Important: The status of the COVID-19 crisis constantly changes. The information in this resource is updated frequently.
 Actions

Difference between revisions of "Contact-Tracing Investigations"

From Navigating COVID-19

 
(36 intermediate revisions by 5 users not shown)
Line 1: Line 1:
Governor Newsome stated that the ability to conduct contact tracing is an important factor in business reopening decisions.  Businesses need to understand the contact tracing process, and the importance of this requirement. 
+
<center>
 +
{| class="wikitable"
 +
! [[Employer Response to COVID-19 in the Workplace|< Previous ]] !! [[Navigating COVID-19: A Legal Guide For California Employers|Table of Contents]] !! [[FAQs — Contact-Tracing Investigations|Next >]]
 +
|-
 +
|}
 +
</center>
  
Contact tracing is an  important investigatory tool in an employer's efforts to reduce the spread of the virus in the workplace. If contact tracing is done promptly and well it can help determine who an exposed or COVID-19 infected employee had close contact with, ensure that these are quarantined and avoid further infection.  A proper contact tracing investigation can also help an employer determine whether a COVID-19 positive employee likely contracted the illness in the workplace or elsewhere, an important determination for CalOSHA recording requirements and handling workers compensation cases.
 
  
==WHAT IS CONTACT TRACING?==
 
  
Contact tracing is an investigation intended to identify employees, vendors, suppliers, or clients the employee may have had close contact with at work.  Contract tracing can be used in conjunction with a required CalOSHA investigation to determine whether an employee with COVID-19 contracted the illness at work or elsewhere.  The key to effective contract tracing is to do it quickly in order to reduce the risk that other employees will be exposed to the virus, and so the employer can comply with CalOSHA requirements to provide a safe workplace for employees.
+
Gov. Newsom said that the ability to conduct contact tracing is important for businesses when they decide to reopen. They should understand the contact-tracing process, and why it's required.
  
Contact tracing has many potential benefits. These can include educating infected people about what steps to take to avoid spreading the virus, helping exposed contacts separate themselves from others to stop the spread of the virus, linking infected and exposed people with community resources during quarantine or self-isolation, and assisting employers in the determination of whether the exposure occurred at work.
+
Contact tracing is a vital investigatory tool in an employer's efforts to reduce the spread of the virus in the workplace. If contact tracing is done promptly and well, it can help determine who had close contact with an employee exposed to or infected with COVID-19, so that they can quarantine. A proper contact-tracing investigation also can help an employer determine the likelihood that an employee who is positive for COVID-19 contracted the illness in the workplace, or elsewhere. That's important for Cal/OSHA's recording requirements and for handling workers' compensation cases.
  
However, contact tracing does have some limitations. It does not stop all systematic spread; since investigation starts after symptoms appear, it must be done quickly to be effective; it has the potential to create privacy and confidentiality issues if not handled correctly.
+
==What Is Contact Tracing?==
  
Despite limitations, contact tracing is a valuable and legally required tool to limit the spread of COVID-19. Employers should develop contact tracing policies as part of their return to work procedures to inform employees of the need for investigation if an employee contracts the virus. In this process, employees should be made aware that the intention is not to interrogate or pass judgment, or to interfere with their private lives outside of work.  Contact tracing is done to collect information to keep all workers safe.  All data collected during this process must be kept confidential and only used to track COVID-19 cases and monitor risk in the workplace.  Information collected during the investigation should never be placed in an employee’s personnel file.
+
Contact tracing is an investigation to identify employees, vendors, suppliers or clients with whom an employee might have had close contact at work. Contract tracing can be used in conjunction with a required Cal/OSHA investigation to help determine where an employee with COVID-19 contracted the illness. The key to effective contract tracing is to do it quickly to reduce the risk that other employees will be exposed to the virus, and to comply with Cal/OSHA requirements to provide a safe workplace for employees.
  
Contact tracing and notification underscores the importance of social distancing at work. Employers can encourage social distancing by incorporating it into return to work policies and practices, modifying work spaces, staggering schedules, encouraging telework, creating workflows that limit interaction, and more.  The less close contact and movement employees have within the workplace the lower exposure rates might be and the less likely the employer will need to contact trace. All the processes, procedures and efforts made to social distance will assist the employer in its contact tracing efforts and investigations into whether suspected or confirmed COVID-19 cases are work-related.
+
Contact tracing has many potential benefits. They can include:
  
==CDC GUIDANCE ON CONTACT TRACING==
+
<ul>
 +
<li>educating infected people about how to avoid spreading the virus;</li>
 +
<li>helping exposed contacts separate themselves from others to stop the spread of the virus;</li>
 +
<li>linking infected and exposed people with community resources during quarantine or self-isolation; and</li>
 +
<li>helping employers determine if the exposure occurred at work.</li>
 +
</ul>
  
The CDC has issued guidance on contact tracing for health departments because contact tracing has traditionally been the job of federal state and local health departments. https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/investigating-coivd-19-case.html  The guidance is expansive and detailed and parts may not be applicable to most employers but it is worth highlighting parts of the guidance that do affect employers. The CDC recommends the following COVID-19 specific practices:
+
Contact tracing, however, has limitations.
  
• Contact tracing should be conducted for close contacts (any individual within 6 feet of an infected person for at least 15 minutes) of laboratory confirmed positive coronavirus test or probable COVID-19 patients.
+
<ul>
• Remote communications for the purposes of case investigation and contact tracing should be prioritized; in person communication may be considered only after remote options have been exhausted.
+
<li>It does not stop all systematic spread because investigation starts only after symptoms appear.</li>
• Testing is recommended for all close contacts of confirmed or probable COVID-19 patients.
+
<li>It must be done quickly to be effective.</li>
• Those contacts who test positive (symptomatic or asymptomatic) should be managed as a confirmed COVID-19 case.
+
<li>It has the potential to create privacy and confidentiality issues if not handled correctly.</li>
• Asymptomatic contacts testing negative should self-quarantine for 14 days from their last exposure (i.e., close encounter with confirmed or probable COVID-19 case).
+
</ul>
• If testing is not available, symptomatic close contacts should self-isolate and be managed as a probable COVID-19 case. If testing is not available asymptomatic close contacts should self-quarantine and be monitored for 14 days after their last exposure, with linkage to clinical care for those who develop symptoms. See https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html
 
  
==CONTACT TRACING METHODS==
+
Despite limitations, contact tracing is a valuable and legally required tool to limit the spread of COVID-19. Employers should develop contact-tracing policies as part of their return-to-work procedures, informing employees of the need to investigate if an employee contracts the virus. The information should be clear to employees that such investigations are not adversarial or judgmental. They are not intended to intrude into their private lives outside of work. Employees should understand that the purpose of contact tracing is to collect information to keep all workers safe.
  
