How schools are navigating privacy concerns in COVID-19 contact tracing

As plans to reopen schools have ramped up across the country, so too have administrators’ efforts to contain the spread of the deadly coronavirus.

That’s why many districts have turned to contact tracing, a system that aims to identify and alert those who may have been exposed to students and staff members who have tested positive for COVID-19.

How that’s accomplished varies widely from district to district. And while, overall, experts say these efforts are off to a good start, some methods have raised concerns about student privacy.

Mixed methods

In Tennessee’s Cleveland City School District, students are wearing masks, eating lunch in their classrooms and social distancing in hallways. Teachers are staying at their desks.

When someone starts showing symptoms of the disease — before there’s even a positive COVID test — those precautions go one step further. 

“Maybe we look at seating charts … who they maybe spent time with in the hallway — anyone that we can determine has been within 6 feet for greater than 15 minutes,” said Laura Hudson, coordinator of school health for the district. 

If the test comes back positive, principals are told to send home any students who were identified as contacts through these so-called “pre-tracing” efforts. 

School nurses are the ones taking charge of contact tracing in Cleveland City Schools, which have seen about 25 positive cases so far this school year. The district currently has three active cases and 57 individuals in quarantine, according to the most recent data posted to its website at press time.

As in many states, that data also gets reported to the local and state health departments, which often partner with school districts on contact tracing efforts. 

“Contact tracing is a crucial component of any community’s attempt to address the spread of the novel coronavirus and COVID-19,” said Stacey Pelika, director of research at the National Education Association’s Center for Enterprise Strategy, which has an online dashboard with crowdsourced information about COVID-19 cases in pre-K-12.

“Schools and institutions of higher education have an interest as a public health matter, as well as possible legal obligations, to help facilitate contact tracing,” Pelika said.

One of the most notable efforts along these lines has been the Los Angeles Unified School District’s COVID-19 Testing and Tracing Program, which includes a goal to administer 20,000 COVID tests per day within a few weeks.

The district has partnered with research universities, healthcare companies and Microsoft on the program. All data collected will be kept in a secure database and remain private, according to the district’s website. Any information shared with outside parties, such as researchers who are studying these efforts, “will be in full compliance with privacy law and only with consent from any participant in the testing program.”

School officials with knowledge of the program were not available for comment as of press time.

Some districts have turned to apps, such as CrisisGo’s Safety iPass, in use by 200 schools and counting, according to the company. Individuals scan QR codes with their phones once they enter a building or classroom. That way when someone tests positive for COVID-19, the system can track who was there around the same time and may have been exposed.

Other technology solutions include software available from Qualtrics and Salesforce that help districts manage their COVID-19 responses, including digital contact tracing, all in one place.

With Qualtrics, anyone who tests positive gets an opt-in survey asking them to identify with whom they’ve been in contact. The system then sends email alerts — pre-written by the school district — to those contacts with next steps.

“You really have to do this with technology to be able to do it in any kind of scalable way,” said Omar Garriott, Qualtrics’ global industry lead for education. “It’s really important that we’re not just relying on symptom reporting but actual positive cases and being able to just cut that off at the knees. And that’s really what contact tracing allows you to do — quickly identify hotspots and take actions that can isolate those hotspots and not turn them into bigger problems, really.”

Privacy concerns

While many school districts have been collaborating with their local health departments, others are citing privacy concerns and refusing to release any information for fear of violating the Family Educational Rights and Privacy Act (FERPA) and Health Insurance Portability and Accountability Act (HIPAA) laws.

But privacy experts are crying foul, saying neither law applies in this case.

Paige Kowalski, executive vice president at Data Quality Campaign, said schools already contact parents when there’s an outbreak of lice or a stomach bug without identifying the student started it. 

As is the case in Cleveland City Schools and elsewhere, no one is handing over students’ private academic data or health records to county health departments.

“Schools are actually pretty good at sharing health information,” Kowalski said. “I think where this has gotten a little bit different is that COVID has been a little bit politicized, and the data around COVID has been a little bit politicized out there. And so these cases are being treated and perceived differently than if we were talking about lice or stomach flu or any other thing that may be going around the community that you want to inform and let people make reasonable protections.”

Kevin Brown, executive director of the Texas Association of School Administrators, said a superintendent in a small town recently came under fire for closing school after a student tested positive for the virus. When he wouldn’t release the student’s name, parents accused him of making it up as an attempt to keep students from attending in-person classes.

“You’re damned if you do, and you’re damned if you don’t,” he said.

Though he supports contact tracing, Brown said protecting students’ privacy throughout the process can be somewhat tricky in smaller schools with class sizes of five or six.

“You would have to be very careful that you don’t unintentionally out the person just because of numbers that are there,” Brown said. “I think you just have to be very careful about what it looks like.”

Where contact tracing efforts get murky for data privacy advocates is how school districts are collecting this information, especially with the various technology solutions popping up.

“You have some colleges that are requiring downloading contact tracing apps that may have just sprung up overnight and may require location data to be on and [are] tracking the day-to-day movements of every student, and possibly reporting that information to school administrators and others,” said Amelia Vance, director of youth and education privacy and senior counsel at the Future of Privacy Forum. 

Vance doesn’t know of any K-12 schools requiring the same, but would not be surprised if there are — and if their number is growing — especially because many schools already have location-tracking abilities when students are connected to the network, she said.

In Cleveland City Schools, no one has complained about privacy violations to the administration’s knowledge. But contact tracers have had to combat fears about the virus itself, letting people know that just because they’re being contacted doesn’t necessarily mean they have COVID-19.

“We’ve been sending students home for years with temperatures,” said Hudson. “So just that education piece, I think, is huge for our nurses to kind of convey to the teachers and then also to the students.