After 9/11, we gave up privacy for security. Will we make the same trade-off after Covid-19?

In a span of weeks, the novel coronavirus has turned the nation’s roiling health privacy debate on its head. Concerns about what Google and Facebook might be doing with patients’ sensitive health information have receded, and instead, Americans are being asked to allow surveillance of their daily movements and contacts, and even their temperature and other physiological changes.

By tapping into people’s phones and medical records, researchers and public health authorities are hoping to more swiftly identify and isolate potentially infected patients and corral a pandemic that is outrunning them despite unprecedented restrictions on daily life.

Underscoring the urgency, the federal agency in charge of policing data breaches is now saying it will back off enforcement of certain privacy rules to make it easier for hospitals and their vendors to share patient medical records with public health officials. Meanwhile, the nation’s tech behemoths are collecting health information through Covid-19 symptom checkers, data that could prove invaluable to disease trackers when combined with travel and location data from smartphones.

“There are times that not using the information that we have is morally hard to defend, and I think this is one of them,” said Michelle Mello, a health law professor at Stanford University.

While the relaxing of health privacy rules can be justified during a crisis in which so many lives are at stake, some experts are asking what happens after the pandemic fades. Will we go back to normal, or will the erosion of privacy become part of the fabric of American health care, accepted as the price of continued vigilance against new viruses, in the same way Americans tolerated the loss of privacy and personal freedoms after the 9/11 terrorist attacks?

“Anything that has the potential of making people less safe, even if it involves giving people back some privacy they’ve already given up, is just much harder to sell, “ said Glenn Cohen, a professor of health law policy and bioethics at Harvard University. Attempts to implement digital monitoring of infected people may also be tied to the re-opening of the economy and the easing of social distancing, which may make intrusions easier to accept.

Cohen noted that there was enormous pressure on lawmakers to repeatedly renew the Patriot Act, which broadly expanded the government’s surveillance powers following the 2001 attacks. “We tend to accept what we live in as far as what privacy is, and once we’re there, the status quo has a lot of power over us,” Cohen said.

In the case of the Patriot Act, there were opportunities to debate the law and the surveillance capabilities it enabled. But the speed of the coronavirus — and the urgency of the health threat it poses — is not allowing time for a deliberative approach. Instead, government officials and technology company executives are discussing ways to respond to the virus in private meetings, including a March teleconference hosted by the White House, and making decisions with enormous implications for public health and individual freedoms. While the participants and the broad topics raised in that meeting were made public, the full details have not been released, and the White House has reportedly ordered federal health officials to treat top level meetings on the coronavirus response as classified.

The effort to increase surveillance is unfolding against the backdrop of mounting evidence that close tracking and isolation of infected patients in China, Singapore, and South Korea has helped control the spread of the coronavirus in those countries and limited the death toll. While the accuracy of China’s case counts has been questioned, the government there is requiring citizens to use software that automatically determines whether a person needs to be quarantined based on a color-coded assessment of contagion risk. South Korea is using a combination of smartphone location data, surveillance camera footage, and credit card data to trace the movements of infected patients and deliver information to the public on hotspots.

In the United States, such intrusive measures have not yet been implemented, but some privacy watchdogs are concerned about what they’re seeing. Apple and Google’s life sciences arm, Verily, are partnering with state and federal governments to conduct digital screening of patients that involves collection of data on their symptoms, recent travel, location, age, and underlying health conditions. Microsoft and many other technology startups are collecting similar information in partnerships with state governments and hospitals.

People willingly use symptom checkers, and most would no doubt support sharing their anonymized data with public health agencies to fight Covid-19. But several Democrats in the U.S. Senate have sent letters to Apple CEO Tim Cook and Verily CEO Andy Conrad to ask how the companies intend to use and safeguard the information they collect, and whether they will agree to refrain from using the data for commercial purposes.

“Americans should not have to trade their privacy at the expense of public health needs,” the senators wrote in the letter to Apple, which was signed by Sens. Bob Menendez and Cory Booker of New Jersey, Richard Blumenthal of Connecticut, and Kamala Harris of California.

Apple posted a statement on its website indicating that it is collecting information only on how people are using its screening tool — not the answers they provide — and that the information will not identify them. A spokeswoman for Verily told STAT that it will retain information collected from its screening tool only long enough to finish its project, and will not use it for advertising.

The White House Office of Science and Technology Policy has held separate discussions with Facebook, Amazon, Google, Facebook, IBM and other technology companies to assess how to use aggregated smartphone data and other information to trace the spread of the virus and whether Americans are keeping a safe distance from one another. The status and precise focus of those efforts is unclear; the White House did not respond to a request for comment.

