|04.09.20| MIT develops app to anonymously trace COVID-19 contacts; Connected health growing, but HIPAA still misunderstood

A research effort based out of MIT is looking to individuals' smartphones as tools for automatic COVID-19 contact tracing, but it's taking a unique approach that doesn't log GPS data or other potentially identifying information.

Rather, the multi-organization Private Automatic Contact Tracing (PACT) team is turning to smartphones' Bluetooth functionality – or more specifically, the short-range data strings known as "chirps" that smartphones regularly emit to connect with other devices.

By downloading a PACT app, individuals enable their phone to continuously send out these random data strings and keep a log of those from other participating devices it has encountered. If a user is diagnosed with COVID-19 by a healthcare professional, they would receive a QR code that notifies a cloud system of their status and uploads their list of received chirps.

All other participants in the system would be able to initiate a scan of the collective logs at any time through their own app and, if any of their outbound chirps match an instance stored in the cloud, would be warned of a potential (but still anonymous) COVID-19 contact. Of note, the system also keeps track of the approximate distance between each individual's device and that of their contact, as well as a rough estimate of the time they spent in range of the chirps.

“I keep track of what I’ve broadcasted, and you keep track of what you’ve heard, and this will allow us to tell if someone was in close proximity to an infected person,” Ron Rivest, an MIT Institute Professor and principal investigator of the PACT project, told the institution's communications outlet, MIT News. “But for these broadcasts, we’re using cryptographic techniques to generate random, rotating numbers that are not just anonymous, but pseudonymous, constantly changing their ‘ID,’ and that can’t be traced back to an individual.”

Once launched, participants will be able to download and join the effort "in a number of ways," according to MIT News, one of which is through another digital COVID-19 effort already launched by the organization called SafePaths.

WHY IT MATTERS

Manual contact-tracing is a labor-intensive task for any public health organization, let alone one overwhelmed by the magnitude of COVID-19. Once established and distributed, automated systems such as these could not only cut back on that burden, but also notify officials of incidental contact that the infected individual might not recall or even be aware of.

“In order for the U.S. to really contain this epidemic, we need to have a much more proactive approach that allows us to trace more widely contacts for confirmed cases," Dr. Louise Ivers, executive director of the Massachusetts General Hospital Center for Global Health and an advisor on the project, told MIT's communications outlet. "This automated and privacy-protecting approach could really transform our ability to get the epidemic under control here and could be adapted to have use in other global settings.”

But the particular appeal of PACT over several other automated contact-tracing or behavior-tracking projects is the minimal amount of data collection it requires. Bluetooth-enabled smartphones already keep a record of the chirps they have sent and received, and the project's database only maintains the outbound chirps of a positive case's device – in other words, no location data, and just a one-way log of unique contact events that can only be completed by a match from the second device.

The team hopes that being transparent with their approach and ensuring user privacy will help drive greater adoption of the platform and, ultimately, more comprehensive contact-tracing.

“We’re not tracking location, not using GPS, not attaching your personal ID or phone number to any of these random numbers your phone is emitting,” Daniel Weitzner, a principal research scientist in the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) and PACT's co-principal investigator, told MIT News. “What we want is to enable everyone to participate in a shared process of seeing if you might have been in contact, without revealing, or forcing anyone to reveal, anything.”

THE LARGER TREND

Several countries have already begun looking into, or have rolled out, mobile-phone-based efforts to track the spread of coronavirus among their citizenry that are often based on GPS tracking. Reports coming out just a few weeks ago that the U.S. government was discussing similar GPS-based efforts with leading tech companies.

Policy thought leaders have gone back and forth on the concept. For instance, former FDA Comissioner Dr. Scott Gottlieb floated the idea of GPS tracking on cellphone apps to ensure home isolation as a potential component of a robust coronavirus response in a report penned the other week. But more recently, he signed onto a Duke Center for Health Policy working paper that preferred "timely contact tracing ... augmented by technology" to "cell phone-based apps recording proximity events between individuals," due to concerns that these apps would not be well adopted, insufficiently discriminate between cases and contacts and potentially introduce privacy or security issues.

But the privacy and effectiveness debate hasn't stopped big tech from repurposing the data it's already collecting to help combat the disease. Within the past week alone, both Google and Facebook launched maps and reports to the public describing large-scale movement, behaviors and potential contacts within certain regions.

Even before the current crisis, connected technology and the Internet of Health Things were growing in prominence and adoption. Now, spurred on by people’s efforts to stay at home as much as possible, this technology is even more important.

But as health information and health data move into the homes and into consumers’ personal devices, concerns about privacy and security are giving pause to some providers and consumers.

“It’s probably fair to say that the healthcare industry is a little bit lagging in some respects compared to other industries that have picked up and used the internet connectivity and sensors for real-time data analytics,” Brian Scarpelli, senior global policy counsel at the Connected Health Initiative, said during a recent HIMSS Digital event. “There’s a very legitimate reason for that, and I don’t mean this as a knock, because in the healthcare sector, safety and life is so paramount in so much of what is done.”

Scarpelli joined Joy Pritts, a consultant and former ONC chief privacy officer, to discuss patient data privacy in the world of connected health and what HIPAA does and doesn’t cover. (Take the quiz on this page to test your knowledge of the 1996 law’s scope).

What people often don’t realize, Pritts said, is that HIPAA was created to keep data safe as it moves between health insurers and providers, so data that doesn’t interact with that ecosystem is often not protected at all. On the other hand, information that does fall under the law’s purview is often more protected than people realize.

“You’ll hear people say, ‘We only collect their name, phone number and the fact that they were a client of this particular doctor,’” Pritts said. “Guess what? You have already made something protected health information with just those three pieces of information.”

And when HIPAA doesn’t apply, it can be confusing to figure out what does. Scarpelli and Pritts described a “patchwork” of regulations including GDPR, the California Consumer Privacy Act, and FTC guidelines. And Congress is working on a cross-sectoral data-privacy framework that could affect health data in interesting ways.

Other laws to protect patient privacy can also conflict with HIPAA – for instance, laws that include a right for people to delete data about them can conflict with guidelines that require doctors to maintain complete and accurate records.

Pritts and Scarpelli advised that organizations concerned about their use of health information follow some best practices.

The “Get out of Jail Free” card that’s common to almost all privacy laws is that if you have the user’s explicit permission you can use and share their data in any way they’ve agreed to. So when in doubt, get permission.

Additionally, companies large and small need to confront privacy questions early and head-on.

“If, at the top of your organization, privacy is just another box to check, then all of your employees will have that attitude and you should not be surprised if there’s poor compliance,” Pritts said. “Rather, if you set up a pro-privacy culture up front that this is something you do, you expect everyone else to do, and you take it into account up front, and aim for the future so you can build into this, you’ll be much better off.”