Contact tracing can be done using traditional investigatory methods or through the use of newly developed mobile apps that utilize smart phone and mobile phone technology. Using technology to contact tracing can be more rapid, more accurate, and more effective than traditional face to face investigatory contact tracing methods.
+
All data collected during the process must be kept confidential and used only to track COVID-19 cases and monitor risk in the workplace. Information collected during the investigation should never be placed in an employee’s personnel file.
 +
 
 +
Contact tracing and notification underscore the importance of social distancing at work. Employers should encourage social distancing by:
 +
 
 +
<ul>
 +
<li>incorporating it into return-to-work policies and practices;</li>
 +
<li>modifying workspaces (for example, by creating workflows that limit interaction);</li>
 +
<li>staggering schedules; and</li>
 +
<li>encouraging telework.</li>
 +
</ul>
 +
 
 +
The less close contact and movement employees have within the workplace, the lower the potential exposure, and the less likely the employer will need to trace contacts. All efforts to maintain social distance will make contact-tracing investigations more efficient and useful in determining if confirmed cases of COVID-19 are work related.
 +
 
 +
==CDC Guidance on Contact Tracing==
 +
 
 +
[https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html The Centers for Disease Control and Prevention (CDC)] has issued guidance on contact tracing, which traditionally has been the job of federal, state and local health departments. The guidelines are expansive and detailed, and some might not apply to most employers. Still, all employers should review the site in conjunction with formulating their contact-tracing policies.
 +
 
 +
As more is learned about the virus and how it spreads, the CDC updates its guidance, including the definition of close contact and its recommendations regarding contact tracing.
 +
 
 +
The CDC recommends [https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html these practices] specific to COVID-19:
 +
 
 +
<ul>
 +
<li>Contact tracing should be conducted for close contacts of people who have tested positive for coronavirus, or for probable COVID-19 patients. The CDC recently broadened the definition of "close contact," expanding the the universe of people who might be considered such contacts for purposes of tracing them. The [https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/appendix.html#contact new definition] is "[s]omeone who was within 6 feet of an infected person for a cumulative total of 15 minutes or more over a 24-hour period starting with 2 days before illness onset (for asymptomatic patients, 2 days prior to test specimen collection) until the patient is isolated." Previously, "close contact" was someone who had been within 6 feet of an infected person for at least 15 minutes.</li>
 +
<li>Remote communications are preferred for investigating cases and contact tracing; in-person communication may be considered only after remote options have been exhausted.</li>
 +
<li>All close contacts of confirmed or probable COVID-19 patients should be tested.</li>
 +
<li>Contacts who test positive (symptomatic or asymptomatic) should be managed as a confirmed COVID-19 case.</li>
 +
<li>Asymptomatic contacts who test negative should self-quarantine for 14 days from their last exposure (that is, a close encounter with a confirmed or probable COVID-19 case).</li>
 +
<li>If testing is not available, symptomatic close contacts should self-isolate and be managed as a probable COVID-19 case; asymptomatic close contacts should self-quarantine and be monitored for 14 days after their last exposure, and referred to clinical care if they develop symptoms.</li>
 +
</ul>
 +
 
 +
'''Effect of the New Definition of "Close Contact"'''
 +
 
 +
The broader definition of "close contact" considers cumulative rather than consecutive contact. That means that a person exposed three times in a 24-hour hour period –– for five minutes during each encounter –– would meet the new definition. So the sphere of people for contact-tracing purposes is greatly expanded. When determining whether an employee has been exposed to an infected employee for 15 minutes or more, employers must consider shorter interactions between workers that might occur throughout the day or the days prior to infection. Determining what is a close contact must be done regardless of whether the individual was wearing a face mask or other PPE. The CDC does offer some flexibility within the definition by including factors influencing a close-contact analysis:
 +
 
 +
<ul>
 +
<li>proximity of the infected worker to the close contact (closer distance = increased exposure); </li>
 +
<li>duration of the exposure (longer exposure = increased risk);</li>
 +
<li>if the infected worker has symptoms;</li>
 +
<li>if the infected worker likely generated respiratory aerosols (for example, was coughing, talking loudly, etc.);</li>
 +
<li>other factors (inside or outside, ventilation, crowding, etc).</li>
 +
</ul>
 +
 
 +
The broader definition establishes a much lower threshold to require quarantine that could result in staffing issues. The [https://www.cdc.gov/coronavirus/2019-ncov/hcp/disposition-in-home-patients.html CDC recommends] sending employees home to self-monitor for 14 days if they had close contact with the infected employee. The only exception is when the business is considered essential or critical infrastructure. In that case, the close contact of the infected worker may continue to work while self-monitoring and wearing a face mask. 
 +
 
 +
The revised definition is a reminder to employers to monitor social distancing and the use of PPE for all employees at the work site.
 +
 
 +
==Contact-Tracing Methods==
 +
 
 +
Contact tracing can be done using traditional investigatory methods or through the use of newly developed apps for mobile devices. Using technology to trace contacts can be faster, more accurate and more effective than traditional face-to-face contact-tracing investigations.
  
 
===Investigatory Method===
 
===Investigatory Method===
  
Once an employer learns an employee has tested positive for COVID-19 or has a family member who has tested positive it should immediately initiate its contact tracing policy. The steps and questions asked will vary by employer and industry but below is a basic checklist of steps to follow.
+
Once an employer learns that an employee has tested positive for COVID-19 or has a family member who has tested positive, it should initiate contact tracing immediately. The precise approach to collect information will vary by employer and industry, but here's a basic process:
 +
 
 +
#Designate a specfic team or an individual to perform the contact tracing.
 +
#Educate the team (or individual) about the importance of contact tracing, and train members how to interview employees and notify affected contacts. The team/person should be identified and trained before employees return to work.
 +
#Identify and interview employees with confirmed or potential COVID-19 illness with dispatch.
 +
#Notify employees who may have been exposed.
 +
#Keep investigative information confidential in separate files and never in personnel files.
 +
 
 +
 
 +
Gather as much information as possible about the symptomatic employee’s work location.
  
