At universities, contact tracing app reception hinges on privacy

Universities have launched mobile apps to collect COVID-19 health data on students and faculty, but some schools are now facing backlash over privacy concerns and how the apps have been implemented.

These exposure notification or contact tracing apps primarily work by allowing people to voluntarily track their symptoms, record COVID-19 test results, get connected to medical resources and notify users of potential exposure to the virus in order to keep those on campus safe and give administrators a more accurate assessment of the pandemic’s impact on campus.

At the University of Arizona, students, faculty and staff can now download the Covid Watch app, and opt in to providing anonymous health data, like positive COVID-19 test results, and with potential virus exposures monitored via Bluetooth signals transmitted between users.

The app can calculate a person’s level of exposure risk by assessing duration of exposure to an infected person, distance from an infected person and the point in the infection cycle at which a user was exposed. If found to be exposed to the virus, they’ll be instructed how long they should quarantine for, what symptoms to monitor and how to connect with campus health resources to schedule a test or be seen for symptoms.

“The app is a vital part of our plan to mitigate the risk of COVID-19 as we return to campus over the coming weeks with our on-ramp approach,” Robert Robbins, University of Arizona President, said in a video briefing Wednesday.

The U of A COVID-19 monitoring app is not mandatory for students, faculty and staff to use. At Albion College, a small liberal arts school in Michigan, contact tracing is also being used to help tackle any coronavirus outbreak on campus, but the university is forcing students to use the app or risk facing suspension or expulsion.

Unlike the University of Arizona, students Albion were required to download and install a contact tracing app that was designed to track students’ real-time locations around the clock with no way to opt out.  Tech Crunch reported Wednesday that the app, called Aura, was designed by the Pennsylvania-based firm Nucleus Careers, which appears to have no history of developing health care apps.

The app collects students’s COVID-19 test results to alert other students when they have come into close proximity with a person who tested positive for the virus, but requires constant access to the student’s real-time location.  The college said constant access to students’ location data is necessary to track the spread of any outbreaks on campus, but students and their parents expressed privacy concerns over the app after at least two security vulnerabilities were discovered, which allowed access to the app’s back-end servers and potentially to students’ COVID-19 test results.

Though the flaws in the app have been fixed, a petition to make the app optional for students now has more than 1,500 signatures. Albion College did not respond to a request for additional information on whether it intends to proceed with its mandatory-use policy.

But still, many universities have implemented contact tracing apps to help students and faculty safely return to campus this fall, including the University of Texas, Austin, Harvard University, Arkansas State University and University of Missouri, which all have applications that students can use voluntarily.

Many these apps being used by colleges and universities may also eventually be adopted by states looking to implement contact tracing on a wider scale for residents.

The University of Arizona’s Covid Watch app is being piloted with students first, but the university hopes to be able to share the technology with the state health department by the fall, according to Richard Carmona, director of U of A’s campus reentry task force and 17th U.S. Surgeon General.