COVID-19 is altering traditional approaches to educating students and conducting research at colleges and universities across the U.S. As a large majority prepare to welcome students, faculty, and staff back to campus for the fall 2020 semester, a substantial investment of time and resources is required to secure their safety and well-being.
Legal duties, ethical principles and reputational concerns all underlie this obligation — an inadequate approach can create substantial liability for any institution of higher education (IHE). This is especially true since COVID-19 will be considered a foreseeable risk by the time IHEs begin to reopen.
Courts have split on whether or not a school owes a duty of care to students. The prudent course is for IHEs is to assume that they have the duty to protect students from foreseeable risks. Similarly, they need to adopt reasonable measures to protect faculty and staff from known harm.
Contact tracing is one tool IHEs must consider to meet these safety obligations.
Traditionally (but not always) undertaken by public health authorities, contact tracing involves identifying and locating individuals who have been exposed to someone infected with COVID-19. According to the CDC, COVID-19 contact tracing should identify those who were within six feet of the infected person for a period of 15 or more minutes, beginning 48 hours before the onset of symptoms through the time that the infected person was isolated.
Contact tracing must be conducted swiftly and efficiently. For IHEs, reliance upon local public health authorities may not suffice. These agencies, even where adequately funded, will struggle to keep up with contact tracing demand when thousands of people arrive in their communities to begin a semester. Similarly, IHEs themselves, whose budgets have been ravaged by the COVID-19 pandemic, will lack the staffing resources to engage in person-to-person contact tracing.
Given the scope of the pandemic and the drastic consequences from failing to detect an upswing in infection in a timely manner, many IHEs are considering digital contact tracing technology (DCTT). Most DCTT solutions rely upon a smart phone app to detect and log the user’s contact with other people who are also employing the app. When a user is subsequently identified as diagnosed with COVID-19, the app can identify other users who were in contact with the infected person and notify them or their IHE.
Although DCTT allows an IHE to conduct large-scale contract tracing rapidly, it can create problems. Collecting information about where a student or employee has been, and with whom, can raise significant privacy concerns. Handled incorrectly, DCTT may backfire by generating unintended legal risks for an IHE, or if the app is perceived to erode privacy or other personal interests the IHE community may simply refuse to use it — and contact tracing will fail.
To avoid legal missteps IHEs conducting contact tracing need to comply with data privacy and security laws, health information privacy laws, employment laws and, as applicable, with principles of constitutional law.
Data Privacy Laws
A for-profit entity conducting contact tracing on behalf of an IHE needs to comply with a growing number of state laws regulating the privacy of personal information such as the California Consumer Privacy Act which imposes detailed notice and use obligations as well as consumer rights to access and request deletion of personal information. Another example is the California Online Privacy Protection Act requiring that users of mobile applications such as DCCT be informed of how their personal data will be collected, used and disclosed.
Health Information Privacy Laws
The Health Insurance Portability and Accountability Act safeguards the confidentiality of protected health information but is unlikely to affect contact tracing except in narrow circumstances. More relevant is the Family Educational Rights and Privacy Act which prohibits IHEs from disclosing personally identifiable information from education records without prior written consent of a parent/guardian or eligible student.
Nondiscrimination and Related Rights
The Americans with Disabilities Act (ADA) imposes broad protections against discrimination in employment, accommodations and education for persons with disabilities. Section 504 of the Rehabilitation Act of 1974 prohibits discrimination on the basis of disability by any program or activity receiving federal funding. The ADA and Section 504 may be relevant to contact tracing, prohibiting results from being used as a basis for discrimination.
(a) In the student context, an IHE may not discriminate on the basis of disability in admissions, accommodations or instruction. There is a robust and extensive history of litigation against IHEs centered on claims of disability discrimination. In every instance, the key questions are whether the student actually had a condition that qualifies as a disability; whether the disability could reasonably be accommodated by the IHE without undue hardship; and whether the IHE did in fact provide reasonable accommodation. COVID-19, an infectious disease, will doubtless qualify as a disability. Thus, refusing admission to a student because she had COVID-19 would be discriminatory unless no reasonable accommodation, such as temporary quarantine in a specially designated dormitory, were possible without creating undue hardship for the IHE.
(b) Any employer who has more than 15 employees and any employer providing programs or services receiving federal funding will be prohibited from discriminating against employees on the basis of disability. The key is whether the employee has a condition qualifying as a disability; whether the disability — infection with COVID-19 — can be reasonably accommodated by the employer without undue hardship; and whether the employer has provided reasonable accommodation.
Title VI of the Civil Rights Act of 1964 prohibits race, color and national origin discrimination by IHEs receiving federal funds. Title VII of the Civil Rights Act prohibits discrimination by employers based on race, color, national origin, religion and sex, including pregnancy. The Age Discrimination in Employment Act bars discrimination in employment based on age (40 or older). Each of these may give rise to claims against IHEs based on how they use information obtained through contact tracing.
Electronic Data Privacy and Security Laws
Under Section 5 of the Federal Trade Commission Act, the Federal Trade Commission (FTC) uses its enforcement authority to oversee collection, storage, and transmission of digital user data. The FTC has a long record of imposing sanctions when privacy practices fail to protect consumers as promised in published privacy policies. IHEs should ensure a DCTT provider disclose to users how data will be utilized and that each user expressly agrees.
The Electronic Communications Privacy Act of 1986 (“ECPA”) makes it a crime to access electronic data without authorization. Violations can result in prison sentences, $250,000 fines, and victim lawsuits. While an employment contract or student handbook may provide for such authorization, it is unlikely that IHEs have designed such documents to cover DCTT contact tracing.
Federal Constitutional Issues
Students and employees of public universities will also be entitled to protection of constitutional privacy rights. The Fourth Amendment to the U.S. Constitution prohibits unreasonable search and seizure, such as acquiring cell phone records to trace a suspect’s movements. No Fourth Amendment concerns are raised where a search is done with consent. For public IHEs this exception provides additional reasons to secure clear user consent before implementing a DCTT.
The U.S. Congress is considering several bills that may affect how contact tracing can be legally conducted, with a probable focus on DCTT. For now, the variety of legal implications raised by DCTT strongly suggest that IHEs should assure that DCTT should only occur after obtaining valid user consent and any data obtained through DCTT is in fact used and stored in the manner promised to users, and not for purposes not covered by consent.
1 Restatement (Third) of Torts: Phys. & Emot. Harm § 40 (2012) Commt. l (“Courts are split on whether a college owes an affirmative duty to its students. Some of the cases recognizing such a duty are less than ringing endorsements, often relying on other aspects of the relationship between the college and its student to justify imposing a duty. Conversely, a number of the cases declining to recognize a duty speak in narrow, fact-specific terms that do not rule out the possibility of recognizing a duty in other contexts.”)
2 OSHA has provided guidance on how to prepare the workplace for reopening, found at https://www.osha.gov/Publications/OSHA3990.pdf.
3 https://www.cdc.gov/coronavirus/2019-ncov/php/principles-contact-tracing.html
4 See Betts, Jennifer and Eckard, Michael O., An Update on Coronavirus Contact Tracing: Status, Benefits and Key Considerations, https://ogletree.com/insights/an-update-on-coronavirus-contact-tracing-status-benefits-and-key-considerations/
5 However, under the Americans with Disabilities Act, all medical information about employees or applicants for employment must be collected and maintained on separate forms and in separate files and must be treated as a confidential medical record.
7 Many states have adopted unfair and deceptive trade practices statutes similar to Section 5 of the FTC Act, so IHEs also need to be aware of and assure compliance with state law requirements.