Kansas’ new coronavirus bill puts privacy limits on contact tracing

As states continue to ramp up their ability to track the continued spread of the coronavirus, many parties are raising concerns about just how invasive contact tracing efforts will be, especially if they rely mobile technology and the collection of personally identifiable information.

But an emergency bill passed this week in the Kansas Legislature appears to put some limits on how expansive state and local health authorities can go in building out contact tracing programs for COVID-19. The bill, which distributes additional funds to localities as they deal with the effects of the pandemic, also includes several new guidelines on contact tracing.

Among the provisions is that individuals’ participation in any program will be voluntary, not mandatory, and that information collected by contact tracers cannot be used for any other government or third-party purpose. State and municipal health agencies are also only allowed to execute contact tracing efforts if they’re determined to be necessary by the state health secretary or relevant local health officer.

Perhaps most relevant, though, is that the bill prohibits “contact tracing from being conducted through the use of any service or means that uses cellphone location data to identify or track, directly or indirectly, the movement of persons.”

Kansas Attorney General Derek Schmidt was a leading proponent of the restrictions, sending a letter last week to Gov. Laura Kelly and the state’s legislative leaders asking them to consider a bill that would impose some controls on how public health agencies in the state collect and store information from COVID-19 patients and individuals they’ve potentially infected.

“Many public health officials have explained contact tracing is key to enabling a safe reopening and economic recovery because it is the foundation for identifying new outbreaks of the virus and containing them before they can spread widely,” Schmidt’s letter reads. “At the same time, the information-gathering activities inherent in contact tracing present significant and legitimate privacy concerns.”

The Kansas Department of Health and Environment is trying to hire about 400 contact tracers to cover the state of 3 million, which has recorded more than 10,000 COVID-19 cases and 222 deaths. Individual counties are also fielding their own teams. And as in other states, Kansas health officials are currently sifting through a range of brand-new offerings from tech companies, including a new API developed jointly by Apple and Google that uses Bluetooth technology to track users’ phones.

County health departments across Kansas are depending mostly on live phone interviews to determine if newly-infected patients have come into contact with other people. And according to KCUR, the public radio station in Kansas City, Missouri, several major counties haven’t started considering how they might add mobile apps — potentially based on the Apple-Google platform — to their toolkits. Johnson and Wyandotte counties, which contain Kansas City, Kansas, and its suburbs, both said they’re not recommending that their residents use any apps.

It’s unclear what the Republican-led legislature’s emergency bill — which Kelly, a Democrat, is expected to sign — means with regard for the Apple-Google interface, which several states plan to use in their own contact-tracing programs. The tech giants said they will not permit app developers to use the API to access mobile devices’ location tracking services. The bill is only meant as a temporary measure through next April, after which the legislature may put in more permanent regulations.

Still, Schmidt, a Republican, welcomed the bill’s passage.

“With this new statute, Kansas will put in place enforceable statutory protections specifically to protect citizens’ privacy and civil liberties during COVID-19 contact tracing,” he said Friday in a statement released by his office. “This new legislation does not address every question. But at least this puts in place basic protections for civil liberties and privacy to replace the unregulated wild west that otherwise was unfolding in COVID-19 contact tracing.”