1. Have a designated team or individual to perform the contact tracing.
+
<ul>
 +
<li>Do employees share equipment, tools or supplies?</li>
 +
<li>Who sits or works near the affected employee’s work location?</li>
 +
<li>Were the proximate employees working in the 48 hours before the affected employee first showed symptoms?</li>
 +
</ul>
  
Train a contact tracing team or individual about the importance of contact tracing, how to successfully perform it, how to interview employees and notify affected contacts.  This team or person should be identified and trained prior to employees returning to work.
+
Interview symptomatic employees as soon as possible after they are identified. Investigators should ask for the names of all employees, visitors, vendors, clients or others with whom they had close contact in the workplace starting from 48 hours of the appearance of symptoms.
  
2. Identify and interview employees with confirmed or potential COVID-19 illness.
+
Employers should question employees about possible outside exposure immediately on learning of a confirmed or suspected case to help determine the likelihood of work-related exposure. Prompt investigation also will help employers to notify co-workers and others of potential exposure. Investigators should ask the affected employee how he or she believes the illness was contracted without assuming it was at the workplace.
  
Gather as much information as possible about the symptomatic employee’s work location.  Do employees share equipment, tools, or supplies? Who sits or works near the affected employee’s work location?  Were these employees working in the 48 hours before the affected employee first showed symptoms? This will provide the investigator information on who may have been exposed.
+
In addition, investigators should get the names of family members with whom the employee had contact and to identify all locations outside of work the employee visited in the 48 hours before symptoms appeared. The possibilities are many –– the grocery store, church, restaurants, doctors’ offices, school, etc. Investigators should learn whom the employee spoke to at any location, and if he or she knows of any positive test results or potential exposure any of these contacts might have.
  
Interview the symptomatic employee as soon as possible after they are identified.  Interviewers should ask for the names of all employees, visitors, vendors, clients or others they had close contact with in the workplace starting from 48 hours before symptoms appeared through the time of the interview.
+
Employees should be asked specifically about close contact with any individual in the 48 hours before symptoms appeared or, if asymptomatic, 48 hours before a positive test. [https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html Close contact is defined by the CDC] as people within 6 feet for at least 15 minutes.
  
Employers should question employees about possible outside exposure immediately upon learning of a confirmed or suspected case. Contact tracing not only will assist employers in determining whether exposure was work related, it will also help them notify co-workers and others of potential exposure.  Be sure to ask the employee how he or she believes the illness was contracted and don't assume it was at the workplace. Be sure to inquire
+
Employees identified in No. 2 above should be informed of contact with a person in the workplace who is suspected or confirmed to have COVID-19. To maintain confidentiality, they should not be told who is the infected employee. Contacts should be given guidelines for self-quarantine, told to contact their health-care provider if they experienced COVID-19 symptoms, and given the chance to ask questions about quarantine and benefits. Potentially exposed employees asked to quarantine might be eligible for expanded sick leave benefits under the Families First Coronavirus Response Act (FFCRA).
  
In addition, interviewers should ask for the names of family members the employee had contact with and to identify all locations outside work the employee visited in the last 48 hours before symptoms appeared. These places could include the grocery store, church, restaurants, doctors’ offices, schools etc.  Be sure to ask about who the employee spoke to, and whether they are aware of any positive test results or potential exposure of any of these individuals.
+
According to the CDC, employers should send home any employees who have had a risk of exposure. They should be advised to maintain social distance, and self-monitor for 14 days from the exposure. If a business is considered essential, however, the CDC says that exposed employees may continue to work. We recommend, however, that exposed employees, whenever possible, be sent home and allowed to quarantine for the 14-day period to reduce chances of the workplace becoming a coronavirus hotspot.
  
Employees should be specifically asked about close contact with any individual they had contact with in the 48 hours before symptoms began or, if asymptomatic 48 hours before a positive test.  Close contact is defined by the CDC as contacts within 6 feet for at least 15 minutes.  https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html
+
===Contact-Tracing Apps===
  
3. Notify employees who may have been exposed.
+
The technology for contact-tracing tools is evolving rapidly. Typically, digital contact tracing alerts the user if he or she has been in contact with someone who has reported having a positive coronavirus test or COVID-19 diagnosis. Notification occurs under defined parameters –– for example, length of time with or proximity to the contact. Some apps are tied to smartphones, and others involve wearable smart devices. Similar technology also can be used to encourage social distancing through proximity tracking and beaconing between devices.
  
Employees identified in Step 2 should be informed they had contact with a person in the workplace who is suspected or confirmed to have COVID-19. To maintain confidentiality, they should not be told the name of the infected employee. Contacts should be given guidelines for self-quarantine, told to contact their healthcare provider if they experienced COVID-19 symptoms and given the chance to ask questions about quarantine and benefits.  Remember that potentially exposed employees asked to quarantine may be eligible for expanded sick leave benefits under the Families First Coronavirus Response Act (FFCRA).
+
Broadly, apps can estimate the distance between two individuals who come in contact, and can estimate the time of contact. For example, if the users are fewer than 6 feet apart for, say, 15 minutes, the app logs the encounter. When the app user tests positive for coronavirus infections, and identifies himself or herself, any other user that had an encounter can be notified of the risk for infection.
  
