Artificial Intelligence & Robotics · 6/8/2020 · Artificial Intelligence & Robotics. Traditional...

Artificial Intelligence & Robotics



Without a Trace: Where Is Digital Data Privacy When Conducting COVID-19 Contact Tracing?Bridge Session: Wednesday, September 30th | Day 5


SpeakersRafael “Rafa” Baca, US Patent Attorney, Adelante IP Law Group, & AI Software Developer (Moderator)

Lydia de la Torre, Of Counsel, Squire Patton Boggs; Lecturer and former Co-Director, Data Privacy Certificate Program, Santa Clara Law School

Mihran Yenikomshian, Vice President, Analysis Group


To Receive CLE Credit for this Live Conference Session• You must attend this entire program; partial credit is not available.• Recordings watched within the conference platform are not eligible for

CLE credit. • Conference attendees will receive a link to their personalized CLE

affidavit via email after the end of the last day of the conference.• Enter the email address to which you want your CLE certificates sent and fill

out the online affidavit completely.• Select the combination of MCLE jurisdictions in which you are seeking CLE

credit.• After submission, your CLE certificates will be available for download and will

also be emailed to you.


Questions?Attendees may submit questions via the ‘Chat’ feature in the virtual conference platform interface


Recordings• Watch it again…• Recordings of this session will be available here within two (2) days of the end of the live session.

• No CLE credit is available for recorded sessions.


Questions?Attendees may submit questions via the ‘Chat’ feature in the virtual conference platform interface


Agenda

1. How digital contact tracing works2. What privacy laws apply and how can policy

foster privacy-protective deployment3. Case Studies


1.How does contact tracing work?

1.1. Traditional contact tracing and its shortcomings

1.2. How technology can augment traditional contract tracing


Traditional Contract TracingThe 3Ts: Testing, Tracing, and Treating

Contract Tracing: Working backward from infected cases to identify people who may have been exposed, so that they can be tested, isolated, & treated.

Traditional contact tracing is a labor-intensive and slow● Interviews and detective work, often

taking “four or five people over three days to do one full contact trace”.

● What data should they have access to?


The shortcomings: Traditional tracingTRADITIONAL TRACING:Slow/Expensive● People separated through walls/use of PPE.Interviews are unreliable● Faulty memoryAccess to additional data to contact those exposed● South Korea: Tracers use mobile GPS data,

credit card spending data, and even CCTV footage

● Vietnam: Neighbors encouraged to report potential symptomatic people


How can technology augment conventional contact tracing?

Mobile devices can be used in an automated and scalable way to help determine who has been exposed.

Databases can be used as a way to track and research COVID-19 spread and take localize actions

Predictive models can be developed to assess how rapidly disease will spread and optimize potential pandemic-related restrictions

● Identify exposure

● Rapid notifications

● Instructions on next steps

● Inform health authorities


How can technology augment conventional contact tracing?

Allows for information sharing across many different stakeholders (e.g., public health officials, businesses, test result reporting)

Enables a flexible contact tracing infrastructure beyond COVID-19 use (e.g., other infectious diseases)

Optimizes deployment of limited resources (e.g., contact tracers, testing capabilities)

IoT approach can be built upon existing infrastructure


What are the issues with using technology to augment contact tracing?Privacy concerns and misuse of data

Difficulty processing and aggregating data (delays in reporting can delay the usefulness)

Real-world applications (thus far) have fallen short of expectations (e.g., bespoke apps)


What privacy laws apply and how policy can foster privacy-protective deployment?

2. What privacy laws apply and how policy can foster privacy-protective deployment?

2.1. Existing and proposed laws (US-Fed)

2.2. Existing and new laws (US-States)

2.3. The role of policy


Existing laws & new bills (US-Fed)

New billsJune: The COVID-19 Consumer Data Protection Act of 2020(Rep)May: Public Health Emergency Privacy Act (“PHEPA”) (Dem)Similarities/Differences:● Temporarily regulate collec/handling of COVID-19

related info: Express consent + Transparency + Use restrictions

● PHEPA is broader and has private right of action○ PHEPA applies to workplace data & guest/visitor

screening data○ PHEPA applies to priv. entities and gov. entities

(Republican bill only to private entities)○ PHEPA private right of action ($100/$1,000 or

$500/$5,000 if willful/reckless)

