City contact tracers had access to COVID-19 patient records after quitting or being fired, investigation finds
More than a quarter of the city of Chicago’s COVID-19 contact tracers who left their jobs as of early this year still had access to patient data for at least a month after their termination.
That’s according to City Hall Inspector General Joseph Ferguson. His office investigated Chicago’s contact tracing program, which is run by private contractors, and found the Chicago Department of Public Health “did not consistently remove terminated users’ access” to a system of tracking coronavirus patients within the standard seven days.
Of the nearly 600 contact tracers hired last year, the report found that 50 had been fired or had resigned as of Feb. 15, 2021. All the departing workers should have had their access to a system with patient data cut off within seven days. But only 11 did, Ferguson found.
A month later, more than a quarter of those contact tracers still could have viewed patient information, though city officials showed investigators that none had done so.
COVID-19 contact tracing involves interviewing people who test positive for the virus and also anyone they might have infected. It’s considered an important tool in fighting the pandemic.
The report found that the city’s tracing program, run by Chicago Cook Workforce Partnership and more than 30 community organizations, largely did a good job of protecting privacy and reducing cybersecurity risks. But it said oversight can be improved.
“Contact tracing will continue to play an integral part in tackling the current pandemic by helping to address and manage cases,” Ferguson said. “As part of its overall and ongoing work to protect communities from both disease transmission and cybersecurity risks, we encourage [the city] to continue to implement and update security needs as they develop.”
According to the health department’s response, the city agreed to strengthen its oversight of the contact tracing system access and “will incorporate employment status reviews into its weekly check-ins with the community-based organizations that are in the corps. This will help ensure [the city] is notified when an employee has left the corps and enable the prompt termination of the employee’s access to the system.”
Health department officials said they “designed the system to have consistent monitoring over who logs in and what they do with information. Because of this, no unauthorized access has occurred in the system, contact tracers are well trained, and people who talk to contact tracers receive life-saving advice and counsel to help stop COVID.”
Regarding the recommended changes to ensure more protections, health department officials said, “We agree and have already implemented several of these extra-layer protective procedures.”
Contact tracers have described challenges getting people to talk to them about their exposure to the coronavirus, and the city program got off to a slow start.
In May 2020, the city issued a $56 million request for proposals to bolster its contact tracing. More than 30 community groups were picked by the workforce partnership group to train the trackers.
The city also should inform COVID-19 patients and contacts how long the city will retain their data, the report said.
Brett Chase’s reporting on the environment and public health is made possible by a grant from The Chicago Community Trust.