Ethical and Legal Issues in COVID-19 Case Investigation and Contact Tracing: A Case Study of A Large Academic Public Health Partnership

Abstract

In an effort to respond to the large surge in COVID-19 cases in Arizona that began between May and July 2020, the Arizona State University (ASU) Student Outbreak Response Team (SORT) formed a remote, volunteer-based case investigation team that worked in partnership with a local public health department through delegated public health authority.

Between March of 2020 and December 2021, Maricopa County, Arizona, the most populous county in Arizona and the fourth most populous county in the United States,¹ experienced over 865,000 cases of COVID-19.² At various points during 2020 and 2021, Maricopa County and Arizona were considered global hotspots and had the highest per capita COVID-19 infection rates in the United States.³ The overwhelming surge of new cases combined with limited public health staffing prompted an expanded partnership between Arizona State University’s (ASU) Student Outbreak Response Team (SORT) and Maricopa County Department of Public Health (MCDPH). This large, remote, scalable public health response team was tasked with conducting case investigations of individuals who had suspected or confirmed COVID-19 and to identify people who had been exposed to, and possible infected with, COVID-19.⁴

At the beginning of the COVID-19 pandemic, universal case investigation coupled with timely contact tracing was promoted as a key public health prevention strategy by the Association of State and Territorial Health Officials (ASTHO),⁵ the National Association of County and City Health Officials (NACCHO),⁶ and the Centers for Disease Control and Prevention (CDC).⁷ Case investigation includes the identification and interview of individuals with confirmed or probable infections. As part of the case investigation process, interviewers solicit a list of contacts (people who meet disease-specific criteria) who were potentially exposed to the disease through their interaction with the case and are at elevated risk of infection. A contact tracer will then try to notify these potential contacts of their risk of exposure, and provide guidance on how to monitor their symptoms and minimize the risk of further disease transmission.⁸ Many case investigation and contact tracing teams also provide education to cases, share social support resources, and make targeted referrals for testing locations, vaccination services, and other healthcare resources.

Case investigation and contact tracing processes differ based on the illness being investigated, resources available, and the local public health jurisdiction. For COVID 19 in the United States, most jurisdictions opted to use interview-based case investigation and contact tracing, in which case investigators reached out to each positive or presumed positive COVID-19 case by phone ⁹ (or more rarely door-to-door).¹⁰ Exposure notification was typically completed by phone or text notification.¹¹ Some jurisdictions also incorporated digital tracking methods using phone Bluetooth or even other wearable devices.¹²

Like many public health teams responding to the COVID 19 pandemic, SORT case investigators worked in a virtual, work-from-home environment, and cases were contacted via phone for health and efficiency reasons. Remote case investigation was necessary given the rapid increase in COVID-19 cases which required the team to conduct a high number of interviews in succession. During the interview, SORT case investigators obtained demographic information, medical history, symptoms, employment status and history, travel history, and vaccination status of cases using a structured interview template. Despite specific delegated executive and public health authority to conduct case investigations and contact tracing,¹³ SORT had to navigate challenging legal and ethical issues associated with confidentiality, mandatory reporting, and the scope of case investigations.

This paper uses the experience of a large academic-public health partnership to inform a discussion of the legal hurdles and ethical challenges encountered by SORT, as well as solutions SORT employed to continue safe and secure operations in the face of unpredictable waves of cases and legal uncertainty around the COVID-19 response in Arizona. Over the course of conducting case investigations, the legal and ethical issues encountered by SORT fell into three primary categories: (1) issues related to the confidentiality and privacy of cases protected health information and other confidential data, (2) mandatory reporting requirements of case investigators and supervisors to address issues such as child abuse, elder abuse and medical emergencies, and (3) issues regarding the scope of work that should be performed by case investigators.