Existing Laws:● Health Insurance Portability and

Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health Act (HITECH)

● Unfair and Deceptive Acts and Practices (UDAP) Statutes

● Federal/State Information Practices Acts (IPA)

https://www.commerce.senate.gov/services/files/A377AEEB-464E-4D5E-BFB8-11003149B6E0,

https://www.congress.gov/bill/116th-congress/senate-bill/3749/text?q=%7B%22search%22%3A%5B%22s3749%22%5D%7D&r=1&s=2


Existing & new laws

(US-States)

Existing● California Consumer Privacy Act (CCPA)● State UDAP Statutes

New: ● Kansas (June 8, 2020 - HB 2016): Requires participation in state contact

tracing to be voluntary and mandates confidentiality / imposes data retention requirements + prohibits certain uses of cellphone location data.

● New York (June 17, 2020 - S 8362): Requires that all contract tracers hired by the state health department be representative of the cultural and linguistic diversity of the community they serve.

● South Carolina (June 25, 2020 - HJR 5202): Prohibits the local health department from using mobile apps created for contact tracing.


The role of policy

Adequate safeguards needed:● Oversight (judicial-priv. right of action v. agency)● Sunset provisions● Limitations on secondary use● Data retention

Policy● Decentralized v. Centralized● Proximity (bluetooth) v. Geolocation (GPS)● Voluntary (“Opt-in”/”Opt-out”) v. ”Mandatory”● Open source / Binary Transparency / Computational encryption


3. Case Studies

3.1. Case Study 1: The Google-Apple DCTT API (US-States)

3.2. Case Study 2: How are Universities Addressing the Challenge?

3.3. Case Study 3: CalREDIE


State Contact Tracing Apps

FIRST CASE STUDY


Google/Apple DCTT: How does it work?


Google/Apple DCTT API: Key points

● COVID Positives: The mechanism will be determined by the public health authority and may vary across regions. For example, users may verify a test result using a pin code.

● Exposure: The system provides apps with both an estimate of time the user has been in contact with someone positive and the approximate distance but public health orgs. will determine what merits a notification.


Pros/Cons of using cellphones for contact tracing:

Pros/Cons of Apple/Google DCTT:

Mobile phones sensors = imperfect proxies for exposure.● Over reporting:

○ People separated through walls/use of personal protective equip.○ Fleeting interactions (crossing paths in the grocery store)

● Under reporting: ○ Smartphone penetration in US = 81% + People don’t always

carry cell phones○ Virus can linger on a surface long after the person is gone

Adoption (as it is opt-in)Org. that do not qualify (e.g. universities): ● Bluetooth & location APIs can be used (with permission) but...are

limited in background● Large battery impact


Google / Apple DCTT API Adoption● Apple and Google said Sept 1st that 25 U.S.

states and territories “are exploring use of the API”

● September announcement: Rolling out Exposure Notifications Express, a way for public health officials to quickly launch COVID-19 contact tracing apps

At least 23 countries have requested access to Apple and Google’s contact tracing technology

US States that have released a COVID app:● VIRGINIA

● PENNSYLVANIA

● NEVADA

● ALABAMA


Phase II: Exposure Notification ExpressBefore: Public health orgs could launch apps using the Apple-Google DCTT approach to Bluetooth Low Energy exposure notifications but required help from a developer.

Phase II: iOS and Android smartphones will automatically log COVID-19 exposure notification events without the need to download an app. (Part of iOS Sep 1st update/will launch latter in Sep for Android)

At launch, Maryland, Nevada, Virginia, and Washington D.C. will use Exposure Notifications Express.

What changes?● Contact events will now be recorded in 5-min.

intervals for a maximum of 30 minutes● Public health authorities can customize signal

strength and duration thresholds for their apps to define dangerous contacts and who receives a smartphone alert

BUT: Still opt-in!


How are universities addressing the challenge?

