WA Notify COVID-19 Exposure Tracking Tool Poses Privacy and Implementation Considerations for Employers

Washington State has a new COVID-19 exposure-notification smartphone tool, WA Notify. Introduced on Nov. 30 by the Department of Health, University of Washington, and Brotman Baty Institute, WA Notify has since been downloaded or enabled by more than 1.5 million users. As the official exposure notification tool for Washington, WA Notify alerts users of potential exposure to COVID-19.

Given the tool's potential to help reduce COVID-19 infections, employers in Washington are rightfully considering its application in the workplace. In this advisory, we provide an overview of WA Notify, its privacy protections, and key considerations for employers.

How Does WA Notify Work?

WA Notify was designed to allow users to receive notices when potentially exposed to COVID-19—but without tracking where the users go, collecting users' personal information, or sharing personal information between users.

When WA Notify is enabled on a smartphone, the phone uses Bluetooth technology to send a code to nearby phones that also have WA Notify enabled. The codes swapped by the phones are random and anonymous, so neither the recipient nor WA Notify can identify the person or device associated with the code. Codes received are saved on the phone, not by WA Notify or any government agency or private entity, for 30 days.

If a WA Notify user tests positive for COVID-19, the public health department will provide them with a "verification code" to enter into the tool. Entering the verification code will send an anonymous alert to other WA Notify users who were near the positive user for a significant length of time (e.g., 15 or more minutes) in the previous 14 days. These exposure alerts do not identify the person who tested positive, or where the two users were near each other, only that the alert recipient had a potential exposure event. This alert could encourage the recipient to follow appropriate public health guidelines related to the potential exposure, including quarantine and testing.

iPhone users can enable WA Notify through the Exposure Notifications setting on their device. Android users can download WA Notify as an app on Google Play. More information about the tool, including privacy protections, is available from the Washington State Department of Health or the University of Washington.

WA Notify and the Workplace

While the privacy risks associated with enabling WA Notify on devices appear to be minimal, the potential privacy concerns around the tool when used in the employment context are significant. As employers continue to adapt to a workplace that includes COVID-19 exposure issues, some employers may evaluate whether to require or encourage employees to enable the WA Notify tool on phones and devices used to perform work.

In particular, the tool could be valuable in preventing COVID-19 transmission in the workplace because it alerts individuals regarding potential COVID-19 exposure and thus encourages them to quarantine and/or get tested if they receive an alert about a potential exposure. In addition, an employee who receives such a notification would be deterred from entering the workplace and exposing others, including coworkers and customers, thereby preventing potential COVID-19 transmission in the workplace. Also, employers could establish workplace screening and safety policies that take the WA Notify exposure alerts into account. However, employers should keep in mind the following legal and employee relations considerations related to the tool and privacy issues:

• Employees will likely be skeptical of the tool and have privacy concerns, particularly since the tool is enabled around the clock unless disabled by the user and use of the tool is not limited to work hours or responsibilities. As a result, requiring employees to use the tool may create unwanted morale issues with limited business protections related to reducing the transmission of COVID-19 in the workplace.
• It may be difficult for employers to provide business justification for mandating the use of the tool, since its function greatly exceeds workplace exposure issues, and the tool does not provide users with specific exposure location information. Employers who have employees performing in-person services will have stronger business-related justifications for encouraging the use of the tool because of the risks to the workforce and the public. Employers with a remote workforce, where exposure risks to other employees and the public is limited, will have a more difficult time directly tying the use of the tool to workplace-related protections.
• Educating employees about the tool and the privacy protections within the tool may minimize privacy concerns and incentivize employees to use the tool.
• If employers require or encourage employees to use the tool, they should consider how to handle potential exposure alerts employees may receive in order to comply with Washington Safe Start workplace requirements and applicable state and federal exposure guidance and recommendations, including requiring employees who have potential exposures to quarantine and/or follow other applicable guidelines and recommendations. This could mean updating applicable workplace safety plans and educating employees on what to do if they receive an alert, including notifying the appropriate workplace contact.
• If employers require employees to use the tool, appropriate reimbursement for personal device use should be provided if the employee does not have a work-provided device or does not already receive reimbursement for using a personal device for work purposes. Employers could also offer to provide reimbursement to incentivize the use of the tool if encouraging, but not requiring, employees' use of the tool.
• Employers may face liability if they require or encourage employees to use the tool and personal information is compromised because of the tool.  Employees may seek indemnity for any losses due to the exposure of information

Recommendations for Employers:

• In most situations, employers should encourage rather than require the use of the tool because of the privacy considerations that extend beyond the workplace. If an employer requires the use of the tool, the requirement should be limited employees who have regular in-person interactions with others.
• Employers should update workplace safety plans to reflect use of the tool by employees, and to specify what to do if an employee receives a potential exposure alert from the tool.
• Employers should provide employees with training related to the tool, including the privacy protections, and what to do if they receive a potential exposure alert.
• If employers want to encourage the use of the tool, consider incentives, such as small rewards to each employee when there is evidence that they enabled the tool. Incentives might include providing gift cards or chances to receive a larger award.
• Employers should provide appropriate reimbursement for personal device use if requiring the tool and if the employee does not have a work-provided device or does not already receive reimbursement for using a personal device for work purposes.

This article was originally featured as an employment advisory on DWT.com on December 23, 2020. Our editors have chosen to feature this article here for its coinciding subject matter.