Commentary: COVID-19 contact tracing apps: Choose the technology wisely

There has been significant interest in leveraging smartphone apps for contact tracing, a public health strategy that involves tracking people who are COVID-19 positive to identify disease hot spots. Traditionally this is done by workers on foot and over the telephone, and we know this labor-intensive method works — it has helped in the elimination of smallpox and in curbing the spread of sexually transmitted infections. However, the efficacy of the app-boosted method is still unknown.

Unfortunately, pressure to ease lockdowns has led to a mad dash to develop and use such apps for COVID-19, resulting in a wildly different array of options. As public health departments are pushed to follow suit, we must be careful about which technologies we adopt.

Several dozen states and companies have already started developing and using digital tools. In the spring, Utah released an app, called Healthy Together, which was built by a social media startup that used Bluetooth and GPS data to augment in-person contact tracing. While the GPS location tracking feature was shut down over the summer due to poor uptake and app mistrust (only 200 users had opted to share location data), the app still tracks proximity relative to other app users. The result? A haphazard app that does not retain the ability to identify COVID-19 hot spots, yet still tracks some data.

North Dakota’s app also uses location data, but unfortunately was found to have been sharing data with Foursquare and Google’s advertising system. While the company developing North Dakota’s app has since updated its privacy policy, its case highlights another important issue. Both North Dakota and Utah’s apps require sharing location data with the state public health department. This centralized storage approach lends itself to partnership between public health departments and contact tracing apps, but is also invasive and highly vulnerable to exploitation by hackers or misuse by law enforcement.

When Apple and Google teamed up in April to build an alternative option, a software tool kit called Exposure Notifications, many hoped that this would finally allow digital contact tracing to take off. The Apple-Google system has the support of many privacy experts because it uses Bluetooth instead of location data, saves records across people’s phones rather than in a central database and features periodically erased data.

However, while decentralized data is likely safer from a privacy perspective, there are still risks with the Apple-Google solution. It requires use of Bluetooth, a convenient but imperfect technology with inherent security risks. Furthermore, these contact tracing apps would not be covered by the Health Insurance Portability and Accountability Act privacy laws, since the data would be voluntarily shared with the third-party apps. Finally, health authorities would only be notified if the individual chooses to submit their positive test result, making this solution heavily dependent on the honor system.

Even if all these risks are mitigated, there is still much that is unknown, such as determining how high the false positives may be from these tools. Proximity apps can’t tell the difference between health care workers wearing personal protective equipment and people at a party. It also can’t distinguish people separated by walls or driving near each other on highways. This means there is potential for a flood of false positives and app fatigue if people start ignoring notifications that are frequently incorrect.

But simply increasing accuracy won’t be enough, if enough people aren’t willing to download the app in the first place. A recent simulation by the University of Oxford found that 56% of the population (or 80% of all smartphone users) would need to use an app in order to effectively control the outbreak. Unfortunately, a recent nationwide poll indicates that only 30% of Americans are willing to use a contact tracing app.

Moreover, the app method excludes people who do not own smartphones, including older patients more vulnerable to COVID-19. Finally, America’s regional contact tracing app approach has made contact tracing more, rather than less, complicated. A state-by-state solution isn’t very helpful if a person who tests positive with a Virginia app doesn’t trigger an alert in North Carolina.

This does not mean that contact tracing apps will be useless, and we are making progress daily to overcome the challenges above. In fact, the authors of the original study presented research in September that an installation rate as low as 15%, in conjunction with traditional contact tracing, could help suppress COVID-19. Also encouraging is that so far, 10 states have published apps using the technology from the Apple-Google partnership, and at least four will be able to exchange notifications.

So, what’s next? For those of us who do choose to download a contact-tracing app, it is critical we pay attention to the technology the app is based on (Bluetooth or GPS) and where the data is stored. For people developing such apps, interstate collaboration and interoperability is absolutely critical to optimize the chance of effectiveness. Most importantly, as a society we cannot fixate on technology at the expense of other, more difficult choices like social distancing, limiting gathering sizes and wearing masks. The next several months will unfortunately be challenging, but if we are intentional about our choices as citizens and communities, we have the opportunity to create a better, safer tomorrow in this crisis and beyond.

Dr. Lochan Shah is a resident physician in internal medicine at Johns Hopkins.