, the Alabama Department of Public Health would enable notification to all phones that had made Bluetooth contact with the particular device in the last fourteen days.16
The University of Arizona has taken a different approach through their app, Covid Watch. The difference is that it does not notify any central public health authority of exposure status. Instead, the app frequently compares its logs of random numbers with the numbers shared by positive patients and would alert individual users if they have been exposed to a confirmed positive app user. Users would then be shown general information on what steps they should take and what campus resources were available.17
Federal Privacy Laws and Disclosures
Leaders in the education and technology fields also recognized that protecting the privacy of users depends on adhering to relevant privacy laws. The most significant law that deals with protecting the privacy of students’ education records is the Family Educational Rights and Privacy Act (FERPA), passed in 1974.18,19 The law applies to all educational agencies and institutions that receive funds under any program administered by the U.S. Secretary of Education. The term “educational agencies and institutions” under FERPA generally includes school districts and public schools at the elementary and secondary levels, as well as private and public institutions of postsecondary education.
Under FERPA, an eligible student must provide a signed and dated consent before an educational agency or institution can disclose personally identifiable information (PII) from education records.20 PII refers to a student’s name or identification number, as well as other information that can be used to distinguish or trace an individual’s identity either directly or indirectly through connections with other information.21 The term “education records” is defined as records that are (1) directly related to a student and (2) maintained by an educational agency or institution, or by a party acting for the agency or institution.22 Immunization and other health records also fall under that same category pursuant to FERPA.
Does FERPA Allow a School to Release Information Related to COVID-19?
Generally, FERPA allows public health disclosures under certain exceptions. An institution may disclose, without prior written consent, PII from student education records to appropriate parties in connection with an emergency. This “health or safety emergency” exception is permitted if knowledge of that information is necessary to protect the health or safety of a student or other individuals.23 This exception to FERPA’s general consent requirement is limited in time to the period of the emergency and does not allow a “blanket release” of a student’s PII. An educational institution may choose to disclose PII on a case-by-case basis, or it can be determined based on the totality of the circumstances.24 However, once that disclosure is made, the school must document within the student’s file the articulable and significant threat that formed the basis of the disclosure.25 Moreover, the disclosure must be in non–personally identifiable form.26 Institutions must always be mindful that even if they disclosed nonidentifiable information, the information may be specific enough that a reasonable person within the community could ascertain the identity of the infected student.
Can Schools Disclose a Student’s Infection Status to the Media?
Institutions must walk a fine line between the health of the community and the privacy of the student when dealing with the media. As discussed above, institutions can disclose PII to “appropriate parties” such as public health officials whose knowledge of the information is necessary to protect the health or safety of students or other individuals. However, the media are not “appropriate parties.” An institution may only disclose to the media nonidentifiable information. This would include providing the number of students who have COVID-19 to provide general health data to the public. With such a disclosure, the institution would have to take steps to ensure that other reasonably available information would not cause the particular student(s) to be identified through the disclosure.
Technology and privacy laws have played a vital role in combatting the spread of COVID-19 through digital contact tracing on college campuses throughout the country. Google and Apple have come together to reinforce public health authorities’ efforts by developing an exposure notification platform that integrated their respective operating systems with the various digital contact tracing apps that had been made available. Schools across the country have employed different methods of digital contract tracing; however, they have relied upon the important federal privacy law known as FERPA to guide them on how and when to disclose positive cases of COVID-19 on their campus. The unprecedented use of technology and data privacy has allowed colleges to bridge the gap between student safety and student privacy in an efficient and significant manner.
Endnotes
1. See Albert Fox Cahn & Amanda Kadish, Surveillance Technology Oversight Project, Schoolyard Surveillance: The Rise of K-12 Contact Tracing Technologies (Sept. 2, 2020), https://www.stopspying.org/s/schoolyard-surveillance-FINAL.pdf.
2. Paul Weber, Texas Testing Drops as Schools Reopen, Prepare for Football, NBCDFW.com (Aug. 15, 2020), https://www.nbcdfw.com/news/coronavirus/testing-drops-in-texas-as-schools-reopen-football-resumes/2426608.
