View source for Contact-Tracing Investigations

Governor Newsome stated that the ability to conduct contact tracing is an important factor in business reopening decisions.  Businesses need to understand the contact tracing process, and the importance of this requirement.  

Contact tracing is an  important investigatory tool in an employer's efforts to reduce the spread of the virus in the workplace. If contact tracing is done promptly and well it can help determine who an exposed or COVID-19 infected employee had close contact with, ensure that these are quarantined and avoid further infection.  A proper contact tracing investigation can also help an employer determine whether a COVID-19 positive employee likely contracted the illness in the workplace or elsewhere, an important determination for CalOSHA recording requirements and handling workers compensation cases.

==WHAT IS CONTACT TRACING?==

Contact tracing is an investigation intended to identify employees, vendors, suppliers, or clients the employee may have had close contact with at work.  Contract tracing can be used in conjunction with a required CalOSHA investigation to determine whether an employee with COVID-19 contracted the illness at work or elsewhere.  The key to effective contract tracing is to do it quickly in order to reduce the risk that other employees will be exposed to the virus, and so the employer can comply with CalOSHA requirements to provide a safe workplace for employees.

Contact tracing has many potential benefits. These can include educating infected people about what steps to take to avoid spreading the virus, helping exposed contacts separate themselves from others to stop the spread of the virus, linking infected and exposed people with community resources during quarantine or self-isolation, and assisting employers in the determination of whether the exposure occurred at work.

However, contact tracing does have some limitations. It does not stop all systematic spread; since investigation starts after symptoms appear, it must be done quickly to be effective; it has the potential to create privacy and confidentiality issues if not handled correctly.

Despite limitations, contact tracing is a valuable and legally required tool to limit the spread of COVID-19.  Employers should develop contact tracing policies as part of their return to work procedures to inform employees of the need for investigation if an employee contracts the virus. In this process, employees should be made aware that the intention is not to interrogate or pass judgment, or to interfere with their private lives outside of work.  Contact tracing is done to collect information to keep all workers safe.  All data collected during this process must be kept confidential and only used to track COVID-19 cases and monitor risk in the workplace.  Information collected during the investigation should never be placed in an employee’s personnel file.

Contact tracing and notification underscores the importance of social distancing at work.  Employers can encourage social distancing by incorporating it into return to work policies and practices, modifying work spaces, staggering schedules, encouraging telework, creating workflows that limit interaction, and more.  The less close contact and movement employees have within the workplace, the lower exposure rates might be and the less likely the employer will need to contact trace. All the processes, procedures and efforts made to social distance will assist the employer in its contact tracing efforts and investigations into whether suspected or confirmed COVID-19 cases are work-related.

==CDC GUIDANCE ON CONTACT TRACING==

The Center For Disease Control (CDC) has issued guidance on contact tracing. Contact tracing has traditionally been the job of federal state and local health departments. This may be found at https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/investigating-coivd-19-case.html  The guidance is expansive and detailed, and parts may not be applicable to most employers. Be that as it may, employers should review this as they form their contact tracing policies. Of note, the CDC recommends the following COVID-19 specific practices:

•	Contact tracing should be conducted for close contacts (any individual within 6 feet of an infected person for at least 15 minutes) of laboratory confirmed positive coronavirus test or probable COVID-19 patients.
•	Remote communications for the purposes of case investigation and contact tracing should be prioritized; in person communication may be considered only after remote options have been exhausted.
•	Testing is recommended for all close contacts of confirmed or probable COVID-19 patients.
•	Those contacts who test positive (symptomatic or asymptomatic) should be managed as a confirmed COVID-19 case.
•	Asymptomatic contacts testing negative should self-quarantine for 14 days from their last exposure (i.e., close encounter with confirmed or probable COVID-19 case).
•	If testing is not available, symptomatic close contacts should self-isolate and be managed as a probable COVID-19 case. If testing is not available asymptomatic close contacts should self-quarantine and be monitored for 14 days after their last exposure, with linkage to clinical care for those who develop symptoms.  See https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html

==CONTACT TRACING METHODS==

Contact tracing can be done using traditional investigatory methods or through the use of newly developed mobile apps that utilize smart phone and mobile phone technology.  Using technology to contact tracing can be more rapid, more accurate, and more effective than traditional face to face investigatory contact tracing methods.

===Investigatory Method===

Once an employer learns an employee has tested positive for COVID-19 or has a family member who has tested positive it should immediately initiate its contact tracing policy. The steps and questions asked will vary by employer and industry but below is a basic checklist of steps to follow.

1.	Have a designated team or individual to perform the contact tracing.

Train a contact tracing team or individual about the importance of contact tracing, how to successfully perform it, how to interview employees and notify affected contacts.  This team or person should be identified and trained prior to employees returning to work.

2.	Identify and interview employees with confirmed or potential COVID-19 illness.

Gather as much information as possible about the symptomatic employee’s work location.  Do employees share equipment, tools, or supplies? Who sits or works near the affected employee’s work location?  Were these employees working in the 48 hours before the affected employee first showed symptoms? This will provide the investigator information on who may have been exposed.