In the past few years, several case studies have been published on how public health jurisdictions¹⁴ approached the process of interview-based case investigations and contact tracing during the COVID-19 pandemic. Most cursorily addressed the need for compliance with the Health Insurance Portability and Accountability Act (HIPAA) in public health practice and data collection during an emergent pandemic.¹⁵ Few, however, focused on the legal and ethical challenges that arose when conducting this delicate public health process remotely. Past studies have also not given sufficient attention to the need to provide ethics and legal training to teams comprised of those without legal experience and limited training in public health ethics.

The HIPAA Privacy Rule recognizes that public health authorities and others responsible for ensuring public health and safety have a legitimate need to access protected health information to carry out their public health mission. The Privacy Rule permits covered entities to disclose protected health information, without authorization, to public health authorities who are legally authorized to receive such reports for the purpose of preventing or controlling disease.¹⁶ While contact tracing and case investigation have been carefully designed to protect privacy, the large volume of contract tracing which is being carried out as part of the pandemic response in the United States, it is worth revisiting potential concerns around privacy, legality, and equity.

This paper uses the experience of a large academic-public health partnership to inform a discussion of the legal hurdles and ethical challenges encountered by SORT, as well as solutions SORT employed to continue safe and secure operations in the face of unpredictable waves of cases and legal uncertainty around the COVID-19 response in Arizona. Over the course of conducting case investigations, the legal and ethical issues encountered by SORT fell into three primary categories: (1) issues related to the confidentiality and privacy of cases protected health information and other confidential data, (2) mandatory reporting requirements of case investigators and supervisors to address issues such as child abuse, elder abuse and medical emergencies, and (3) issues regarding the scope of work that should be performed by case investigators.

ASU Student Outbreak Response Team (SORT)

Between June 2020 and October 2021, SORT trained over 450 case investigators. Those case investigators completed over 31,722 case interviews and elicited 24,884 close contacts. To meet the high demand for case investigations in light of soaring cases, SORT cast a wide net for recruiting volunteers and staff at the start of the pandemic. The team included undergraduate and graduate students whose academic focus ranged from biology to engineering to social work, as well as community members whose professional experience ranged from dog training to nursing.

In addition to navigating fluctuations in state public health authority and federal guidance throughout the pandemic, SORT had to ensure it complied with federal HIPAA data privacy requirements¹⁷ and expansive mandatory reporting statutes that cover children,¹⁸ vulnerable adults, and elders.¹⁹ The diverse disciplinary representation on the team meant that SORT case investigators had a wide range of baseline understandings about privacy concerns, HIPAA, public health, and ethics. Consequently, SORT had to navigate unexpected challenges that partially stemmed from this range in disciplinary backgrounds and public health experience. The large public health workforce added additional complications to help staff become oriented to rules that can be very complex and difficult to remember and follow. From its formation, SORT took extensive efforts to ensure that this diverse team operated in a manner that was not only ethically and legally compliant, but was one that also operated in a way that allowed for equitable community impact. This required navigating a difficult balance between rigorous data protection and remaining highly adaptive to manage a large volume of data during an unprecedented pandemic.

Arizona and the Legal Landscape Around COVID-19

Despite being a regional, national, and even global hotspot for COVID-19,²⁰ Arizona governmental entities have supported public health surveillance but limited public health legal authority and legal response options in the state, including restricting the ability of certain entities to require masks, vaccinations, or enact other response measures. The Arizona Governor first declared a public health emergency in response to COVID-19 on March 11th, 2020.²¹ A week later on March 23rd, 2020 another executive order added COVID-19 to the state’s list of mandatory report diseases and legally enhanced the ability for state and local health departments to surveil cases.²² This and subsequent executive orders ²³ required all COVID-19 testing labs to report the results of all COVID-19 tests, as well as the information about the case including their name, address, telephone number, date of birth, and gender, to the Arizona Department of Health Services. The governor extended this enhanced surveillance authority numerous times during the pandemic.²⁴