4. Keep investigative information confidential in separate investigative files and never in personnel files
+
The details vary of how these apps work. For example:
  
According to the CDC, employers should send home any employees who have had a risk of exposure and advise them to maintain social distancing and self-monitor for 14 days from the exposure.  If a business is considered essential, however, CDC Guidelines say exposed employees can continue to work.  However, it is recommended that exposed employees, whenever possible, should be sent home and allow the quarantine for the 14-day time period to ensure that your workplace does not become a coronavirus hotspot.
+
<ul>
 +
<li>what qualifies as an “encounter” –– that is, what is considered an epidemiologically relevant distance within an epidemiologically relevant time period;</li>
 +
<li>details of how an infection risk is notified;</li>
 +
<li>additional information that might be logged;</li>
 +
<li>who hosts the information collected about the user; and</li>
 +
<li>the amount of information stored by the app and for how long.</li>
 +
</ul>
  
===Contact Tracing Apps===
+
Of course, the effectiveness of the apps depends on all employees consistently using them. One downside of the app is that it doesn't provide the employer with sufficient information to determine whether the worker who tests positive for COVID-19 contracted the virus at work or some other place. Employers still must conduct an investigation to determine the likelihood of workplace exposure.
  
The technology regarding contact tracing tools is evolving rapidly. Digital contact tracing is typically set up to alert the user if he or she has been in contact with someone who has reported having a coronavirus positive test result or COVID-19 diagnosis, with notification occurring under certain defined parameters (for example, length of time of the contact or proximity of contact). Some apps are tied to smartphones, while others involve wearable smart devices.  Similar technology may also be used to help encourage social distancing through proximity tracking and beaconing between devices.
+
There are many unanswered questions about how contact-tracing apps work and how effective they will be. Employers should evaluate their app options for functionality before implementing one in the workplace. Among other concerns, they should study:
  
Broadly, apps can be used to track and estimate the distance between two individuals who come in contact by estimating the distance between them and the length of the contact.  For example, if the users are less than six feet apart for a sufficient period of time, the app logs the encounter.  When a user of the app identifies him or herself as having tested positive for a coronavirus infection, any other user that had an encounter can then be notified of the potential infection risk.
+
<ul>
 +
<li>what data are being collected;</li>
 +
<li>how the data are being stored (on an individual’s device or an external server);</li>
 +
<li>how long the data will be kept/stored;</li>
 +
<li>whether the app’s developer has continued access to the information; and</li>
 +
<li>what data security measures are in place (such as encryption and anonymization).</li>
 +
</ul>
  
The details of how these apps work very widely and are often dependent on the technology’s developer. For example, among other details, the following can all vary:  What qualifies as an “encounter” (that is, what is considered an epidemiologically relevant distance and an epidemiologically relevant time period); the details of the notification of an infection risks; additional information that may be logged by the app; the hosts of the information collected about the apps user; and the amount of information stored by the app and for how long.
+
Employers also should determine how contact-tracing tools will be tailored for their business. Will the tool be voluntary or mandatory? If mandatory, will employees be discharged if they refuse to use the tool or try to disable it? Will the tool track contacts only during work hours or outside work time as well? Who in the organization will have access to information collected through the tool?
  
Of course, the effectiveness of these apps is dependent on all employees consistently using the apps. One downside of the app is that it does not provide the employer with sufficient information to determine whether the COVID-19 positive employee contracted the illness while at work or elsewhere.  Employers must still conduct an investigation to determine whether it’s likely the virus was contracted at work.
+
With the rapid speed of app development, guidance from federal and state jurisdictions probably will be issued. Now, however, legal guidance is limited.
  
There are many unanswered questions about how contact tracing apps will work and how effective the tools will be.  Employers evaluating these tools may want to review any app and its functionality before implementing it in the workplace.  Among other issues, it is important that employers evaluate and understand technical issues including, but not limited to, the following:
+
==Legal Considerations for Contact Tracing and the Use of Contact-Tracing Apps==
 +
===Privacy, Data and Cyber Security===
  
• What data is being collected;
+
Although there is no U.S. privacy law, California has several laws that protect an employee’s privacy. In general, California employees have the right to/expectation of no unreasonable, substantial or serious interference with their privacy unless these rights are outweighed by a legitimate business interest (in this case, protecting the health and safety of the employer’s workforce). The business interest must be addressed by using the least intrusive means, such as collecting only the minimal information necessary to meet a specific goal, and anonymizing all information to the extent possible.
  
• How the data is being stored (on an individual’s device or an external server);
+
On Jan. 1, 2020, the [https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121 California Consumer Privacy Act (CCPA)] went into effect. The CCPA grants California employees and consumers robust data privacy rights and control over their personal information, including the right to know and the right to delete personal information collected. The CCPA applies to any business, including any for-profit entity that collects consumer’s personal data, and satisfies at least one of these:
  
• How long the data will be kept/stored;
+
<ul>
 +
<li>has annual gross revenues in excess of $25 million;</li>
 +
<li>buys, receives or sells the personal information of 50,000 or more consumers or households; and/or</li>
 +
<li>earns more than half its annual revenue from selling consumer’s personal information.</li>
 +
</ul>
  
• Whether the app’s developer has continued access to the information;
+
Employees are included in the definition of “consumer,” so they are protected under this law. The term "employee" may include applicants, current/former employees, independent contractors and owners/directors/officers.
  
• What data security measures are in place (such as encryption and anonymization).
+
The CCPA expands employee rights, as it requires privacy notices and disclosures about the data collected by employers and the purpose for collection; allows for damages if the employee’s personal information is breached; and expands the right to request access to or deletion of personal information.
 +
Given the broad coverage of CCPA to for-profit businesses of a certain size, any covered employer who elects to use a contact-tracing app probably would be required to adhere to the CCPA notification requirement. So affected employers should prepare CCPA-compliant notices detailing the app to be used for contact tracing, the data to be collected, the purpose of data collection, where the data will be stored and who will have access to it. In addition, employees should be notified of their right to request access to the data collected and their right to have the information deleted after use. We also recommend that employers include an authorization that employees agree to use the app.
  
In addition, employers should also evaluate how contact tracing tools will be tailored for their workplace. Factors include whether the tool will be voluntary or mandatory, if mandatory, will employees be discharged if they refuse to use the tool or try to “turn it off”, will the tool only track contacts during work hours or outside work time, and who in the organization will have access to information collected through the tool.
+
The [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=56.10.&lawCode=CIV Confidentiality of Medical Information Act (CMIA)] applies to collected medical information and requires specific notices at collection and consent to share the information. The CMIA is intended to provide even greater privacy protection for medical information than does HIPAA. The act also requires employers who received medical information to safeguard it, and prohibits them from disclosing medical information without employee authorization.<ref>Code of Civil Procedure § 56.20 - § 56.245</ref> Given the rise and transparency required under state consumer protection laws, employers should have a COVID-19 policy that discloses all types of data collected in the contact-tracing app, and explain the purpose of such collection. Also, businesses should request employees' consent to the use of contact-tracing apps or GPS tracking.
  
