College COVID-19 pandemic apps should follow best practices for privacy, ethical computing

As students head back to campuses across the country, many colleges and universities are using mobile phone and web apps to help them manage the pandemic.

But programs to alert students when they have come in contact with a person infected with COVID-19, that monitor quarantine compliance and check symptoms have popped up quickly in the market. As a result, these apps may not all follow best practices for safe and secure computing, say members of the University of Michigan Center for Ethics, Society, and Computing.

ESC faculty member Denise Anthony is director of the Health Informatics Program and professor of public health, sociology and information. She addresses the importance of making app design choices that protect users and highlights some best practices suggested by the center.

What are some of the chief concerns with these apps?

Contact tracing for COVID-19 is an important and necessary public health practice, so determining who potentially has symptoms or has potentially been exposed, testing those individuals and isolating new cases uncovered through that testing can help contain and limit COVID-19 infection.

Universities, wanting to ensure the safety and well-being of students, faculty and staff interacting in multiple ways in campus environments, seek to deploy various efforts, including new mobile phone and web-based apps for symptom checking, contact tracing, quarantine compliance and exposure monitoring.

Given that universities often serve diverse populations with different needs—and they may simultaneously act as the same person’s educator, surrogate parent, social calendar, landlord, restaurant, internet service provider, employer, health care provider, public health agency and local law enforcement agency—it is important to carefully consider the design choices made for each app that can affect a user’s freedom, privacy, safety, livelihood and health. Some of the apps in use have not factored these considerations into the design.

What should universities do to protect students?

By using privacy-preserving best practices for data gathering (e.g., limited data necessary to explicitly defined purpose, anonymity where possible, discarding data after a specified period of time), as well as communicating clearly with users about the purpose and use of data and who has access to it (and other important ethical practices outlined by ESC and others), university leaders can cultivate trust and cooperation from members of the community.

To promote data quality, build trust and avoid coercion, the ongoing collection of health information should be done on an opt-in basis, not as a requirement of employment, enrollment or access to infrastructure and resources.

What can students and others do to protect themselves? What questions should parents and students ask?

Insist that university leaders follow best practices for data gathering, privacy preservation and digital accessibility for any symptom tracking and contact tracing apps they use.

Expect that any of these apps should be deployed as part of a multifaceted strategy in tandem with clear and compassionate guidance and education, efforts to combat misinformation and resources of care that include frequent testing.