Despite extending the surveillance capabilities of state and local jurisdictions to track COVID-19, there were limited direct public health legal interventions such as mask requirements.²⁵ On June 15th, 2021, the governor issued an executive order preventing the Arizona Board of Regents and institutions of higher education in the state from requiring COVID-19 testing, masking, or vaccination for students.²⁶ Later that month, on June 30th, 2021, the state legislature passed House Bill 2898 which prohibited secondary schools from requiring students or staff to wear masks.²⁷ In September of the same year, an Arizona Superior Court judge found the anti-mask law unconstitutional under the state constitution Article IV pt. 2 § 13 because it was improperly included in a budget reconciliation bill.²⁸ Given these restrictions, entities, including the state secondary school system and the state university system were not able to respond to case data with policy, including interventions such as requiring masks during periods of high transmission.

Legal and Ethical Lessons Learned

The American medical system is known for presaging autonomy and individual decision-making over other ethical principles like beneficence, non-maleficence, and justice. However, during a public health emergency, the autonomy of the individual takes a backseat to the needs of the community. This shift in focus from individual to community needs can be a challenging transition for the public in the United States, where cultural understandings of health are often viewed from a lens of individualism and autonomy.

The three primary areas of legal and ethical issues are described in the sections following: (1) confidentiality and privacy; (2) mandatory reporting; and (3) scope of work.

Confidentiality and Privacy

In Arizona, the Governors’ COVID-19 surveillance executive orders enabled the health department to collect and assess data on COVID-19 cases in aggregate and individually. Case investigations and contact tracing involve handling both protected health information and other sensitive, confidential information. Case investigators have access to names, birthdates, addresses, phone numbers, and COVID-19 positive status before an investigation even begins. Ensuring that this health information is narrowly and properly disclosed to public health entities is essential. Proper handling of protected health information involves not only preventing unintentional disclosures by public health workers operating remotely, but also careful control of information to potential proxies on the phone who may be acting on behalf of the individual.

SORT used an entirely remote workforce who communicated internally and with cases via a variety of technological platforms, including Microsoft Teams, Zoom, and remote calling services like Amazon Connect.²⁹ The remote workforce required a different approach to monitoring and ensuring the security of each individual case investigators’ work environment given that each case investigator was not physically present in a secure workspace using a controlled computer.

SORT required all case investigators to sign a confidentiality agreement with both Maricopa County and the team itself. SORT also provided specific training about best practices for confidential remote case investigation work, including steps to ensure a secure internet connection, the use of headphones, ensuring that cohabitants of the workspace not be within earshot, and making sure to destroy of all written or typed notes outside the case file.³⁰ Case investigators were required to appear on camera via Zoom to confirm they were in a compliant environment prior to beginning a case investigation shift.

A second issue impacting confidentiality and privacy that arose early on was the use of proxies to conduct interviews for those who were unable to communicate via phone due to language barriers, physical or mental disability, or age. Given the population of Maricopa County, a significant portion of cases that SORT received were minors, elderly, or individuals who did not speak English proficiently enough to conduct an interview via phone.

In deciding how to proceed, the team had to weigh the risks of using a proxy against the potential benefits of collecting needed information to slow the spread of disease. When a proxy was used, there was risk that a person other than the COVID-19 positive case may learn of the diagnosis without the case’s explicit consent. This was balanced against the potential benefit to public health through the collection of data that more accurately reflected the diverse population that was contracting COVID-19. An additional public and individual benefit was the provision of resources and support to individuals from medically underserved populations. With the rapidly increasing number of positive cases, especially among the elderly and Hispanic populations in Maricopa County, the benefit of gaining key information relative to the tracking and tracing of the virus, as well as providing cases with informational resources, was considered to outweigh the risks to the individual.