As these tools continue to be developed at a rapid pace, it is likely that additional guidance from federal and state jurisdictions will be issued. However, at this time, there is limited legal guidance in the use of these applications.
+
Assuming adherence to these legal standards, an employer still would have to overcome cultural, workplace, demographic and socioeconomic differences that might limit mobile-enabled, technology-based contact tracing. Critically, effectiveness probably requires widespread adoption at a regional level. Also, many employees may not carry their phones with them at all times as a matter of personal habit or because of employment restrictions. So if the contact-tracing app is tied to a personal cellphone, it might be difficult to get accurate information, especially if it's collected while an employee is off work.
  
==LEGAL CONSIDERATIONS WITH CONTACT TRACING AND THE USE OF CONTACT TRACING APPS==
+
Contact tracing also raises various legal issues and concerns under the Americans with Disabilities Act, regarding privacy and confidentiality considerations.
  
===Privacy, Data and Cyber Security Considerations===
+
Employers have a duty under OSHA to maintain safe working environment for their employees and to furnish a “place of employment, ... free from recognized hazards that are causing or likely to cause death or serious physical harm.” This can be a minefield for employers, but it works both ways. Considering the relatively easy transmission of the virus, according to the CDC, the employer’s obligation to investigate whether any COVID-19 infections among its employees are work related, and its responsibility to provide a safe workplace, employers have ample support for implementing a contact-tracing program that mandates employee participation.
  
Although there is no nationwide privacy law in the United States, California has several privacy laws that protect an employee’s privacy rights.  In general, California employees have the right or expectation against unreasonable, substantial or serious interference with privacy unless the right or expectation is outweighed by a legitimate business interest (here, protecting the health and safety of employer’s workforce), and provided that the interest is met using the least intrusive means (for example, collecting only the minimal information necessary to accomplish the employer’s goal and anonymizing such information to the maximum extent possible).
+
===Equal Employment Opportunity Commission and Americans with Disabilities Act===
  
On January 1, 2020, the California Consumer Privacy Act (CCPA) went into effect. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
+
Neither the EEOC nor California’s Department of Fair Employment and Housing (DFEH) has issued guidance on contact tracing or contact-tracing apps. The EEOC, however, has issued guidelines on other employer responses to the pandemic, allowing greater than normal flexibility. The DFEH has concurred.  
The CCPA grants California employees and consumers robust data privacy rights and control over their personal information, including the right to know and the right to delete personal information collected. The CCPA applies to any business, including any for-profit entity that collects consumer’s personal data, and satisfies at least one of the following thresholds: Has annual gross revenues in excess of $25,000,000.00, or buys, receives, or sells the personal information of $50,000.00 or more consumers or households, or earns more than half of its annual revenue from selling consumer’s personal information.
 
  
Employees, are included in the definition of “consumer” and therefore are protected under this law. Employee includes applicants, current/former employees, independent contractors and owners/directors/officers. The CCPA expands employee rights as it requires mandatory privacy notices and disclosures about the data collected by employers and the purpose for collection; allows for damages if the employee’s personal information is breached, and it expands the right to request access to or deletion of personal information.
+
Specifically, employers may take employees' temperatures, may screen employees daily for symptoms, exclude employees from the workplace if they exhibit symptoms of COVID-19 and restrict access to the workplace by employees who are deemed to be a “direct threat” to the health or safety of others as a result of their COVID-19 exposure. Of course, any screening or assessment required by employers must be business related, serve business needs and no more intrusive than necessary. This is discussed in-depth in [[Disability and Reasonable Accommodations under the American with Disabilities Act & the Fair Employment and Housing Act]].
  
Given the broad coverage of CCPA to for-profit businesses of a certain size, it is likely any covered employer who elects to use a contact tracing app would be required to adhere to the CCPA notification requirement. As a result, affected employers should prepare CCPA compliant notices detailing the app that is going to be used for contact tracing, the data that will be collected, the purpose of data collection, where the data will be stored and who will have access to it.  In addition, employees should be notified of their right to request access to the data collected and their right to have the information delated after use. Furthermore, it is recommended that employers include an authorization wherein employees agree to use of the app.
+
Given the flexibility the EEOC has provided employers to deal with the coronavirus, it's probable that the ADA would allow for the use of a contact-tracing app for purposes of identifying employees who have had close contact with someone who has a positive or probable case of COVID-19. To avoid the appearance of discriminating against disabled employees, or others within an EEOC-protected category such as age, employers who use contact-tracing apps must be sure to require all employees to use them, not just some. The business reason for the collection of data –– for example, to ensure the health and safety of the workforce –– probably outweighs employee privacy concerns, as long as privacy and confidentiality guidelines are followed.
  
The Confidentiality of Medical Information Act (CMIA) applies to medical information collected and requires specific notices at collection and consent to share the information.  Civil Code section 56. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=56.10.&lawCode=CIVC
+
We recommend that employers considering the use of contact-tracing apps contact us to ensure that proper notice, disclosure and consent forms are provided to employees.
CMIA is intended to provide even greater privacy protection for medical information than does HIPAA.  CMIA also requires employers who received medical information to safeguard that information, and prohibits them from disclosing medical information without employee authorization.  California Civil Code §56.20-§56.245.  Given the rise and transparency required under State Consumer-Protection Laws, employers should have a COVID-19 policy that discloses all types of data collected in the contact tracing app and explain the purpose of such collection.  It is also recommended that businesses request employees to consent to the use of contact tracing apps or GPS tracking.
 