3. Lisa Pane, Coronavirus Deaths Are Rising Again in the US, as Feared, CBS8.com (Oct. 26, 2020), https://www.cbs8.com/article/news/health/coronavirus/coronavirus-deaths-are-rising-again-in-the-us-as-feared/507-52b78b47-8a80-416e-959f-246dd928768a.
4. See Contact Tracing—CDC’s Role and Approach, CDC.gov (Aug 10, 2020), https://www.cdc.gov/coronavirus/2019-ncov/downloads/php/contact-tracing-CDC-role-and-approach.pdf.
5. See Contact Tracing: Using Digital Tools, CDC.gov (Oct. 10, 2020), https://www.cdc.gov/coronavirus/2019-ncov/downloads/digital-contact-tracing.pdf.
6. Shamshul Bahri, Enhancing Quality of Data Through Automated SARS Contact Tracing Method Using RFID Technology, 4 Int’l J. Networking & Virtual Orgs. 145 (May 4, 2007).
7. Leo Kelion, Coronavirus: NHS Contact Tracing App to Target 80% of Smartphone Users, BBC.com (Apr. 16, 2020), https://www.bbc.com/news/technology-52294896.
8. Will Knight, Phones Could Track the Spread of COVID-19. Is It a Good Idea?, Wired (Mar. 15, 2020), https://www.wired.com/story/phones-track-spread-covid19-good-idea.
9. Devin Coldewey, What Is Contact Tracing?, Tech Crunch (Apr. 18, 2020), https://techcrunch.com/2020/04/18/what-is-contract-tracing.
10. Bahrain, Kuwait and Norway Contact Tracing Apps Among Most Dangerous for Privacy, Amnesty.org (June 16, 2020), https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwait-norway-contact-tracing-apps-danger-for-privacy.
11. Id.
12. Ryan Brown, Why Coronavirus Contact-Tracing Apps Aren’t Yet the “Game Changer” Authorities Hoped They’d Be, CNBC.com (July 3, 2020), https://www.cnbc.com/2020/07/03/why-coronavirus-contact-tracing-apps-havent-been-a-game-changer.html.
13. Apple and Google Partner on COVID-19 Contact Tracing Technology, Apple (Apr. 10, 2020), https://www.apple.com/newsroom/2020/04/apple-and-google-partner-on-COVID-19-contact-tracing-technology.
14. Exposure Notifications: Using Technology to Help Public Health Authorities Fight COVID19, Google, https://www.google.com/covid19/exposurenotifications/.
15. Andrea Ramey, Alabama College Students Encouraged to Download COVID-19 Contact Tracing App, ABC News (Aug. 11, 2020), https://abc3340.com/news/local/alabama-college-students-encouraged-to-download-COVID-19-contact-tracing-app-08-11-2020.
16. Alabama’s GuideSafe Exposure Notification App Launches Statewide, Birmingham City Council (Aug. 17, 2020), https://www.birminghamal.gov/2020/08/19/alabamas-guidesafe-exposure-notification-app-launches-statewide.
17. Univ. Commc’ns, UArizona Testing App to Alert Students, Employees Exposed to COVID-19, Univ. of Ariz. News (June 18, 2020), https://news.arizona.edu/story/uarizona-testing-app-alert-students-employees-exposed-covid19.
18. 20 U.S.C. § 1232g; 34 C.F.R. pt. 99.
19. It is important to note that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not apply to student health records. At the postsecondary level, FERPA applies to most public and private institutions of postsecondary education and to the student health records that they maintain. Records dealing with the student’s health are considered “education records” or “treatment records” if certain conditions are met.
20. 34 C.F.R. § 99.30(a).
21. Id. § 99.3.
22. 20 U.S.C. § 1232g(a)(4); 34 C.F.R. § 99.3.
23. 20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10), 99.36.
24. 34 C.F.R. § 99.36(c).
25. Id. § 99.32(a)(5).
25. Id. § 99.31(b)(1).