Protecting Privacy or ‘Outing’ Patients in Contact-Tracing

By Tammy Joyner

At 86, Wilhelmina Wilson takes no chances when it comes to safeguarding her health during the COVID-19 pandemic in New York.

She stays squirreled away in her one-bedroom co-op apartment in Queens, where she has lived since 1976.

When she ventures out, she’s armed with disinfectant sprays and wipes for elevator buttons and doorknobs to the building’s incinerator and laundry room.

She’s en garde anytime she hears of new COVID-19 infections.

Still, Wilson worries.

When employees at a neighborhood store came down with the virus, Wilson and other building residents were notified by a note from management taped to the front entrance of the building.

But she’s received no notice about her neighbor across the hall.

Wilson, a retired bank employee, told Digital Privacy News that she watched from a safe distance in her doorway as the woman recently was rolled away on a gurney to a waiting ambulance after she tested positive for coronavirus.

To date, Wilson said, no official mention of the incident has come to building residents, in writing or otherwise, about her neighbor.

She learned about the woman’s status from the victim’s daughter.

“They should let people know when there’s a case of the virus,” Wilson said. “People would be a little more cautious.

“I’ve never heard anything said about it,” she added. “In fact, I called security and they said they knew about her — but I didn’t see anything on the door downstairs about her.”

Public Right to Know?

With the number of COVID-19 cases in the U.S. soaring past 1.2 million, Wilson’s concerns broach a delicate subject: Does the public have the right to know who has the virus?

The issue remains timely as the federal government and more local entities increasingly weigh “contact-tracing” to find and monitor new cases to try to slow the spread of coronavirus.

In locating new cases, personal and sensitive information may be divulged, though health officials insist the privacy of new victims is safeguarded — and will continue to be even after the pandemic subsides.

“There’s thousands of people working on contact-tracing across the United States,” said Eric Pevzner, chief of the Centers for Disease Control and Prevention’s (CDC) epidemiology workforce branch and the Epidemic Intelligence Service (EIS) Program.

“We’re all trained when we collect personal information to secure that data.”

‘Disease Detectives’

Contact-tracing involves teams of public-health nurses, epidemiologists and trained citizens — commonly known as “disease detectives” — identifying new coronavirus cases.

They track them via phone and help sick patients and those they’ve potentially exposed isolate themselves. The strategy has proven successful in China, Germany and South Korea.

“Contact-tracing has been extremely useful,” said Tara Scribellito, nursing supervisor of infectious disease at the Salt Lake County Public Health Department in Utah, where the method is used extensively.

In a letter sent last month, 16 current and former public-health officials across the country urged Congress to allocate manpower and $46 billion in a future coronavirus relief package so states can track down new cases before more states reopen.

The size of the workforce of disease detectives would range between 100,000 and 300,000.

130 Detectives at CDC

The CDC has 130 disease detectives, “all of whom are working on the pandemic in some capacity,” said Pevzner, who directs the agency’s cadre of disease detectives.

Ninety detectives are in Atlanta or in CDC field offices around the country. The others work in 34 states, usually at local public-health agencies.

“There are very few states we’re not working with right now,” Pevzner told Digital Privacy News.

During the investigations, people are assured of privacy. “We’re not tracking people using their phones,” he said.

“Whenever we do contact investigations, we tell them we’re not going to share your information with anyone else,” Pevzner continued. “A big part of the investigation is really about building up trust, so they truly feel comfortable talking.”

Still, some people worry “they’re going to be blamed,” he said. “We promise them we’re not going to share their information.”

Ebola, Tuberculosis, HIV

Pevzner has been working in public health since 1996 and has dealt with Ebola, tuberculosis and HIV.

“I’ve dealt with viruses much more lethal and pathogens that have scared me more,” he told Digital Privacy News. “I haven’t seen this (kind of) infection and spread this rapidly around the globe, causing this much disruption.

“It’s disrupted every measure of society,” Pevzner said. “It’s unprecedented in my career and lifetime.”

In Salt Lake City

At the Salt Lake County Health Department, “the utmost discretion” has been used since the first case was discovered in the state in early March, Scribellito said.

