Should US enterprises use their own contact tracing tech?

Contact tracing has been cited by the Centers for Disease Control and Prevention as a critical component of slowing the spread of COVID-19 and safely relaxing social distancing orders.

But although tech giants like Apple and Google released their initial contact tracing solutions for public health organizations, these solutions are likely weeks, or even months away from launch due to the complexity of the US healthcare system. And adoption is further complicated as the contact tracing space grows noisier by the week, as some countries such as the UK look to develop their own solutions, separate from Apple and Google.

Our economy can’t wait; we need an alternative to enable companies to open their doors safely before public health solutions are available. Enterprise contact tracing solutions could help fill the gaps.

What’s holding state-wide contact tracing solutions back

Apple and Google’s technology is only open to public health organizations; it isn’t meant for enterprise use. The companies have developed a smartphone interface, a software developer kit and API call instructions meant to serve as the “starting gun” for public health organizations to develop their own contact tracing apps.

Public health authorities need to develop all of the elements of the app, including data storage infrastructure and functionality that enables privacy, transparency and consent, and that will take time.

All of this must happen within a healthcare system in which each organization uses its own suite of software solutions, many of which must be integrated into the Apple/Google solution for it to work. It’s a complex task that will take months and will likely be a regional effort only as a result. It will also complicate the tracking of employees who travel across state or international lines. Public health solutions may simply take too long for enterprises that have employees who can’t work remotely or that are facing an economic imperative to reopen.

How enterprise contact tracing could fill the gaps

In the meantime, enterprises can develop their own opt-in contact tracing solutions. Enterprise contact tracing apps would serve as an additional layer of protection for workers while public apps are in development, and they could potentially provide additional insights into transmission among targeted groups.

By relying on employees to share when they’ve contracted COVID-19, these solutions wouldn’t need to integrate with healthcare provider and insurer systems, which means they could be launched long before public contact tracing solutions are available.

Using technology that’s already widely available, businesses could design an enterprise contract tracing apps to work like this: Users with a company email address opt in to use the company’s apps, which anonymously gather device IDs from phones within six feet and turn on Bluetooth and Wi-Fi when they are inside an office or facility.

If someone tests positive, he or she then self-reports through the app, and anyone who has been nearby receives an exposure notification.

Those that were in close proximity to someone who has been infected can then self-quarantine and would be informed of their exposure faster than traditional contact tracing methods. The app would gather a minimum of user information – just a device ID, which can be stored in a secure database accessible by select HR personnel only.

Down the line, businesses could add additional functionality, like a symptom tracker that can be used to slow the spread of the seasonal flu and alerts for activities like hand-washing when a user enters or exits a geofence around a company facility.

Enterprise contact tracing privacy and adoption concerns

Adoption may be slowed if employees are hesitant to share health information with their employers – some simply may not feel comfortable with giving their employer that information. That’s why apps must be privacy-first and use technology like Bluetooth rather than private geolocation data to track interactions.

This ensures that the only information shared is an anonymous device ID – no personal or identifiable information ever leaves an employee’s phone. Companies must also enforce robust privacy, access and retention controls so data is accessible to company administrators/HR only.

Under HIPAA requirements, companies cannot require employees to share most health information, which means that enterprise apps will have to rely on self-reporting. Though this may prove to be a challenge to adoption unless privacy concerns are addressed, enterprise apps stand to have a higher rate of reporting than public apps due to a higher level of social cohesion in the workplace than in society in general. (A lack of social cohesion has been cited as a barrier to public contact tracing in the U.S.).

Enterprise contact tracing puts action behind the desire to keep a community safe, and people are more motivated to protect those they know and interact with frequently – such as their co-workers. Even if only a portion of employees choose to self-report, enterprise apps can still slow the spread of COVID-19.

These solutions, however, aren’t a replacement for public contact tracing. They can be used by individual companies to track disease transmission among their employees. And given the resources required to develop then, they’d work best at organizations that have large campuses or numerous offices – they likely aren’t a solution for small or medium-sized businesses.

Enterprise contact tracing can fill the gaps that will exist until state-wide solutions launch, and when paired with public contact tracing, it offers additional protection for employees. It can be launched quickly, offering the potential for enterprises to help reopen the US economy and prevent COVID-19 from spreading.

This article was contributed by Raja Roy, head of engineering at PK.