A new Kansas emergency bill passed earlier this week includes the COVID-19 Contact Tracing Privacy Act, which aims to protect the privacy of persons whose information is collected through contact tracing and the confidentiality of contact data. 

Some of the guidelines include:

• The bill prohibits the state or any municipality, or any officer or official or agent thereof, from conducting or authorizing contact tracing, except whenever the Secretary or a local health officer determines contact tracing is necessary to perform a public health duty assigned by statute to the official, the Secretary or local health officer may conduct or authorize contact tracing, as provided in the section.
• The bill requires each person acting as a contact tracer, before collecting any contact data, to execute under oath, on a form prescribed by rules and regulations of the Secretary, an acknowledgment of familiarity with the Privacy Act and the duties it imposes, including the duty of confidentiality.
• The bill prohibits a contact tracer from disclosing the identity of an infected person to a contact, and only contact data specifically authorized by the Secretary pursuant to rules and regulations could be collected as a part of contact tracing. The Secretary, a local health officer, or a contact tracer would be prohibited from producing data pursuant to a subpoena unless the subpoena is issued by a court and is accompanied by a valid protective order preventing further disclosure of such information. 
• The bill prohibits contact tracing from being conducted through the use of any service or means that uses cellphone location data to identify or track, directly or indirectly, the movement of persons.
• The bill states no third party shall be required to collect or maintain data regarding infected persons or contacts for the purpose of contact tracing. Contact tracers would be prohibited from obtaining contact data related to an infected person or contact from any third party, except that contact data voluntarily collected or maintained by a third party could be obtained by a contact tracer only if the third party provides such information voluntarily and with the consent of the infected person or contact whose information is disclosed, or such information is provided pursuant to a valid warrant. 

In addition, the bill would require contact data to be used only for the purposes of contact tracing and not for any other purpose; confidential and not disclosed, produced in response to any Kansas Open Records Act (KORA) request, or made public, unless the disclosure is necessary to conduct contact tracing; and safely and securely destroyed when no longer necessary for contact tracing, pursuant to rules and regulations of the Secretary.