Contact Tracing - It is more than just knowing

[~7 minutes read time, ~2 minutes video]

If you want to learn more about how Contact Tracing works and its Privacy concerns click here.

The WORLD is opening up and many of us will be walking into Brave New World that is filled with not just economic uncertainties but uncertainty about our life itself. As the global economic engine restarts, albeit, with lower horsepower, Contact Tracing will take the spotlight with offices and facilities reopening globally in the coming weeks. Perhaps the C-suite is scrambling to determine how to go about creating and assuring a safe workplace for the employees, customers, and suppliers. This article provides a framework for the C-suite that can help them to think about how they can strategize and mitigate some of the privacy risks that will come with it.

This is perhaps the first time for many organizations attempting Contact Tracing, so there is no ONE formula or an approach that would fit all. Contact Tracing involves collecting PII (Personally Identifiable Information) data. The nuances and implications of implementing the Contact Tracing initiative could be different for different organizations and industries.

(Assumption) As part of the COVID-19 business continuity, most organizations would have invoked their Crisis Management policies and established a clear communication strategy and plan. It is the legal and moral responsibility of the organization to ensure the safety and security of all the direct stakeholders with whom the business is conducted. At the minimum, most organizations will have the following direct and indirect stakeholders - Employees, Customers, Suppliers, Essential service providers, General public, and Facilities management. We will collectively call them the Users. These users would form the part of the contact tracing scope.

Yes, the pressure is on, however starting the Contact Tracing initiative without a clear strategy could have unintended consequences. Here are some of the points that the Business leaders have to keep in mind as they embark on implementing contact tracing initiatives:

1. Contact tracing is NOT a preventative solution to stop a COVID-19 outbreak in the workplace. It is a means to trace the root cause in case an outbreak occurs in the workplace. Contact tracing is HIGHLY effective with Social distancing policies.
2. Define the target segment that you want to track and trace. Selecting a wrong target segment to track and trace could result in attracting unwanted liabilities. For example, many organizations have different policies for the contingent vs. non-contingent workforce. Can the contingent workforce movements be tracked?. Define the 1st, 2nd, and 3rd-degree contact tracing audience.
3. Before launching the initiative make sure you are OVERcommunicating What you are doing?, Why you are doing?, When will it be done?, How it will be done?, and What it means to each stakeholder? and the role of various members of the organization. The communication strategy should be clearly customized to various user segments.
4. This is a business problem and not a technology problem. IT is just an enabler.
5. Contact tracing is a privacy issue and the initiative should be led by a task force that involves representation from the Information security department, Information technology department, Human Resources, Risk & Compliance, Legal, Facilities administration, and Business process excellence.
6. Prior consent/authorization from various target segments is required before starting the Contact Tracing initiative.
7. Contact tracing initiative is not a one-person activity, a team has to support the process on an ongoing basis until the time the initiative is active and should be part of the Information Security organization and/or HR.
8. All tracking DATA gathered as part of the contact tracing should be governed and secured with the highest confidentiality to ensure compliance with privacy regulations.

Start with a clear strategy and operating framework. The strategy and framework may not be perfect on day one, it will evolve with the process. However, care should be taken to ensure that it does not violate any of the privacy governance policies. Top-down communication is STRONGLY recommended before, during, and after the contact tracing initiative. Have a clear start date and a "proposed" end date for the initiative.

The framework above provides a simple view of all aspects of a typical contact tracing initiative.

Collecting accurately, organizing, and securing human movement data of the physical interactions is at the heart of the Contact Tracing process. This can be done in two ways, either by manual logging by the users themselves or by smart digital logging.

Manual logging is a laborious process where the users have to keep a journal to capture the physical interactions they have had in the day while performing their duties. The information in the journal is consolidated and stored securely for future use.

In today's digital age, most companies would prefer Smart digital contact tracing. This can be done either by using a smartphone app or a wearable sensor. The smartphone app would use built-in technologies such as Bluetooth Low Energy (BLE) beacon and GPS sensor that transmit location data and device identifier data. When another smartphone running the same app comes in proximity, the app will log the contact and perhaps also alert both smartphone users if they are not within their social distancing boundaries in the workplace. All of these happen in real-time. The data can be logged in the mobile phones and sent to a central database from where it can be accessed by authorized personnel. If in case either of the users has been found positive for the COVID-19 infection, then the data collected from the phone can be used to determine all potential users who may have come in contact with the infected user. This will help the authorities to easily track and alert other users of potential exposure to the infected user that can help take preventive measures and contain further spreading of the infection.

Not all organizations provide smartphones to their employees and employees may not be willing to have the organizations install tracing apps on their personal smartphones. In such cases, they can use wearables that perform the same function except that the user has to wear them when they are performing their job. The wearable can be tagged to a named user thereby ensuring that there is clear traceability of the social interactions.

Once the data is collected it has to be encrypted and secured. If an outbreak and the infected user is discovered, then the data can be shared with appropriate authorities to take preventative actions. Every measure has to be taken by the organization to secure the data so that in case of a data breach the user privacy is not compromised. A back-end server software can use data retention policy such that the user trace data is only stored for rolling 14 days.

Factors to consider while selecting a Contact Tracing solution includes:

• Ability to configure Data collection parameters
• Data security features that can ensure its integrity and prevent unauthorized access
• Data retention policy definition capability
• Ability to configure a workflow that can be used to alert managers or supervisors
• Geofencing and Proximity alerting for active safety
• Active Safety visualization and reporting capability
• Contact log management and access control
• Visual, Audible, Vibration alert capability
• Persistence memory capability to ensure the app works if there is no connectivity and logs the data on the device

While the above is more relevant from an organization perspective, many countries are actively engaged in creating a public version of the contact tracing app that does not collect PII information and is less intrusive. For example, Singapore and China have developed an advanced app that users expiring tokens in user's smartphones. In a public setting, scientists at Oxford University estimate that the app will be effective only if 60% of the population uses it. The video below from France 24 explains how this works.

COVID-19 pandemic has created some very unique challenges for global organizations, some of which are inconceivable and unheard of. As organizations prepare to resume business operations to operate in the Next-New-Normal, Digital technology will become the centerpiece of People management strategy.

We are all in this together!

Please do not hesitate to send your feedback to [email protected] or [email protected].

Thank you!