The SORT leadership team, in consultation with ethicists at a local hospital system, developed a policy for conducting case investigation interviews via proxy that allowed for continued case investigations with these significant populations. Case interviews were conducted via proxy if at least one of two conditions was met: 1) the case provided explicit consent to be interviewed via proxy; or 2) the case was determined to lack the capacity to complete the interview themselves due to minor status, illness, or other disability, and the proxy was able to confirm key identifying information about the case such as birthdate or address. When possible, cases were referred to a language line at the health department (for languages other than English or Spanish) or transferred to a multi-lingual case investigator on the SORT team before resorting to a proxy interview. Without the ability to use proxies, a significant portion of cases would not have been included in data collection, severely limiting our understanding of the spread of COVID in these already underserved populations. Moreover, these cases would not have received access to resources like COVID-19 isolation and quarantine guidance, letters of excused absence for employers, or direction to additional COVID-19 resources such as rental assistance, mutual aid, and migrant assistance, among others.

Mandatory Reporting

Early in the pandemic, concerns arose that the combined social and economic stressors would lead to increased violence against vulnerable populations³¹ while simultaneously quarantine policies and school closures would limit interaction with external entities, such as schools, where mandatory reporting most commonly occurs.³² Given SORT’s significant call volume to elderly and minor cases, the team became increasingly concerned about requirements of case investigators to report findings to other entities in the state of Arizona, either ethically or by law. Given these concerns, SORT was acutely aware that interactions with cases and their families put case investigators in a unique position to potentially learn of issues with elder abuse and child abuse that were otherwise unseen. An ongoing program evaluation survey (unpublished) of 84 SORT case investigators in November of 2020 confirmed that the team frequently encountered cases facing difficult scenarios: 48% of case investigators reported working with a case that was expressing a high level of emotional distress.

Under Arizona statute,³³ medical professionals, social workers, peace officers, clergy, school personnel, and domestic violence victim’s advocates who “reasonably believe” that a minor has been subjected to abuse are required to report to a peace officer, department of child safety, or tribal authorities. The elder abuse statue³⁴ requires treating medical professionals, social workers, attorneys, accountants, and conservators to report any abuse, financial or physical, to a peace officer or protective services worker. In the context of case investigators conducting public health practice, there was not a clear legal duty to report either child or elder abuse. However, it was our teams’ determination that there was an ethical duty given the unique social isolation of the pandemic and the unique access of case investigators.

SORT developed a policy for reporting suspected cases of elder and child abuse that case investigators encountered. Line supervisors debriefed with case investigators after shifts and paid special attention to difficult call encounters. If a situation brought up concerns of abuse, line supervisors enlisted support of program management to determine next steps and/or reporting. Case investigators were provided with support to decompress after difficult calls and were often asked to assist with reporting processes. Collaborative decisions were made to determine who would make the report to the appropriate entity: line supervisors (many of whom were in active social work or healthcare delivery degree programs), or program managers. For example, while completing a case interview a case investigator learned of drug use in the home of a minor case. Concerned with the child’s well-being, the case investigator consulted with the line supervisor and a member of the management team (who is also a social worker) to review the details of the call. As there was reasonable belief that the minor was exposed to illicit drug use, the program manager reported the concerns to appropriate authorities.

SORT also encountered similar issues with medical emergencies. At various points in the pandemic, case investigators communicated with cases who were experiencing life-threatening symptoms of COVID-19 and were in urgent need of medical care. While there was no legal duty of case investigators to report medical emergencies, there was an ethical duty. SORT worked with partners and created procedures for responding to cases who were in active medical distress. These procedures included asking to speak with other individuals in the home who could help (if available), linking the case with appropriate state medical support hotlines for further assessment, and calling 911 on behalf of the case at the case’s request. In situations where case investigators were required to work with or consult with outside entities, SORT required an internal incident report be filed.

Scope of Practice

The scope of investigative duties for case investigators working on the line was an important issue for SORT. Case investigators were primarily undergraduate students and community volunteers who had undergone a public health training program. The young age and inexperience of many of the case investigators, combined with the wide range of information easily available on the internet led to concerns about what sources of information case investigators could “investigate” outside their case interviews.

