Abstract

The COVID-19 pandemic has brought the long-standing public health practice of contact tracing into the public spotlight. While contact tracing and case investigation have been carefully designed to protect privacy, the huge volume of tracing which is being carried out as part of the pandemic response in the United States is highlighting potential concerns around privacy, legality, and equity. Contact tracing during the pandemic has gained particular attention for the new use of digital technologies—both on the consumer side in the form of Exposure Notification applications, and for public health agencies as digital case management software systems enable massive scaling of operations. While the consumer application side of digital innovation has dominated the news and academic discourse around privacy, people are likely to interact more intensively with public health agencies and their use of digital case management systems. Effective use of digital case management for contact tracing requires revisiting the existing legal frameworks, privacy protections, and security practices for management of sensitive health data. The scale of these tools and demands of an unprecedented pandemic response are introducing new risks through the collection of huge volumes of data, and expanding requirements for more adept data sharing among jurisdictions. Public health agencies must strengthen their best practices for data collection and protection even in the absence of comprehensive or clear guidance. This requires navigating a difficult balance between rigorous data protection and remaining highly adaptive and agile.