Everbridge Contact Tracing App Privacy Information

FAQs

  • How will DU use information collected by Everbridge?

    The information collected by the Everbridge app through the symptom monitor, proximity tracing  will be used only for the following:

    • contact tracing.
    • reporting of symptoms related to COVID-19.
    • compliance with requirements from the Colorado Department of Public Health and Environment (CDPHE) and Denver Department of Public Health and Environment (DDPHE).
  • How will Everbridge collect information to assist contact tracing?

    Within Everbridge, you can opt for Bluetooth-enabled proximity tracing.  DU will also use building access and wireless connection information along with Bluetooth proximity tracing to identify exposure with individuals who have tested positive for COVID-19.

  • How does Bluetooth proximity tracing work?
    • DU community members can opt in and out of the Bluetooth proximity tracing for the Everbridge app as frequently as they like.
      • On Android phones, to allow the Everbridge app to contact trace, user will need to run the Everbridge app in either the background or foreground in addition to turning on the location services on their phone settings to “Always Allow” for the Everbridge app and enabling Bluetooth on their phones.
      • On Apple phones, you will need to download two apps, one for receiving push notifications and the other for contact tracing purposes. To allow the Everbridge contact tracing app to contact trace, user will need to run the Everbridge app in either the background or foreground in addition to enabling the Bluetooth option for the Everbridge app on their phone settings.
      • To turn off contact tracing just close or end the app on your phone.
      • Please do not uninstall the app as it will remove all contact tracing tokens exchanged residing on the phone.
      • The app will need to be running in the background or foreground for contact tracing options to work and exposures to be reported.
    • When the Everbridge app is running in the foreground or background on the phone (Bluetooth enabled), it will collect and store information essential for thorough contact tracing.
      • When a community member comes in contact with another member who has enabled the Everbridge app with the Bluetooth option, tokens will be exchanged and stored on the members’ phones. The token is only exchanged between phones that are within 6 feet of each other for at least 15 minutes. This information will not be shared with any third parties.
      • When a community member self-reports a COVID-19 positive test through the Everbridge app, the COVID response team will be notified.
      • The COVID response team will validate test results and then, using information about the individual’s building access and contacts indicated by tokens, the team will notify all community members who have come in contact with the individual with a positive test. That person’s identity will remain confidential.

    To ensure community members’ privacy, Bluetooth Proximity tracing does not report location to DU. When a member with the Bluetooth-enabled Everbridge app self-reports a positive test, the COVID response team receives a report with the names of all DU community members who have exchanged tokens with the positive person’s phone in the previous 14 days. However, because the location is NOT collected through proximity tracing, the COVID response team is not privy to the location where tokens were exchanged.

  • Can I opt out of using the contact tracing feature of the symptom monitoring app?

    Effective contact tracing is a powerful tool that can make all the difference in keeping the campus safe. Although you can opt out, we strongly encourage everyone to participate. The higher the rate of participation the better the campus ability to contain the spread of the virus.

    Through manual contact tracing (i.e., tracing the spread of the virus by conducting person-to-person interviews rather than through digital location and proximity tracing), individuals confirmed positive for COVID-19 are asked to recall who they were in the vicinity of within the past ten days. Using Everbridge removes the potentially fallibility of memory and increases accuracy exponentially. 

  • Who within DU who will have access to our symptom monitoring data?

    Symptom monitoring data that you provide is only accessible to University employees and agents authorized to handle secure information for University operations and who are obligated to maintain confidentiality.

    Depending on the number of cases on campus, we may also be required to report symptomatic individuals to the Denver Department of Public Health and Environment.

  • Where is the data stored? What measures will DU take to keep data secure?

    Security and privacy have been paramount considerations as DU evaluates contact-tracing digital technology and potential integration with symptom monitoring. DU has created a privacy and data security working group specifically for COVID-19 led by the deputy COVID-19 coordinator. They will make policies and recommendations and then share these and the protections in place with the broader community.

    For contact tracing and symptom monitoring, we have selected a firm, Everbridge, with years of proven data security and privacy experience. They have the credentials, certifications, and independent oversight in place to ensure safeguards remain current in a landscape of more intense cyber-attacks. Everbridge will have a comprehensive set of security requirements and controls based on the U.S. National Institute of Standards and Technology Security and Privacy Controls for Information Systems and Organizations and the ISO standards, and they will be General Data Protection Regulation compliant. 

    Digital contact-tracing technologies that use Bluetooth Low Energy (BLE) technology, which allows personal data to be de-centrally stored on the individual’s phone and only accessed via randomized keys, are preferred. Full details on how contact tracing data is stored and maintained are detailed in the action plan.

  • Who will see my test results/how will they be used?

    All test results will be reviewed by National Jewish Health and available to the person tested via the University’s electronic health record system. Test results will also be viewed by a limited number of University administrators for COVID contact tracing purposes and care management who are authorized to handle secure information for University operations and who are obligated to maintain confidentiality. The limited access to information is provided in accordance with applicable privacy laws and University privacy policies. Any positive test results will be reported as required to public health agencies.

  • How will my health information be stored and protected?

    Health information is stored and protected in accordance with applicable privacy laws and University privacy policies.

  • Who within DU who will have access to our contact tracing data?

    Only authorized personnel who have completed training and signed confidentiality agreements will have access to contact tracing data. This data will only be accessible for 28 days.