SECOND CASE STUDY


Challenges for Universities

Student Populations ● Diverse and span the globe, returning to campus can heighten risk in

areas with low COVID rates● Varying degrees of compliance with social distancing (several instances of

off-campus parties leading to COVID infections, may be impossible for sports teams)

Administration and Staff● Tuition puts pressure to provide in-person learning vs Zoom University● Universities are drivers of regional employment, opening up can lead to

regional spread


IoT Approaches for Contact Tracing

Unlike the general public, schools can require students, faculty, and employees to participate in contact tracing programs as part of their enrollment and employment ● Many universities use application-based strategies like Apple/Google API

or bespoke apps

● Some universities are using campus WiFi to identify individuals that came in contact with COVID positive cases


IoT Approaches for Contact Tracing

Harvard University● Testing and tracing requirements vary by requirements of a regular

presence on campus

● TraceFi(pilot program)

○ Wifi based contact tracing system - tracking signal strength, MAC address, and date and time, stored for 28 days

○ Program is opt-out meaning everyone accessing system is enrolled

● Triangulation is an inexact science

● MAC address is “privacy intrusive element” but can be justified due to public health


Approaches for Contact Tracing

University of Arizona ● Part of a multi-progroned approach for monitoring COVID including

wellness checks and water-based epidemiology

● CovidWatch App (not mandatory)○ Calculates a person’s level of exposure risk by assessing duration of

exposure to an infected person, distance from an infected person and the point in the infection cycle at which a user was exposed.

○ Opt-in○ Uses low-energy bluetooth location data to balance need for

privacy and ability to target those at highest at risk● Effectiveness of program may be limited due to opt-in nature of

application


Preliminary observations

College parties seem to be a source of campus spread● Despite efforts to control spread and maintain privacy of

individuals with technology, there are frequent news reports of campus parties in violation of campus COVID safety rules

● Suspensions of students involved is becoming more commonplace

Contract tracing technology can be used to identify events and limit the risk of spread, however● Even with a serious public health concern, predicting and stopping

potential spread events could be considered a misuse of the technology (e.g., while the individual names might be protected, identifying large groups congregating together can have a chilling effect on technology adoption)


Key takeaways for contact tracing technology on return to campus

Varying levels of potential benefit with contact tracing approaches (technology being mandatory vs. non-mandatory, false positives)

Universities need to grapple with consequences of non-compliance with their COVID testing and tracing policies (e.g., suspension too harsh for parties, firing of employees) and backlash for students on perceived misuse of the technology (e.g., privacy concerns lead to a chilling effect on technology adoption)

Large scale natural experiment across different universities and communities, no one size fits all approach and privacy trade offs for each

Too early to gauge success (e.g., most areas people are still spending time outdoors where spread is lower risk)


Is CalREDIE DATABASE ready for AI assisted Contact Tracing ?

THIRD CASE STUDY


POSITIVE COVID-19 TEST RESULT REPORTING TODAY

PATIENT TAKES COVID-19 TEST - Ordering Health Professional sends test specimen to CLIA certified Pathology Lab

REPORTING POSITIVE TEST RESULTS – BOTH Ordering Pro & Lab must report to local health department in roughly 24 hours (CDC guidelines – varied implementation by each State & Public Health Dept at local level). CDC provides guidance only on LOINC data codes

LOINC codes +plus+ the following demographic information: Released, Unit Code, Test Name, Source, Result, Physician's Network, Physician's name, State, Patient Name, Patient ID, Sex, Age, DOB


Data Reporting Inefficiencies Woefully Exist

General Observation: Best way for root cause analysis in Contact Tracing for infection spread for Contact Tracing is through generating measurement data. Average lag-time between CDC reported infection and death – 25 days.

Concerns of Inconsistency of Metrics on form documents for digital reporting:

● CDC must harmonize medical testing information collected - including richer demographic data in terms of metrics to perform meaningful AI modeling and automated contact tracing from a public dataset.

● No national law correlating COVID 19 test reporting of richer demographic information. State of California - 17 CCR § 2505 (28 July 20)

Movement to fully HL7 reporting – end to end encryption (RSA, SHA-)pos & non-pos; 8 hours after provider reporting; race & ethnicity - otherwise Calif. CLIA license suspended


National databases lack uniformity of metrics and timeliness for reporting

● Inadequate foundation for Data Science & AI: no national legislation for a uniform set of data collected or aggregating public database between all local health departments – real-time, transparent & public


Overview of relevant privacy law(1) “PERMITTED USE” EXCEPTION - PATIENT PRIVACY -45 C.F.R. §164.512(b)(1)(iv) provides for contact tracing using digial PHI; see also HIPAA P.L. No. 104-191, 110 Stat. 1938 (1996), HITECH, 42 U.S.C. §300jj et seq.; §17901 et seq.