Soon after, the infectious disease department grew from 10 nurses and two supervisors to 130 investigators, she said. Investigators have a daily workload of three to four cases.

Investigations can span a couple of days to a couple of weeks, Scribellito said.

“We’re really big on trying to maintain the privacy of the COVID-positive patient,” the nursing supervisor said.

Armed with an investigation form and calendar, detectives call patients. From there, they go day by day, hour by hour in restructuring their lives.

“We’re going to go back 48 hours prior to you developing symptoms,” said Scribellito, who works cases as needed.

Meticulous Reconstruction

The work is a lot like detective work. Patients’ activities and whereabouts over the previous two weeks are meticulously tracked: When did you wake up? What did you do? Where’d you go? Whom did you interact with?

Questions are asked until the person, place or thing is “isolated and exposures are determined,” Scribellito explained.

After a new patient is identified, the detectives notify the people and places the person has been around. At no time is the patient’s name revealed unless he or she gives permission.

Searches take investigators to nursing homes, long-term care centers and homes where many people may be living in close quarters.

As of Friday, Utah had 5,724 lab-confirmed cases of COVID-19 and 61 deaths.

In Salt Lake County, the state’s most-populous county, disease detectives have handled more than 1,900 cases, said Nicholas Rupp, a spokesman for the Salt Lake County Health Department.

“We’ve been able to identify the source of the disease for 85% of those cases,” he told Digital Privacy News. “That’s a very good identification rate.”

While the health department fields calls about people not wearing their masks in grocery stores, for instance, Scribellito said she hadn’t “heard about people wanting to out their neighbors or family members.”

“With the pandemic, we’re dealing with finding this balance and maintaining the privacy of individuals and protecting the public health,” she said.

Looking to the Future

Once the pandemic is over or under control — at least one Yale School of Public Health professor predicts COVID-19 lasting into the fall — the data that Utah disease detectives collect will be kept for seven years.

That’s standard practice for all infectious-disease information, Rupp said.

The electronic data is password-protected and under at least a double-lock system on a computer, Rupp said. Any hard-copy information is kept in a secured storage room, also double-locked.

“We follow the requirements of HIPAA and Utah law — and those require secure access,” Rupp told Digital Privacy News. “You have to log in with specific credentials to access the records.

“Anyone who accesses the records is recorded.

“Only employees who have legitimate, professional needs-to-know (reasons) may access the records, not someone who is looking up their neighbor’s records,” Rupp continued. “It’s only accessible by people who need it for their work, such as infectious-disease nurses and investigators.”

Despite the probing and personal questions, the disease detectives have not faced many problems.

“We’ve been really lucky, Scribellito, the nursing supervisor, said. “Most everybody we’ve worked with has been grateful to be made aware of their exposure.

“Most people have been grateful for us taking the burden off of them of notifying people.”

Outing Neighbors?

But what about Wilhelmina Wilson’s concern in New York: Should individuals who’ve contracted COVID-19 be outed?

“It’s a terrible thing to do,” John Banja, professor at the Center for Ethics at Emory University in Atlanta, told Digital Privacy News. 

“Here’s the bottom line,” he posed. “Yes, there may be a perceived benefit to identifying COVID patients.

“Let’s say you put a big ‘C’ on their chest. What about their dignity, the harm that would exist?”

Further, enforcing a policy for publicly identifying COVID-19 victims would be tough,” Banja said.

“It’s not a crime to be infected with COVID-19, but the kinds of measures we’d use to identify these people (would be like) using criminal enforcement,” he argued. “It would be an extreme measure that’s not merited by the situation of COVID-19 right now.

“That’s not to say,” Banja offered, “something like that is not possible if COVID becomes a super pandemic.”

Tammy Joyner is an Atlanta-based writer.

Sources: 
Letter to Congress: Bipartisan Public Health Leaders Letter on COVID19 Tracking and Tracing
NPR: Some States Plan To Big Increase In Contact Tracing Staff To Fight Coronavirus : Shots – Health News
Slavitt, Gottlieb Seek Money For Contact Tracing, Self-Isolation
Yale: Covid19 is Here, Now How Long Will it Last?