  
Assuming adherence to the legal standards outlined above, and employer would still to overcome cultural, workplace, demographic, and socioeconomic differences that may limit mobile enabled, technology-based contact tracing effectiveness.  Importantly, effectiveness likely requires widespread adoption at a regional level.  Other considerations include the fact that many employees may not carry their phones with them at all times as a matter of personal habit or employment restrictions.  Therefore, if the contact tracing app is tied to the personal cellphone, it may be difficult to get accurate information, especially if information is being collected while an employee is off work.
+
==See Also==
  
Contact tracing raises a variety of legal issues and concerns including the Americans with Disabilities Act, privacy and confidentiality considerations.  Employers have a duty under OSHA to maintain safe working environment for their employees and to furnish worker’s employment.  and a “place of employment, which are free from recognized hazards that are causing or likely to cause death or serious physical harm.”  Considering the relative easy transmission of the virus according to the CDC, and the employer’s obligation to investigate whether any COVID-19 infections among its employees are work-related, coupled with its responsibility to provide a safe workplace, provide employers with ample arguments to implement a contact tracing program that mandates employee participation.
+
[[FAQs – Contact-Tracing Investigations]]
  
===EEOC and Americans with Disabilities Act Considerations===
+
----
  
Neither the EEOC nor California’s Department of fair Employment and Housing (DFEH) has issued guidance on contact tracing or contact-tracing apps, but the EEOC has issued guidance on other employer responses to the pandemic and has allowed greater flexibility to employers in response to the pandemic and the DFEH has adopted the guidance.  Specifically, employers may take employees temperatures, screen employees on a daily basis for symptoms, exclude employees from the workplace if they are exhibiting symptoms of COVID-19, and restrict access to the workplace to employees who are deemed to be a “direct threat” to the health or safety of others as a result of their COVID-19 exposure.  Of course, any screening or assessment required by employers must be business-related, serve business needs and not be more intrusive than necessary.  Given the flexibility the EEOC has given employers to deal with the coronavirus it is probable the ADA would allow for the use of a contact-tracing apps for purposes of identifying employees who have had close contact with an employee who has a positive or probable case of COVID-19.  In addition, employers who use contact tracing apps need to be sure they require all employees to use the apps, not just those with medical conditions, to avoid appearing to discriminate against employees who may be disabled or fall into another EEOC protected category like age.  The business reason for the collection of data (insure the health and safety of the workforce) likely outweighs the employees privacy concerns so long as privacy and confidentiality guidelines are followed. 
 
  
To employers considering use of contact tracing apps we recommend contacting us to insure the proper notice, disclosure and consent forms are provided to employees.
+
<center>
 +
{| class="wikitable"
 +
! [[Employer Response to COVID-19 in the Workplace|< Employer Response to COVID-19 in the Workplace]] !! [[Navigating COVID-19: A Legal Guide For California Employers|Table of Contents]] !! [[FAQs — Contact-Tracing Investigations|FAQs — Contact-Tracing Investigations >]]
 +
|-
 +
|}
 +
</center>

Latest revision as of 22:34, 13 January 2024

< Previous Table of Contents Next >


Gov. Newsom said that the ability to conduct contact tracing is important for businesses when they decide to reopen. They should understand the contact-tracing process, and why it's required.

Contact tracing is a vital investigatory tool in an employer's efforts to reduce the spread of the virus in the workplace. If contact tracing is done promptly and well, it can help determine who had close contact with an employee exposed to or infected with COVID-19, so that they can quarantine. A proper contact-tracing investigation also can help an employer determine the likelihood that an employee who is positive for COVID-19 contracted the illness in the workplace, or elsewhere. That's important for Cal/OSHA's recording requirements and for handling workers' compensation cases.

What Is Contact Tracing?

Contact tracing is an investigation to identify employees, vendors, suppliers or clients with whom an employee might have had close contact at work. Contract tracing can be used in conjunction with a required Cal/OSHA investigation to help determine where an employee with COVID-19 contracted the illness. The key to effective contract tracing is to do it quickly to reduce the risk that other employees will be exposed to the virus, and to comply with Cal/OSHA requirements to provide a safe workplace for employees.

Contact tracing has many potential benefits. They can include:

  • educating infected people about how to avoid spreading the virus;
  • helping exposed contacts separate themselves from others to stop the spread of the virus;
  • linking infected and exposed people with community resources during quarantine or self-isolation; and
  • helping employers determine if the exposure occurred at work.

Contact tracing, however, has limitations.

  • It does not stop all systematic spread because investigation starts only after symptoms appear.
  • It must be done quickly to be effective.
  • It has the potential to create privacy and confidentiality issues if not handled correctly.

Despite limitations, contact tracing is a valuable and legally required tool to limit the spread of COVID-19. Employers should develop contact-tracing policies as part of their return-to-work procedures, informing employees of the need to investigate if an employee contracts the virus. The information should be clear to employees that such investigations are not adversarial or judgmental. They are not intended to intrude into their private lives outside of work. Employees should understand that the purpose of contact tracing is to collect information to keep all workers safe.

All data collected during the process must be kept confidential and used only to track COVID-19 cases and monitor risk in the workplace. Information collected during the investigation should never be placed in an employee’s personnel file.

Contact tracing and notification underscore the importance of social distancing at work. Employers should encourage social distancing by:

  • incorporating it into return-to-work policies and practices;
  • modifying workspaces (for example, by creating workflows that limit interaction);
  • staggering schedules; and
  • encouraging telework.

The less close contact and movement employees have within the workplace, the lower the potential exposure, and the less likely the employer will need to trace contacts. All efforts to maintain social distance will make contact-tracing investigations more efficient and useful in determining if confirmed cases of COVID-19 are work related.

CDC Guidance on Contact Tracing

The Centers for Disease Control and Prevention (CDC) has issued guidance on contact tracing, which traditionally has been the job of federal, state and local health departments. The guidelines are expansive and detailed, and some might not apply to most employers. Still, all employers should review the site in conjunction with formulating their contact-tracing policies.

As more is learned about the virus and how it spreads, the CDC updates its guidance, including the definition of close contact and its recommendations regarding contact tracing.

