Exposure Notification Technologies and Privacy

Summary

A Washington State Department of Health slide presentation, Exposure Notification Technologies and Privacy, given to the House Innovation, Technology & Economic Development Committee on September 30, 2020 by the state health officer and the state privacy officer. The slides describe contact tracing and define a COVID-19 contact as someone within 6 feet of an infected person for at least 15 minutes. They explain the Apple and Google exposure notification API, which uses Bluetooth proximity and anonymous key codes, stores data on the user device and does not use location data. The presentation describes a State Exposure Notification Advisory Committee established in August and a planned pilot of Exposure Notification Express. It closes with state agency privacy principles, confidentiality laws including RCW 70.02 and RCW 43.70.050(2), and a list of data contact tracers do not ask for.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

EXPOSURE NOTIFICATION
TECHNOLOGIES AND PRIVACY
House Innovation, Technology & Economic
Development Committee
September 30, 2020
                          Presenters




 Dr. Kathy Lofy                        Katy Ruckle
WA State Health Officer            WA State Privacy Officer
           Contact tracing background

• Case investigations and contact tracing have been in use for
  decades to slow the spread of infectious diseases (HIV,
  tuberculosis, hepatitis, etc.)
• Key public health tool that helps identify and stop chains of
  transmission, understand who is at risk, and inform public
  health response activities
• Local health leads this work; DOH supports
• COVID-19 case and contact definitions:
  o A case: A person with laboratory-confirmed COVID-19
  o A contact: Someone who has been within 6 feet of an infected
    person for at least 15 minutes



           Washington State Department of Health | 3
Washington State Department of Health | 4
Use case:
exposure
notification
technology




               5
         Exposure notification technology
• Apple and Google developed an underlying application program
  interface (API) and Bluetooth functionality
• API is incorporated into apps designed by public health worldwide; a
  solution is available without an app
• Apps can use Bluetooth proximity information to send notifications
  about exposure and recommend next steps
• Centralized vs. decentralized approach:
    •   Google/Apple API requires decentralization – data is stored on user device
        Several EU countries started with centralized server, now switching to
        decentralized model
    •   Decentralized is more privacy focused but less utility in the data for public
        health purposes
    •   No geolocation data can be used by apps based on Google/Apple API

                Washington State Department of Health | 6
Apple/Google
technology
• Bluetooth signals through
  Google/Apple API detect
  users in proximity               EXAMPLE: EBB02E12E780C039B9176AE20A39329B
  (currently within 6 feet for
  15 minutes or more).
• Their phones exchange
  anonymous key codes.
• If a user tests positive, they
  are instructed to enter a
  PIN to upload keys.
• Regularly phones look for
  matching keys and then
  alerts user of their
  potential exposure to
  someone who tested
  positive.
• User is directed to follow
  up with appropriate public
  health response (TBD).
      Apple/Google exposure notification
                technology

• Technology exist on Apple and
  Google phones
• Use is voluntary
• Available in multiple languages
• Does not track location of user;
  only their proximity to others
• Users are anonymous
• COVID-19-positive users send PIN
  number to national server
  voluntarily



             Washington State Department of Health | 8
 Use of exposure notification technology in
               Washington

• UW proven application (Common Circle) tested on the UW
  Medical Center Labor and Delivery floor
• State Exposure Notification Advisory Committee
    •       Established in August by UW School of Public Health
    •       Broad stakeholder representation
    •       Purpose:
        •     Review technologies
        •     Make recommendations to DOH on implementation of technologies
• Next step: pilot project using an Apple/Google simplified
  adoption strategy (Exposure Notification Express)
    •       Evaluate public health impacts
• Site of pilot not yet selected


               Washington State Department of Health | 9
Privacy principles for Washington State Agencies

  • Lawful, fair, and responsible use
  • Security
  • Individual participation
  • Data minimization
  • Purpose limitation
  • Transparency and accountability
  • Due diligence




            Washington State Department of Health | 10
Privacy considerations in public health surveillance

   • Privacy and confidentiality are cornerstones of public health
     data collection. Without trust that health information will be
     protected, public health suffers.
   • RCWs and WACs lay the foundation for confidentiality
     practices when handling sensitive health data.
   • HIPAA does not apply to protected health information (PHI)
     provided to DOH, but the Health Care Information Act (RCW
     70.02) and other laws do.
   • Identifiable patient data is exempt from disclosure (under
     RCW 43.70.050(2), RCW 70.02, and provisions of WAC 246-
     101 (notifiable conditions rules)
   • OCIO Policy 141.10 – Securing Information Technology Assets


             Washington State Department of Health | 11
  Data that contact tracers or case investigators
                 DO NOT ask for

• Social Security Number (full • Any financial information
  or last four digits)             including:
• Driver's license number or       o account numbers,
  WA ID #                          o credit or debit card
• Student, military, or passport     numbers, or
  ID number                        o any required security code,
                                     access code, or password
• Health insurance policy            that would permit access to
  number or health insurance         an individual's financial
  ID number;                         account
• Biometric data;                • Marital status
• User name or email address • Immigration status
  in combination with a
  password or security answers
  that permits account access

          Washington State Department of Health | 12
Washington State Department of Health is committed to providing customers with forms
  and publications in appropriate alternate formats. Requests can be made by calling
       800-525-0127 or by email at civil.rights@doh.wa.gov. TTY users dial 711.


File and source

File

2020-09-30_a26949_d223619_wa-dept-of-health-exposure-notification-technologies-and-pri.pdf

Size

545,975 bytes

SHA-256

1d65171d29bf53b9941bb667266d34fbc8bf23fdb6c39824706a0da4328bf251

Our copy

2020-09-30_a26949_d223619_wa-dept-of-health-exposure-notification-technologies-and-pri.pdf

Original

app.leg.wa.gov