What is the NHS COVID-19 contact tracing app?
Using technology for contact tracing
The NHS has started testing a contact-tracing app to support a safer eventual transition out of the lockdown, by allowing any new cases to be quickly isolated, and preventing a mass resurgence of infections.
How will the app work?
Using Bluetooth technology rather than GPS means that the app will not be able to track a user’s geographical location, but only records “contacts” with other phones in its vicinity.
Much public debate has focused on the method by which the app will store user data. NHSX has recently announced that the app will be built around a centralised data platform, where data stored on a user’s phone is sent to a central database and processed when someone activates the contact-tracing function.
This method is different from the approach taken in some other countries, where contact-tracing is performed on users’ mobile phones, without sending data to any central location. Tech firms including Google and Apple have claimed the decentralised approach is more secure since there is no central location where all data is stored, and no single organisation has a full picture of user identities.
In our conversations with NHSX, we have emphasised the need for greater clarity on the rationale behind a centralised approach, alongside assurances that this will not compromise user anonymity.
Oxford University Big Data institute suggests that 80% of smart phone users would need to download and use the app for it to stop the virus, though uptake rates around 40-50% would still achieve a high impact, and any uptake could have a positive effect.
NHSX has been clear that use of the app would be completely voluntary, so achieving sufficient uptake to make the app effective will require a high level of public confidence alongside a public information campaign. For comparison, a similar app introduced in Singapore and was downloaded by approximately 12% of the population. In Australia, 8% of the population downloaded the app within two days of its launch.
The app will use Bluetooth technology to track when a user’s phone is within a certain proximity of another user’s phone.
If a user develops symptoms or tests positive for COVID-19, the app would send a series of alerts to people the user has recently been in contact with, advising them to go into self-isolation. The app could allow people to self-diagnose by asking the user a series of question through the app.
A secondary purpose of the app would be to provide the NHS with additional data on the spread of the virus to help with decision-making around broader public health interventions.
NHSX, the national digital unit who have developed the app, has said that it hopes to roll out the app in mid-May.
What do we know about public views on NHS data-sharing?
Our past research has shown (Healthwatch England) that most people are happy for the NHS to use personal health data to improve others’ health if they are certain that the data will be kept anonymous, and will only be used for the specific purpose to which they have given consent.
However, a series of public scandals involving the use of personal data have eroded public trust in organisations holding user data responsibly.
In 2015, Healthwatch England developed 10 principles on information-sharing to give people confidence about the use of their data, many of which are still relevant.
We have also highlighted the importance of communicating well with the public and giving them the information they need to make an informed decision about whether to opt into data-sharing initiatives.
Things to watch out for
Experts and campaigners have raised a variety of concerns about the implications of the app. Here we outline a few areas where unanswered questions will require further monitoring and scrutiny.
Data privacy
Some organisations and researchers have expressed concerns around how the data collected through the app will be stored and pointed out the potential for misuse of data. While NHSX has briefed that data will only be stored for the duration of the epidemic and all data will be anonymised, so far no accountability mechanism for this has been outlined, and the Guardian has reported that provisions for data to be de-anonymised have been considered. The Ada Lovelace Institute recommends that primary legislation be advanced in parliament to govern the use of data collected through the app.
Technical limitations
If there are any imprecisions in detecting proximity or distance via the app, this could impact both effectiveness and public trust. Another concern is that allowing contact-tracing to be triggered through self-diagnosis would mean that not everyone advised to self-isolate would actually be at risk. This issue could be mitigated if, alongside the development of the app, testing can be increased to a level where anyone with COVID-19 -like symptoms can quickly and easily access a test.
Digital exclusions and health inequalities
Making the contact-tracing app a central pillar of any lockdown exit strategy risks unequal outcomes for certain groups who are less likely to access the app. This could include those who lack digital skills, those who may not be able to afford a smartphone or data plan, and communities which might be less likely to adopt the app due to fears about privacy or monitoring.
Fraud
There is a possibility that fake versions of the app could be created to exploit user data. While this possibility could be mitigated by increased security, NHSX has previously also said that it is considering making the app’s source code public in the interest of transparency.
Next steps
The NHS has acknowledged the variety of privacy and public trust concerns they need to mitigate if the app is to be successful. This is positive, but the public will need further clarity before the launch of the app to have confidence that security and privacy standards are maintained. If there is a breach of public trust regarding data exploitation, this could have massive negative knock-on effects for other essential public health measures which rely on public trust in government advice.
Healthwatch England will continue to monitor the development of the app and seek assurances from NHSX regarding privacy, effectiveness, and security. The public will need absolute transparency on the following questions to ensure the app’s success:
- What data will the app capture?
- How will it be captured?
- How will it be used?
- Who will have access?
- How long will they have access to it?
- What happens to anyone who misuses the data?
