California is requiring COVID contact tracing until 2025. Here's how to prioritize privacy

In February, the state of California introduced new long-term regulations that will require employers to conduct COVID-19 contact tracing for all positive cases until early 2025. But despite three years of pandemic experience, employers are still struggling to manage employee safety — and privacy — efficiently.

The updated regulations require contact tracing for anyone who was within six feet of a person with COVID-19 for at least 15 minutes over a 24-hour period, starting from two days before symptoms appeared. That kind of tracking can require a substantial amount of technology, some of which could  impede on employees privacy, which is why contact tracing company Contact Harald is working to help employers abide by the law while minimizing employee risk. 

"The new regulations in California have sort of started another wave of companies being a bit concerned about ticking all the boxes with regard to health and safety," says Matt Denton, co-founder and head of product at Contact Harald. "Safeguarding individuals' privacy is the core tenet of what our system is about, and making sure that boundary between the employee and the employer is clearly defined while also meeting trade union regulations, state regulations and international regulations." 

Read more: U.S. extends COVID public-health emergency to maintain access to care

In the early days of the pandemic, when an outbreak would occur at a company, case investigators would be outsourced and hired to immediately identify, contact and interview the infected as well as anyone who had contact with that person. It was a lengthy process that required the sharing of multiple people's personal information — names, numbers,addresses, as well as the locations they'd visited outside of work — in order to trace how far the COVID could have spread.

Tech companies like Contact Harald have not only automated the process, but made it safer for employee data. In California's case, Contact Harald will partner with a company and provide all employees with a card that hangs around their necks. The cards are devoid of any kind of personal information or identification but have an ID number only Contact Herald can see that records how close or how far employees are from each other at all times. 

Then, if and when there's a positive COVID case, it's just a matter of finding which cards interacted the most and reaching out to the employees linked to the ID number personally — whether through email or text message — without having to alert additional personnel.

Read more: 5 best practices for a safe in-person workplace

"We can store an encrypted phone number on the system and only use it for the purposes of contacting someone in the event of an outbreak, or we can just store an anonymous token which is linked back to a corporate database that can be used by the organization to contact the individual," says Denton. "But there's no other personal information stored on the card, and you can't track the card. We've got multiple levels of security measures taken to ensure the safety and security of the data." 

Not only were the old forms of contact tracing incredibly invasive, according to Denton, they were inherently flawed, too. 

"A manual approach suffers from long interview periods and inaccurate data," says Nick O'Halloran, co-founder and director of contact at Contact Harald. "In the current regulatory environment, it's almost impossible to say whether a person was in that area for a total of 15 minutes. You're relying on memory and you're relying on old arduous processes." 

Contact Harald sets up sensors around a given space that link back to the cards around employees necks. That enables cards to record close contact of two or more people within six feet areas in a space of up to 400,000 cubic feet, making it a much more reliable option for companies looking to limit the spread of the virus.

Read more: Strategies employers can utilize when reopening their offices post-COVID

"If there is an event where someone does test positive, we can easily query the database and inform those that were close contacts so they  can isolate," Denton says. "It automates that entire process."

While California is one of the only states to pass this sort of regulation, it may prove to have more staying power than anticipated because of what Denton sees as unanticipated benefits. For example, quick and secure contact tracing could make it easier and more comfortable for employees to come to the office or company-sponsored events without the fear of getting sick if they know that their company is monitoring their workforce's health and safety closely. 

"It's not just that companies that don't do it face major fines," he says. "It's also about looking after your staff and making sure that they feel protected. COVID is still out there. People still die every day. It's important to abide by government regulations, but also to keep staff feeling healthy and safe."