The CDC recommends these practices specific to COVID-19:

  • Contact tracing should be conducted for close contacts of people who have tested positive for coronavirus, or for probable COVID-19 patients. The CDC recently broadened the definition of "close contact," expanding the the universe of people who might be considered such contacts for purposes of tracing them. The new definition is "[s]omeone who was within 6 feet of an infected person for a cumulative total of 15 minutes or more over a 24-hour period starting with 2 days before illness onset (for asymptomatic patients, 2 days prior to test specimen collection) until the patient is isolated." Previously, "close contact" was someone who had been within 6 feet of an infected person for at least 15 minutes.
  • Remote communications are preferred for investigating cases and contact tracing; in-person communication may be considered only after remote options have been exhausted.
  • All close contacts of confirmed or probable COVID-19 patients should be tested.
  • Contacts who test positive (symptomatic or asymptomatic) should be managed as a confirmed COVID-19 case.
  • Asymptomatic contacts who test negative should self-quarantine for 14 days from their last exposure (that is, a close encounter with a confirmed or probable COVID-19 case).
  • If testing is not available, symptomatic close contacts should self-isolate and be managed as a probable COVID-19 case; asymptomatic close contacts should self-quarantine and be monitored for 14 days after their last exposure, and referred to clinical care if they develop symptoms.

Effect of the New Definition of "Close Contact"

The broader definition of "close contact" considers cumulative rather than consecutive contact. That means that a person exposed three times in a 24-hour hour period –– for five minutes during each encounter –– would meet the new definition. So the sphere of people for contact-tracing purposes is greatly expanded. When determining whether an employee has been exposed to an infected employee for 15 minutes or more, employers must consider shorter interactions between workers that might occur throughout the day or the days prior to infection. Determining what is a close contact must be done regardless of whether the individual was wearing a face mask or other PPE. The CDC does offer some flexibility within the definition by including factors influencing a close-contact analysis:

  • proximity of the infected worker to the close contact (closer distance = increased exposure);
  • duration of the exposure (longer exposure = increased risk);
  • if the infected worker has symptoms;
  • if the infected worker likely generated respiratory aerosols (for example, was coughing, talking loudly, etc.);
  • other factors (inside or outside, ventilation, crowding, etc).

The broader definition establishes a much lower threshold to require quarantine that could result in staffing issues. The CDC recommends sending employees home to self-monitor for 14 days if they had close contact with the infected employee. The only exception is when the business is considered essential or critical infrastructure. In that case, the close contact of the infected worker may continue to work while self-monitoring and wearing a face mask.

The revised definition is a reminder to employers to monitor social distancing and the use of PPE for all employees at the work site.

Contact-Tracing Methods

Contact tracing can be done using traditional investigatory methods or through the use of newly developed apps for mobile devices. Using technology to trace contacts can be faster, more accurate and more effective than traditional face-to-face contact-tracing investigations.

Investigatory Method

Once an employer learns that an employee has tested positive for COVID-19 or has a family member who has tested positive, it should initiate contact tracing immediately. The precise approach to collect information will vary by employer and industry, but here's a basic process:

  1. Designate a specfic team or an individual to perform the contact tracing.
  2. Educate the team (or individual) about the importance of contact tracing, and train members how to interview employees and notify affected contacts. The team/person should be identified and trained before employees return to work.
  3. Identify and interview employees with confirmed or potential COVID-19 illness with dispatch.
  4. Notify employees who may have been exposed.
  5. Keep investigative information confidential in separate files and never in personnel files.


Gather as much information as possible about the symptomatic employee’s work location.

  • Do employees share equipment, tools or supplies?
  • Who sits or works near the affected employee’s work location?
  • Were the proximate employees working in the 48 hours before the affected employee first showed symptoms?

Interview symptomatic employees as soon as possible after they are identified. Investigators should ask for the names of all employees, visitors, vendors, clients or others with whom they had close contact in the workplace starting from 48 hours of the appearance of symptoms.

Employers should question employees about possible outside exposure immediately on learning of a confirmed or suspected case to help determine the likelihood of work-related exposure. Prompt investigation also will help employers to notify co-workers and others of potential exposure. Investigators should ask the affected employee how he or she believes the illness was contracted without assuming it was at the workplace.

In addition, investigators should get the names of family members with whom the employee had contact and to identify all locations outside of work the employee visited in the 48 hours before symptoms appeared. The possibilities are many –– the grocery store, church, restaurants, doctors’ offices, school, etc. Investigators should learn whom the employee spoke to at any location, and if he or she knows of any positive test results or potential exposure any of these contacts might have.

Employees should be asked specifically about close contact with any individual in the 48 hours before symptoms appeared or, if asymptomatic, 48 hours before a positive test. Close contact is defined by the CDC as people within 6 feet for at least 15 minutes.

Employees identified in No. 2 above should be informed of contact with a person in the workplace who is suspected or confirmed to have COVID-19. To maintain confidentiality, they should not be told who is the infected employee. Contacts should be given guidelines for self-quarantine, told to contact their health-care provider if they experienced COVID-19 symptoms, and given the chance to ask questions about quarantine and benefits. Potentially exposed employees asked to quarantine might be eligible for expanded sick leave benefits under the Families First Coronavirus Response Act (FFCRA).

According to the CDC, employers should send home any employees who have had a risk of exposure. They should be advised to maintain social distance, and self-monitor for 14 days from the exposure. If a business is considered essential, however, the CDC says that exposed employees may continue to work. We recommend, however, that exposed employees, whenever possible, be sent home and allowed to quarantine for the 14-day period to reduce chances of the workplace becoming a coronavirus hotspot.

Contact-Tracing Apps

The technology for contact-tracing tools is evolving rapidly. Typically, digital contact tracing alerts the user if he or she has been in contact with someone who has reported having a positive coronavirus test or COVID-19 diagnosis. Notification occurs under defined parameters –– for example, length of time with or proximity to the contact. Some apps are tied to smartphones, and others involve wearable smart devices. Similar technology also can be used to encourage social distancing through proximity tracking and beaconing between devices.

Broadly, apps can estimate the distance between two individuals who come in contact, and can estimate the time of contact. For example, if the users are fewer than 6 feet apart for, say, 15 minutes, the app logs the encounter. When the app user tests positive for coronavirus infections, and identifies himself or herself, any other user that had an encounter can be notified of the risk for infection.

The details vary of how these apps work. For example:

  • what qualifies as an “encounter” –– that is, what is considered an epidemiologically relevant distance within an epidemiologically relevant time period;
  • details of how an infection risk is notified;
  • additional information that might be logged;
  • who hosts the information collected about the user; and
  • the amount of information stored by the app and for how long.