Interview the symptomatic employee as soon as possible after they are identified.  Interviewers should ask for the names of all employees, visitors, vendors, clients or others they had close contact with in the workplace starting from 48 hours before symptoms appeared through the time of the interview.

Employers should question employees about possible outside exposure immediately upon learning of a confirmed or suspected case. Contact tracing not only will assist employers in determining whether exposure was work related, it will also help them notify co-workers and others of potential exposure.  Be sure to ask the employee how he or she believes the illness was contracted and don't assume it was at the workplace.  

In addition, interviewers should ask for the names of family members the employee had contact with and to identify all locations outside work the employee visited in the last 48 hours before symptoms appeared.  These places could include the grocery store, church, restaurants, doctors’ offices, schools etc.  Be sure to ask about who the employee spoke to, and whether they are aware of any positive test results or potential exposure of any of these individuals.

Employees should be specifically asked about close contact with any individual they had contact with in the 48 hours before symptoms began or, if asymptomatic 48 hours before a positive test.  Close contact is defined by the CDC as contacts within 6 feet for at least 15 minutes.  https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html

3.	Notify employees who may have been exposed.

Employees identified in Step 2 should be informed they had contact with a person in the workplace who is suspected or confirmed to have COVID-19.  To maintain confidentiality, they should not be told the name of the infected employee.  Contacts should be given guidelines for self-quarantine, told to contact their healthcare provider if they experienced COVID-19 symptoms and given the chance to ask questions about quarantine and benefits.  Remember that potentially exposed employees asked to quarantine may be eligible for expanded sick leave benefits under the Families First Coronavirus Response Act (FFCRA).

4.	Keep investigative information confidential in separate investigative files and never in personnel files

According to the CDC, employers should send home any employees who have had a risk of exposure and advise them to maintain social distancing and self-monitor for 14 days from the exposure.  If a business is considered essential, however, CDC Guidelines say exposed employees can continue to work.  However, it is recommended that exposed employees, whenever possible, should be sent home and allow the quarantine for the 14-day time period to ensure that your workplace does not become a coronavirus hotspot.

===Contact Tracing Apps===

The technology regarding contact tracing tools is evolving rapidly.  Digital contact tracing is typically set up to alert the user if he or she has been in contact with someone who has reported having a coronavirus positive test result or COVID-19 diagnosis, with notification occurring under certain defined parameters (for example, length of time of the contact or proximity of contact).  Some apps are tied to smartphones, while others involve wearable smart devices.  Similar technology may also be used to help encourage social distancing through proximity tracking and beaconing between devices.

Broadly, apps can be used to track and estimate the distance between two individuals who come in contact by estimating the distance between them and the length of the contact.  For example, if the users are less than six feet apart for a sufficient period of time, the app logs the encounter.  When a user of the app identifies him or herself as having tested positive for a coronavirus infection, any other user that had an encounter can then be notified of the potential infection risk.

The details of how these apps work very widely and are often dependent on the technology’s developer.  For example, among other details, the following can all vary:  What qualifies as an “encounter” (that is, what is considered an epidemiologically relevant distance and an epidemiologically relevant time period); the details of the notification of an infection risks; additional information that may be logged by the app; the hosts of the information collected about the apps user; and the amount of information stored by the app and for how long.

Of course, the effectiveness of these apps is dependent on all employees consistently using the apps.  One downside of the app is that it does not provide the employer with sufficient information to determine whether the COVID-19 positive employee contracted the illness while at work or elsewhere.  Employers must still conduct an investigation to determine whether it’s likely the virus was contracted at work.

There are many unanswered questions about how contact tracing apps will work and how effective the tools will be.  Employers evaluating these tools may want to review any app and its functionality before implementing it in the workplace.  Among other issues, it is important that employers evaluate and understand technical issues including, but not limited to, the following:

•	What data is being collected;

•	How the data is being stored (on an individual’s device or an external server);

•	How long the data will be kept/stored;

•	Whether the app’s developer has continued access to the information;

•	What data security measures are in place (such as encryption and anonymization).

In addition, employers should also evaluate how contact tracing tools will be tailored for their workplace.  Factors include whether the tool will be voluntary or mandatory, if mandatory, will employees be discharged if they refuse to use the tool or try to “turn it off”, will the tool only track contacts during work hours or outside work time, and who in the organization will have access to information collected through the tool.

As these tools continue to be developed at a rapid pace, it is likely that additional guidance from federal and state jurisdictions will be issued. However, at this time, there is limited legal guidance in the use of these applications.

