A bill regulating the use of contact tracing date has moved its way through both chambers of the New York State legislature. Senate Bill S8450C regulates all information that includes or can reveal the identity of any individual and any COVID-19 related information or test results.

New York State established a tracing initiative to control the spread of the coronavirus pandemic across the state. The tracing program is part of the larger strategy of reducing transmission and ensuring affected individuals are appropriately isolated.  As part of this initiative, the state employs contact tracers to communicate with individuals diagnosed with COVID-19, as well as any parties who have been in contact with them and therefore exposed to the virus.

During the early stages of the pandemic, Governor Cuomo said “once you trace, and you find more positives, then you isolate the positives — they’re under quarantine, they can’t go out, they can’t infect anybody else.” Municipalities and local governments in New York have also engaged in this program or a variant of it. For example, New York City hired 3,000 disease detectives and case monitors to identify anyone who has come into contact with individuals who have tested positive for COVID-19.

Senate Bill 8450C, which awaits the Governor’s signature, will apply to every entity employed or under contract with either the state and/or local government, engaging in contact tracing information. These individuals or entities will be limited to disclosing any of the information to permissible purposes. The permissible purposes are disclosures to the appropriate health care providers or their personnel for clinical diagnosis, care or treatment of the data subject, and facilitating a legally authorized public health-related action in relation to a specific individual only to the extent necessary for public health purposes, and for defense of statutory claims.

The bill will also impose a record keeping requirement. If a contact tracing entity uses one of the permissible purposes to disclose the information, the entity would be required to make a record of that disclosure including to whom that information was shared.

The bill would not prohibit possession or use of deidentified contact tracing information.  The bill defines “deidentified” to mean contact tracing information that cannot identity or be made to identify or be associated with a particular individual, directly, or indirectly and is subject to technical safeguards and policies and procedures that prevent intentional or unintentional re-identification. However, the disclosure, possession and use of deidentified contract information requires approval by the state department of health or New York City department of health, when applicable.

Non-governmental entities that have contracted with the state or local governments for contact tracing would be required to remove contact tracing information from its possession or control and deliver it to the appropriate governmental agency without retaining a copy within thirty days of collection. If the entity has deidentified such information, they will still need to get governmental approval for use of that data. Governmental entities, however, have no similar requirement. As South Korea is proving, that information may become too useful to get rid of that easily.