Of course, the effectiveness of the apps depends on all employees consistently using them. One downside of the app is that it doesn't provide the employer with sufficient information to determine whether the worker who tests positive for COVID-19 contracted the virus at work or some other place. Employers still must conduct an investigation to determine the likelihood of workplace exposure.

There are many unanswered questions about how contact-tracing apps work and how effective they will be. Employers should evaluate their app options for functionality before implementing one in the workplace. Among other concerns, they should study:

  • what data are being collected;
  • how the data are being stored (on an individual’s device or an external server);
  • how long the data will be kept/stored;
  • whether the app’s developer has continued access to the information; and
  • what data security measures are in place (such as encryption and anonymization).

Employers also should determine how contact-tracing tools will be tailored for their business. Will the tool be voluntary or mandatory? If mandatory, will employees be discharged if they refuse to use the tool or try to disable it? Will the tool track contacts only during work hours or outside work time as well? Who in the organization will have access to information collected through the tool?

With the rapid speed of app development, guidance from federal and state jurisdictions probably will be issued. Now, however, legal guidance is limited.

Legal Considerations for Contact Tracing and the Use of Contact-Tracing Apps

Privacy, Data and Cyber Security

Although there is no U.S. privacy law, California has several laws that protect an employee’s privacy. In general, California employees have the right to/expectation of no unreasonable, substantial or serious interference with their privacy unless these rights are outweighed by a legitimate business interest (in this case, protecting the health and safety of the employer’s workforce). The business interest must be addressed by using the least intrusive means, such as collecting only the minimal information necessary to meet a specific goal, and anonymizing all information to the extent possible.

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA) went into effect. The CCPA grants California employees and consumers robust data privacy rights and control over their personal information, including the right to know and the right to delete personal information collected. The CCPA applies to any business, including any for-profit entity that collects consumer’s personal data, and satisfies at least one of these:

  • has annual gross revenues in excess of $25 million;
  • buys, receives or sells the personal information of 50,000 or more consumers or households; and/or
  • earns more than half its annual revenue from selling consumer’s personal information.

Employees are included in the definition of “consumer,” so they are protected under this law. The term "employee" may include applicants, current/former employees, independent contractors and owners/directors/officers.

The CCPA expands employee rights, as it requires privacy notices and disclosures about the data collected by employers and the purpose for collection; allows for damages if the employee’s personal information is breached; and expands the right to request access to or deletion of personal information. Given the broad coverage of CCPA to for-profit businesses of a certain size, any covered employer who elects to use a contact-tracing app probably would be required to adhere to the CCPA notification requirement. So affected employers should prepare CCPA-compliant notices detailing the app to be used for contact tracing, the data to be collected, the purpose of data collection, where the data will be stored and who will have access to it. In addition, employees should be notified of their right to request access to the data collected and their right to have the information deleted after use. We also recommend that employers include an authorization that employees agree to use the app.

The Confidentiality of Medical Information Act (CMIA) applies to collected medical information and requires specific notices at collection and consent to share the information. The CMIA is intended to provide even greater privacy protection for medical information than does HIPAA. The act also requires employers who received medical information to safeguard it, and prohibits them from disclosing medical information without employee authorization.[1] Given the rise and transparency required under state consumer protection laws, employers should have a COVID-19 policy that discloses all types of data collected in the contact-tracing app, and explain the purpose of such collection. Also, businesses should request employees' consent to the use of contact-tracing apps or GPS tracking.

Assuming adherence to these legal standards, an employer still would have to overcome cultural, workplace, demographic and socioeconomic differences that might limit mobile-enabled, technology-based contact tracing. Critically, effectiveness probably requires widespread adoption at a regional level. Also, many employees may not carry their phones with them at all times as a matter of personal habit or because of employment restrictions. So if the contact-tracing app is tied to a personal cellphone, it might be difficult to get accurate information, especially if it's collected while an employee is off work.

Contact tracing also raises various legal issues and concerns under the Americans with Disabilities Act, regarding privacy and confidentiality considerations.

Employers have a duty under OSHA to maintain safe working environment for their employees and to furnish a “place of employment, ... free from recognized hazards that are causing or likely to cause death or serious physical harm.” This can be a minefield for employers, but it works both ways. Considering the relatively easy transmission of the virus, according to the CDC, the employer’s obligation to investigate whether any COVID-19 infections among its employees are work related, and its responsibility to provide a safe workplace, employers have ample support for implementing a contact-tracing program that mandates employee participation.

Equal Employment Opportunity Commission and Americans with Disabilities Act

Neither the EEOC nor California’s Department of Fair Employment and Housing (DFEH) has issued guidance on contact tracing or contact-tracing apps. The EEOC, however, has issued guidelines on other employer responses to the pandemic, allowing greater than normal flexibility. The DFEH has concurred.

Specifically, employers may take employees' temperatures, may screen employees daily for symptoms, exclude employees from the workplace if they exhibit symptoms of COVID-19 and restrict access to the workplace by employees who are deemed to be a “direct threat” to the health or safety of others as a result of their COVID-19 exposure. Of course, any screening or assessment required by employers must be business related, serve business needs and no more intrusive than necessary. This is discussed in-depth in Disability and Reasonable Accommodations under the American with Disabilities Act & the Fair Employment and Housing Act.

Given the flexibility the EEOC has provided employers to deal with the coronavirus, it's probable that the ADA would allow for the use of a contact-tracing app for purposes of identifying employees who have had close contact with someone who has a positive or probable case of COVID-19. To avoid the appearance of discriminating against disabled employees, or others within an EEOC-protected category such as age, employers who use contact-tracing apps must be sure to require all employees to use them, not just some. The business reason for the collection of data –– for example, to ensure the health and safety of the workforce –– probably outweighs employee privacy concerns, as long as privacy and confidentiality guidelines are followed.

We recommend that employers considering the use of contact-tracing apps contact us to ensure that proper notice, disclosure and consent forms are provided to employees.

See Also

FAQs – Contact-Tracing Investigations



< Employer Response to COVID-19 in the Workplace Table of Contents FAQs — Contact-Tracing Investigations >
  1. Code of Civil Procedure § 56.20 - § 56.245

Learn more about our services:

SullivanAttorneys.com

Workers’ Comp, Simplified.

Sullivan On Comp