==LEGAL CONSIDERATIONS WITH CONTACT TRACING AND THE USE OF CONTACT TRACING APPS==

===Privacy, Data and Cyber Security Considerations===

Although there is no nationwide privacy law in the United States, California has several privacy laws that protect an employee’s privacy rights.  In general, California employees have the right or expectation against unreasonable, substantial or serious interference with privacy unless the right or expectation is outweighed by a legitimate business interest (here, protecting the health and safety of employer’s workforce), and provided that the interest is met using the least intrusive means (for example, collecting only the minimal information necessary to accomplish the employer’s goal and anonymizing such information to the maximum extent possible).

On January 1, 2020, the California Consumer Privacy Act (CCPA) went into effect. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
The CCPA grants California employees and consumers robust data privacy rights and control over their personal information, including the right to know and the right to delete personal information collected.  The CCPA applies to any business, including any for-profit entity that collects consumer’s personal data, and satisfies at least one of the following thresholds:  Has annual gross revenues in excess of $25,000,000.00, or buys, receives, or sells the personal information of $50,000.00 or more consumers or households, or earns more than half of its annual revenue from selling consumer’s personal information.

Employees are included in the definition of “consumer” and therefore are protected under this law.  The term "Employee" can include applicants, current/former employees, independent contractors and owners/directors/officers.  The CCPA expands employee rights as it requires mandatory privacy notices and disclosures about the data collected by employers and the purpose for collection, allows for damages if the employee’s personal information is breached, and it expands the right to request access to or deletion of personal information.

Given the broad coverage of CCPA to for-profit businesses of a certain size, it is likely any covered employer who elects to use a contact tracing app would be required to adhere to the CCPA notification requirement.  As a result, affected employers should prepare CCPA compliant notices detailing the app that is going to be used for contact tracing, the data that will be collected, the purpose of data collection, where the data will be stored and who will have access to it.  In addition, employees should be notified of their right to request access to the data collected and their right to have the information delated after use. Furthermore, it is recommended that employers include an authorization wherein employees agree to use of the app.

The Confidentiality of Medical Information Act (CMIA) applies to medical information collected and requires specific notices at collection and consent to share the information. This is contained in Civil Code section 56 and can be found at https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=56.10.&lawCode=CIVC.
CMIA is intended to provide even greater privacy protection for medical information than does HIPAA.  CMIA also requires employers who received medical information to safeguard that information, and prohibits them from disclosing medical information without employee authorization.  California Civil Code §56.20-§56.245.  Given the rise and transparency required under State Consumer-Protection Laws, employers should have a COVID-19 policy that discloses all types of data collected in the contact tracing app and explain the purpose of such collection.  It is also recommended that businesses request employees to consent to the use of contact tracing apps or GPS tracking.

Assuming adherence to the legal standards outlined above, an employer would still have to overcome cultural, workplace, demographic, and socioeconomic differences that may limit mobile enabled, technology-based contact tracing effectiveness.  Importantly, effectiveness likely requires widespread adoption at a regional level.  Other considerations include the fact that many employees may not carry their phones with them at all times as a matter of personal habit or employment restrictions.  Therefore, if the contact tracing app is tied to the personal cellphone, it may be difficult to get accurate information, especially if information is being collected while an employee is off work.

Contact tracing raises a variety of legal issues and concerns including the Americans with Disabilities Act, privacy and confidentiality considerations.  Employers have a duty under OSHA to maintain safe working environment for their employees and to furnish a “place of employment, which are free from recognized hazards that are causing or likely to cause death or serious physical harm.”  This can be a minefield for employers, but it works both ways. Considering the relative easy transmission of the virus according to the CDC, and the employer’s obligation to investigate whether any COVID-19 infections among its employees are work-related, coupled with its responsibility to provide a safe workplace, employers have ample arguments supporting a contact tracing program that mandates employee participation.

===EEOC and Americans with Disabilities Act Considerations===

Neither the EEOC nor California’s Department of fair Employment and Housing (DFEH) has issued guidance on contact tracing or contact-tracing apps, but the EEOC has issued guidance on other employer responses to the pandemic and has allowed greater flexibility to employers in response to the pandemic and the DFEH has adopted the guidance.  Specifically, employers may take employees temperatures, screen employees on a daily basis for symptoms, exclude employees from the workplace if they are exhibiting symptoms of COVID-19, and restrict access to the workplace to employees who are deemed to be a “direct threat” to the health or safety of others as a result of their COVID-19 exposure.  Of course, any screening or assessment required by employers must be business-related, serve business needs and not be more intrusive than necessary.  Given the flexibility the EEOC has given employers to deal with the coronavirus it is probable the ADA would allow for the use of a contact-tracing apps for purposes of identifying employees who have had close contact with an employee who has a positive or probable case of COVID-19.  In addition, employers who use contact tracing apps need to be sure they require all employees to use the apps, not just those with medical conditions, to avoid appearing to discriminate against employees who may be disabled or fall into another EEOC protected category like age.  The business reason for the collection of data (insure the health and safety of the workforce) likely outweighs the employees privacy concerns so long as privacy and confidentiality guidelines are followed.  

To employers considering use of contact tracing apps we recommend contacting us to insure the proper notice, disclosure and consent forms are provided to employees.