Utah's Contact Tracing App Doesn't Use Apple's Exposure Notification API, Opts for Less Private GPS-Focused Approach

Utah in April released "Healthy Together," a contact tracing app aimed at limiting the spread of the coronavirus by letting people know if they've come in contact with someone who is later diagnosed with the virus.

The aim of the Healthy Together app is to help the 1,200 Utah Department of Health workers who are doing in-person contact tracing through phone calls. Utah's health department has access to the name, telephone number, and location data of people who test positive for COVID-19 and opt to share their data.

The app uses Bluetooth and GPS to determine when smartphone users come into contact with one another, and if someone tests positive, they can share their location history and contact history over the past 14 days with a contact tracer. Twenty believes that this can cut hour-long phone calls used for contact tracing down to 16 minutes. From Twenty chief strategy officer Jared Allgood:

"Jeff and Sarah are two individuals in this example who don't know each other but they both have the app on their phones. And so the both phones are emitting Bluetooth and GPS signals. Through that data we can identify whether or not two people have spent some time together."

"If Public Health is calling somebody who has the application on their phone, and they've granted permission to see this minimum set of data to do the contact tracing effort, now, instead of spending an hour, you know, interviewing Jeff and trying to fill in the gaps in his memory, they together can step through his list of location history."

Apple and Google's privacy-focused solution does not allow personal information to be provided to public health departments, and it does not involve location-based data collection, unlike Utah's Healthy Together app. Twenty's founders claim that the Healthy Together app is opt-in and users can choose to limit permissions like GPS or Bluetooth if they don't want their location tracked, but it's not clear how this impacts the effectiveness of the contact tracing design as implemented in Utah.

According to the Utah state website, Utah opted out of Google and Apple's solution because Bluetooth alone "gives a less accurate picture" than Bluetooth and GPS location data.

The goal of Healthy Together is to allow public health officials to understand how the disease spreads through the vector of people and places, and both location and bluetooth data are needed to accomplish that.

Bluetooth helps us understand person-to-person transmission, while location/GPS data helps us understand transmission zones -- having both of these important data points provides a more effective picture of how COVID-19 spreads. This data helps policy makers make the best possible decisions about how and where we begin to relax and modify restrictions as our community and economy begin to reactivate.

One of the benefits of the Apple/Google API is background Bluetooth tracking that does not require an app to implement battery draining features or require users to keep it open for smartphone to smartphone communication to be effective. Utah will not have the benefit of the API by opting for an outside solution, which could also impact the effectiveness of the app.

45,000 people have signed up for Utah's contact tracing app, which is about two percent of the state's population. Some estimates have indicated that to be effective, contact tracing apps need to be downloaded by 60 percent of a population.

Apple and Google have said that they're aiming to release the ‌Exposure Notification‌ API in mid-May, so we could see it as early as this week after the release of iOS 13.5. Following the release of the update, the first apps that use the API will be able to be released.

Update: The state of Utah says it has not completely rejected the Apple/Google API, and the following statement was provided to MacRumors:

While Healthy Together does not currently include the Apple/Google API (as it has not been officially launched), neither the state of Utah nor Twenty has completely rejected their solution. As it stands, Apple/Google’s plans are to disallow the use of the API with apps that identify the user or utilize GPS, but there’s still a lot to be learned out about what they ultimately roll out, and Healthy Together is still open to conversations and digging further into the API.

The Healthy Together app was created to meet specifications from Utah’s public health team, and is intended to support and augment the work of their contact tracers, not automate or replace them. Our approach is tech agnostic and built to balance the need for public health effectiveness alongside the need to protect user privacy. Twenty invested heavily in building up a privacy framework that they believe not only meets but exceeds this balance wherever possible (see more here), and remains open to learning and/or adjusting along the way.