A CCSS app(lication) already installed on at least 1.2 million cell phones in Costa Rica could become an instrument to combat the spread of the new coronavirus.
It’s called Expediente Digital Único en Salud (EDUS) – Unique Digital Health Record, it has been operating since 2015, but in the midst of the pandemic it has been shown that it could be used to locate (and treat) those who have come into contact with people infected with covid-19.
Do not panic. First, the system would be voluntary. Second, totally anonymous. And Third, it has not been approved yet, but the Costa Rican Social Security Fund (CCSS) is seriously evaluating the legal feasibility.
The CCSS, if it were to roll out the program, guarantees EDUS would be totally anonymous.
EDUS typically serves as a liaison between CCSS-patient for medical appointments, diagnoses, medications, pension data, and now also to report if a user suffers from virus symptoms.
The plan would be that during the health emergency, the “app” asks the infected to get authorization for the location of their phone and the proximity to other people with cell phones.
The authorization would allow the CCSS to determine through Bluetooth with which other people the infected person had contact, at a certain physical distance, in the 14 days prior to the confirmation of the infection.
Thus, health authorities could identify and locate people at risk to determine if they have symptoms and if they require sampling.
For example, two people activate EDUS on their cellphones. They use their cellphone normally. Then one of them tests positive for the coronavirus. With the patient’s permission, the system sends an alert to the people who were in contact with him or her.
Dr. Eduardo Rodríguez, head of the EDUS clinical component, explained that the CCSS would not only send messages to those who interacted with the infected person, but also to those within a certain range around them, without specifying who the patient is or where they live.
“It would always be anonymized, without identifying the (infected) person. Obviously, it is not to mark the exact point, but to say ‘you must take extreme measures because in X range there is a positive case,’ ” the official explained.
To apply this method, the CCSS is analyzing the legal possibility of updating its “app” to add the function of allowing georeferencing.
Accessing the data from cellphones would allow health authorities to make precise epidemiological scans, as well as alert those who are close to or have had contact with an infected person.
Roberto Sasso, president of the Technological Research Club (Club de Investigación Tecnológica) and who promotes the “precision quarantine” (cuarentena de precisión) system, adds that those who were in contact with the infected person could be isolated and the procedure repeated with those that test positive.
Apple and Google also developed a contact tracking system that will make it possible, in mid-May, that as soon as a person is diagnosed with covid-19, alerts are sent to those who are within nine meters or less from said patient. It is also a volunteer application.
“Each user will have to explicitly choose whether to activate the technology. It can also be deactivated at any time by the user,” the two companies wrote in a joint statement.
Advantage of Edus
The advantage in the case of EDUS, which is the most downloaded health “app” in Costa Rica, is that almost 1.2 million cellphones have it installed and that the patient receives the guarantee from the CCSS that their private life will be respected – security and location will not be used.
This is not new. Other countries, such as Singapore, Israel, South Korea and Poland applied it in this emergency to contain the number of infected.
Tracing the virus path
According to Eduardo Rodríguez, until now EDUS has been useful to follow up on those infected with covid-19, as well as to receive reports from those who have suspicious symptoms.
However, the institution can still get more out of the tool.
“We have to make some adjustments that are minimal, in that the functionality is already in production and could be applied in a very, very short time. When I speak of very short, it is days,” said Rodríguez.
The CCSS, to roll out the app, is in consultations with its Legal Directorate and with the Data Protection Agency of the Inhabitants (Prodhab), to verify the legal possibility of implementing the strategy and define the rules to follow.
According to Sasso, international experiences indicate that, for a strategy of this type to be fully exploited, it is required that between 60% and 70% of the population use the technology.
A caveat
While the CCSS aims to make participation voluntary, Sasso believes that Legislators could pass emergency measures that force the system to be used for the benefit of public health.
He said that the use of their cellphones could be cut off if the person does not use the app, for example.
According to the head of the clinical component of the EDUS, until they have definitive legal criteria, the CCSS assumes the use of the app and its location feature is voluntary, that is the user could decide to activate the app or not. Even after activating, the user could turn off the app.
Access to data with informed consent
Depending on the legal opinion, Rodríguez explained that signing consent for location and tracking is one way to make use of the app.
According to lawyer José Francisco Salas, a specialist in computer law, although health records are sensitive and geolocation is restricted information, the law allows the State to access both.
“When it comes to an emergency like the one we have now, which is a health emergency, it can be done perfectly as long as there are clear rules for that. First, what is the purpose of data collection? And, very importantly, that purpose cannot be diverted,” said Salas.
The lawyer added that the fundamental thing is that there is informed consent from the owner of the data on how the information will be used, that the data is for the exclusive use of the health authorities and that the patient’s identity is shielded from third parties.
Several legislators have shared their opinion on the EDUS publicly. One of those is Wagner Jiménez, chairman of the Science and Technology Legislative Commission, who stated that if the Caja’s plan required any legal reform, he would support it.
“International experience confirms that technology is an instrument par excellence at the service of countries to face the Covid-19 storm,” said Jiménez.
Enrique Sánchez, legislator of the Partido Acción Ciudadana (PAC and chairman of the Human Rights Commission, considers that the exceptional situation could justify the measure, under strict controls.
For Sanchez, privacy and data protection principles must be applied, the data must be anonymized, that the information is strictly necessary and that there is no scope to use it elsewhere.
“Also that access to data is exclusive for those who need it to deal with the crisis, it would have to be stored in an independent database so that it can disappear the day after (after the emergency ends),” Sanchez said.
Since March 26, the EDUS mobile application allows those who experience suspicious symptoms of covid-19 to report them to the Caja.
According to Rodríguez, until this Wednesday morning, 143,768 reports had been generated, of which 11,012 corresponded to people at high risk of contracting the disease.
Another 33,599 identified a medium risk that the symptoms experienced corresponded to the new disease, while 73,415 found a low probability. The rest correspond to people who did not report symptoms.
Rodríguez explained that the “app” also allows them to identify people who may have been infected, but who have few or no symptoms.