- HIPAA Use of Protected Health Info w/o Patient Authorization*Pub Health Investigation of Communicable Disease Exposure in during a presidentially declared National Health Emergency*

(2) GEOLOCATION DATA - CONSUMER & INDIVIDUAL PRIVACY-Communications Act of 1934, CPNI 47 U.S.C. § 222 - defines CPNI to include information that relates to . . . destination, location . . . of use of a telecommunications service subscribed by the telecommunications service.

(3) ONLINE CONSUMER DATA - CONSUMER & INDIVIDUAL PRIVACY- OPT-IN vs OPT-OUT Privacy RightsCalifornia Consumer Privacy Act, CCPA, Cal. Civ. Code §§1798.100 et seq. : Opt-out of consent to sell consumers’ individual informationVs(EU) 2016/679 (General Data Protection Regulation, GDPR) effective 25 May 2018: Opt-In to consent to personal data being used by collectors

(4) DATABASE TRADE SECRETS – INDIVIDUAL INTELLECTUAL PROPERTY RIGHTS- DATABASES & DATABASE DESIGNApplies to both Federal law (Defend Trade Secrets Act (DTSA), 18 USC §§ 1839 et seq.) and State law (Uniform Trade Secrets Act (UTSA))


● California expands patient information collected for positive casesbeyond CDC – race, ethnicity, occupation, place of work, reportingSource, & “supplemental information”

● *Sept 2 – California invests federal funds in a centralized database geared toward big data collection and retrieval and continued patient tracking, Optimuminsight


A Transparent, Current, Uniform NationalPublic Health Dataset NEEDED For MeaningfulData Science & AI

Meaningful use of AI in Contact Tracing will first require some new AI Infrastructure with respect to Privacy:

• Designated CDC/ Local Health Department Database with transparent Public Health Tagged KPIs curated for Machine Learning

• Public-Private Testing & Tracing Dataset-sharing through legislation, possibly expanding Permitted Use Exception of HIPAA (45 C.F.R. §164.512 )

• Existing Cloud National Public Network for collecting PHI? FirstNet a dedicated network for first responders?

National Model based in CalREDIE? CalREDIE has many technical failures - summer 2020; CDC database has failures in data uniformity & transparency - fall 2020

https://www.firstnet.com/


IoT Contact Tracing System

OPTIONAL or “OPT-IN” USE – 2020 HYBRID Near Field Anonymized APP –AND – encrypted QR READER @ Public Locations with encrypted storage by local health department

Decentralized Database Storage & Retrieval – Data Encrypted & Stored on Device ---Uniform CDC standards for infection reporting and contact tracing: Data needs to be gathered and stored in a meaningful uniform manner, that will have baseline value to all public health departments collectively throughout the country but flexibility to add local and regional metrics for study as well as respecting privacy.

COVID Contact Tracing App “functionality” through global adoption of software updates to hardware– Recent announcement by iOS & Android to update with a COVID ”Alert System”; firmware updates to mobile device sensors; future software engineering standards to provide Alert functionality in IoT embedded system software


KEY TAKEAWAYSfor building a dataset for practical Artificial Intelligence & Machine Learning tools for COVID 19 CONTACT TRACING

● Lack of uniform data gathering from the NATIONAL level, - recall DATA is the fuel for AI & Machine Learning algorithms

● Most existing privacy laws, hardware and online network systems as well as Artificial Intelligence technology are “good enough” to get started already for 21st century augmented contact tracing !!

● CalREDIE - although not perfect - would serve as a great national model for CDC & AI Developers to build on in the future


QUESTION&

ANSWERTIME


Parting Thoughts


Mihran YenikomshianVice President

Analysis [email protected]

Contact InformationRafael “RAFA” Baca

US Patent Attorney & AI Software Developerhttps://adelanteiplaw.com/https://digitaldeputyact.org/

Lydia de la TorreOf Counsel / Squire Patton Boggs

[email protected]: https://medium.com/golden-data

https://adelanteiplaw.com/

https://digitaldeputyact.org/

mailto:[email protected]

https://medium.com/golden-data

Artificial Intelligence & Robotics · 6/8/2020 · Artificial Intelligence & Robotics. Traditional...

Documents

Transcript of Artificial Intelligence & Robotics · 6/8/2020 · Artificial Intelligence & Robotics. Traditional...