For example, a case investigator could in theory search a case’s name on social media such as Facebook or Instagram and determine if a case was visiting and posting from restaurants and bars and violating isolation/quarantine recommendations. This was especially concerning as Maricopa County contains Phoenix and Scottsdale, two cities with a significant population of professional athletes and celebrities whose lives are widely publicized online, increasing the temptation. Additionally, while known ASU cases and those from ASU adjacent zip codes were excluded from SORT’s pool of cases, given the large population of ASU students who live within the county jurisdiction (74,795 students in Fall of 2020³⁵), there was a chance that ASU-affiliated case investigators could interview a classmate or colleague.

Given the sensitive information available to case investigators, such as birthdate and address, case investigators technically also had the ability to obtain additional information unrelated to COVID-19 case investigations using publicly available online sources. For example, case investigators could reverse-look up a case’s phone number in an attempt to identify additional details that were potentially relevant to a case interview (such as a case’s workplace). Case investigators with a birthdate and address could also use a variety of free online government websites, like the Maricopa County assessor and Maricopa County recorder to find a cases’ property records, valuation, personal liens, and court history.

While the legal duty of case investigators to maintain the confidentiality of case information was clear, the ethical duty of case investigators to refrain from seeking out publicly available information that could be useful to the goals of public health was less clear. For example, if a case failed to answer their phone, would it be acceptable to Google the case’s name and birthdate and discover the case had a criminal record and was currently serving prison time? Would it be acceptable to search a case’s name on Instagram and review their profile to see if they had been dishonest in their interview about not having left their house in the previous two weeks?

While other jurisdictions, especially those in other countries, utilized alternative sources of information for contact tracing,³⁶ in the United States, concerns about autonomy, privacy,³⁷ and a general suspicion of government and public health³⁸ impeded the use of digital contact tracing applications even if the user explicitly chose to make their data available for COVID-19 tracing.

Our team concluded our case investigators should not seek any additional information outside of the scripted interview questions. SORT provided guidance to case investigators that emphasized the autonomy of cases and respect for case decision making, including about what information they chose to share. Case investigators were instructed to conduct the interview and not to seek additional information from outside sources about the case’s actual whereabouts or behavior including confirmation of the address of a place of business, or the date of a public event attended.

As described earlier, the political and social climate in Maricopa County surrounding COVID-19 was at times extremely fraught. To this end, we recognized the importance of cultivating a relationship of trust between the case investigator and the case. This was important for facilitating the rehabilitation of perceptions of public health as not trustworthy and/or transparent, as well as prevent case investigator overreach.

Public facing communications explaining the process of case investigation and contact tracing were posted on the health department website and shared on social media channels. Another important component of building trust was an intensive in-house training on empathic communication to improve the experience of cases during the interview process.

Conclusion and Future Directions

SORT’s experiences offer a unique view into the decision-making of a public health team navigating legal frameworks, privacy protections, and security practices for management of sensitive health data. While contact tracing and case investigation have been carefully designed to protect privacy, the large volume of tracing which was carried out as part of the pandemic response in the United States highlighted important concerns around privacy, legality, and equity.

Public health response operates in a complex legal and ethical landscape. This case study illustrates how a combination of laws affected the operation of a specific component of public health intervention: case investigation/contact tracing. Local laws enabled data collection and dissemination to the public health department, and privacy laws governed data storage and patient case contact. Seemingly unrelated laws caused additional issues, such as mandatory reporting statutes. SORT navigated this complex legal and ethical environment to support the COVID-19 response.

It is important to consider the scope and ethics of actions taken in response to pandemic policies, especially when addressing public health law, which applies a different balance of autonomy, benevolence, non-maleficence and justice than individual bioethics and the law. The ASU COVID-19 Student Outbreak Response Team faced many challenges during the pandemic and the solutions the team implemented can aid future contact tracing efforts in anticipating these difficult on-the-ground problems in advance of the next pandemic. Management of data privacy is restoring trust and promoting public confidence in contact tracing and overcoming barriers to effective management of the pandemic response. Moving forward, public health agencies must develop best practices for data collection and protection even in the absence of comprehensive or clear guidance.