The Senate Commerce Committee is scheduled to hold a hearing Thursday to examine privacy issues related to “recent uses of aggregate and anonymized consumer data to identify potential hotspots of coronavirus transmission.” And the American Civil Liberties Union will hold a press briefing Wednesday to discuss proposals to use location-tracking technology in response to the pandemic.

Jay Stanley, a  senior policy analyst for the ACLU, said authorities should examine the use of technology to combat the coronavirus, but he stressed that location tracking apps are limited by the accuracy of the data and uneven distribution of smartphones among richer and poorer segments of the population, which could pose equity issues. He also said a lack of adequate privacy protections would undermine uptake. “The goals of public health effectiveness and privacy are generally aligned in this,” Stanley said.

Several research projects are underway to use apps and phone data to speed up contact tracing to identify people who have crossed paths with a newly diagnosed patient, so they can be isolated and tested before they infect others. The coronavirus is spreading too fast now to carry out that work using the traditional approach, which involves dispatching an army of public health workers to interview infected patients and ask about their recent activities and social contacts.

While the digital version of that work may be more intrusive, and amplify privacy concerns, several research groups are seeking to use methods that protect individuals’ identities.

The Massachusetts Institute of Technology has teamed up with Facebook, Mayo Clinic, and other organizations to create an app that collects information using a technique known as differential privacy, a way of publicly sharing information gleaned from a data set without identifying the individuals whose activities are represented.

The app scrambles data so that people who voluntarily contribute their information are not identified. Users of the app, dubbed Private Kit: Safe Paths, would be able to edit their information before it is relayed to public health officials, who could see the location of new infections but not the names of the people connected to them. The data would also be encrypted to prevent a hacker from accessing identifiable information.

If it works, the app could allow users to understand their exposure risks and help authorities identify emerging clusters and warn the public to avoid certain areas, which could help contain the virus and allow communities to ease restrictions on individuals and businesses.

“On the public health side, it is important to know what the trends are and potential paths of transmission,” said Suraj Kapa, a Mayo Clinic cardiologist who worked on the project. He added that location data from phones could allow authorities to quickly zero in on circumstances where an infected person came in contact with a large gathering of people.

“You can find out that there may have been a mass exposure situation,” Kapa said. “And that allows you to intelligently drive testing and resources to address potential outbreaks.”

Kapa said he and the other researchers are intensely focused on ensuring that the app does not give the government open access to peoples’ data on an ongoing basis. “The user should have some ability to understand where their data is going and the identifiability of their data,” he said.

But the success of such efforts depends on multiple unresolved issues, including an expansion of testing and the willingness of large numbers of people — both infected and healthy individuals — to grant access to their phone data.

A number of thorny questions may arise, particularly if voluntary participation is spotty: Could federal or state governments mandate the use of a contact-tracing app in order to help contain the virus and re-open the economy? Could public health agencies get court orders to obtain phone tracking data from communications companies without consumers’ permission? Should the aggregated data be made public, and what would be the consequences if, for instance, the data showed infections concentrated in an ethnic neighborhood?

“Making this information available has [public health] uses, but it also has downsides if it is used in the wrong manner,” said Madhav Marathe, a computer science professor at the University of Virginia who studies the use of advanced computing techniques in epidemiology. “We have to decide as a society at what point of time we are willing to give up basic rights. Those are questions we have to answer together.”

The nation’s primary health privacy law, known as HIPAA, includes language allowing federal officials to waive privacy rules in case of a public health crisis, and officials have already exercised those provisions to allow for greater sharing of patient medical records for public health purposes and to support increased access to telemedicine services. But the 1996 law was passed when health data were primarily in the hands of hospitals, physician offices, and insurance companies — before Apple, Facebook, Amazon, and Google became so pervasive in American life, posing threats to privacy and individual freedoms that lawmakers could not have contemplated at the time.

“Are Americans willing to have [rules] put in place to make use of what they would really think of as their own personal online and cellphone data?” asked Mello, the Stanford law professor. She said a lot of useful data is posted online publicly, such as on social media, and can be scraped fairly easily, but the use of cellphone data is a more complicated question.

“We have a tradition of warrants” for gaining access to such information for law enforcement purposes, she said. “Figuring out what the standards … are going to be for using that geolocation data is going to be the most important thing.”

Mello stressed that addressing these questions now is of paramount importance, so that the next time around, the government and technology companies will be prepared to quickly ramp up digital containment efforts that may be arriving too late to make a difference now.

That means, in addition to clarifying the government’s legal relationships with technology and cellphone companies, establishing a more effective testing apparatus to ensure that any surveillance data collected could be used effectively to protect public health.

“We kind of blew it on surveillance, it’s pretty late in the game to be getting into that now, ”she said of the current outbreak. “You really can’t stand these things up in the middle of a pandemic.”