SHREVEPORT, La. — Days before Louisiana entered Phase One of reopening businesses following two months of shutdowns to prevent the spread of COVID-19, Gov. John Bel Edwards announced the state was hiring 700 contact tracers.
The contact tracing program is designed to track down people who may have come into contact with someone who tested positive for COVID-19, and keep them from spreading it. Within days after the announcement of the contact tracing program, the Louisiana Department of Health posted on its website that it had “received an overwhelming number of inquiries and applications for contact tracing positions.”
Salesforce and Accenture are contracted with the state to operate the information systems and two call centers for contact tracers.
A spokesperson for Salesforce declined a request for an interview, deferring to Louisiana state officials. A spokesperson for Accenture only provided the following statement:
“We are proud to help launch and support Louisiana’s COVID-19 contact tracing effort. Our work will include program management, information technology systems implementation, and support for call center operations.”
Some, like Shreveport attorney Royal Alexander, have questions about the lawfulness of contact tracing programs.
“What we're talking about … is privacy rights and privacy law, versus the public health and the public welfare,” Alexander said. “When we're talking about the data that's collected, what is it going to be used for, specifically? What is it not going to be used for?”
According to the Louisiana Department of Health, a contact tracer will call the person who tested positive for COVID-19 and ask them about where they’ve been and who they may have come into contact with.
“Close contact is defined as less than 6 feet of distance between yourself and another person who could have the coronavirus for a minimum of 15 minutes,” the health department’s website reads.
The contact tracer will then call the close contacts and provide them with information on how to protect themselves and others.
“By contacting people who may have been exposed, you can make them aware of that,” said Debbie Bain Brinkley of Global Strategic Information, which has partnered with local and state governments in California to develop an implement contact tracing strategies. “So they may not have symptoms, they may be asymptomatic and still be spreading the virus. So by telling them this, they can avoid contact with other people and passing it on yet again.”
Brinkley trains contact tracers, and said privacy is a major part of that training.
“There needs to be a policy in place, such that they're trained about HIPAA and protected health information,” Brinkley said. “It's quite clear that they are not to share any names of cases or contacts to people they're calling, or to anyone else.”
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law designed to protect patient privacy. Under HIPAA, names and other identifying information about patients cannot be shared. However, health officials and providers can release some information for the purpose of protecting public health, such as preventing the spread of an infectious disease. The information released must be the minimum amount needed to accomplish that purpose.
“That’s the whole thing,” Alexander said. “You’ve got to paint, with a tiny little brush, the minimum information necessary. What data is collected, for how long it's going to be kept, where it's going to be kept (and) did you have explicit consent?”
Sean Ellis, a spokesperson for the Louisiana Department of Health said in an email to 3 Investigates that information needed for contact tracing will be encrypted for security purposes and stored in a "HIPAA-compliant Salesforce Healthcloud."
“The Department of Health will save this information in a manner that is HIPAA compliant and only for a length of time that is relevant and supportive of the state’s ongoing response to COVID-19,” Ellis wrote.
According to Ellis, the information will not be shared with immigration or law enforcement authorities, nor will it be shared for commercial purposes. It can only be accessed by contact tracers and health officials with the purpose of containing COVID-19.
Because of HIPAA, Brinkley said people have the right to not share any information with contact tracers, though sharing is strongly encouraged by health officials.
“It is important for you to have an honest conversation with the person on the other end of the phone,” the health department’s website reads.
“We have a lot of important information that can protect their health and certainly the health of the people around them,” Brinkley said.
Ellis said Louisiana has no plans to develop a mobile app or use any cellphone data for contact tracing.
The health department has posted a transcript of a sample contact tracing phone call, along with other information, on its website.