Exposure Notification: Saving Lives through Partnership and Trust

It all began so simply. A researcher at the University of Alabama at Birmingham (UAB) came to Chris Brown (vice president of research) and to me, Curt Carver (vice president/CIO) with the idea of developing a symptom tracker as a foundational tool for universities and organizations to proactively attack the pandemic. We were skeptical. This was in early March, well before the full impact of the pandemic was apparent. Fortunately, the researcher convinced us and other senior leaders at UAB. Those of us in the central IT organization did what we often do—we negotiated contracts, spun up servers quickly at no cost to the distributed IT unit that developed the software, and helped a small technology team working for a researcher in the College of Public Health develop a web-based app [http://www.helpbeatcovid19.org] through integration with systems we hosted and ran. Three weeks later, everything was running smoothly, and more than 90,000 unique users have used the system since its debut.

Partnering for Public Health

In late April, Sue Feldman—the project lead for what would later be called the GuideSafe project, the platform that houses the applications and tools that help users and organizations fight COVID-19—reengaged the central IT organization to explore the possibility of developing an exposure notification app. We jointly explored options and concluded that, because of its focus on usability and privacy, a framework developed by Apple and Google had the best possibility for adoption in Alabama. Because we had a good partnership with the company, our initial call was with Apple. This partnership had grown over time, starting with a corporate visit in 2016 and culminating in the announcement of the Birmingham Ed Farm program^Footnote1 and a new Apple Campus Store at UAB in 2020.

Apple and Google were still working the details of their program's rollout and had not yet agreed to partnerships with their closest partners. However, in very short order they agreed that Alabama would be an early partner, but only if this effort was conducted on behalf of the Alabama Department of Public Health. Apple's and Google's openness to partnership and collaboration would become a defining characteristic of this project.

We then needed to work with the state of Alabama, specifically the governor and the Alabama Department of Public Health (ADPH), to get the program launched. As with Apple, we had good relationships with these individuals and agencies. State officials were in a full sprint, doing everything they could to limit the spread of the virus in the state and could not take on additional work. After careful consideration, the governor endorsed the project.^Footnote2 The University of Alabama System office was essential in facilitating the necessary conversations for project approval. The relationships that enabled a successful start of the project had been built over time. Without those existing trust relationships, this project would have never gotten off the ground.

Partnering with ADPH was centered on a recognition of how hard they were already working to combat COVID-19 and that any exposure notification app had to complement and strengthen their existing systems without distracting them from core mission activities. We initially developed the app framework, and over time, they became increasingly engaged with the functionality and strategy of the project, leveraging their medical, marketing, and technical expertise to contribute to key components of the app. This growth in this relationship is a sign of a successful project. Ultimately, ADPH published the app on behalf of the state, and we continue to have a close partnership as the app continues to evolve.

Minimizing Data Collection, Preserving Anonymity

The exposure notification app alerts individuals who, based on cell phone data, have been within six feet for fifteen minutes of another user who later tests positive for COVID-19. Users who have downloaded the app and test positive can anonymously report that test result. The system then notifies other users—also anonymously—who have been exposed to the user who tested positive. We do not need location information to do this, so GPS data is not tracked; instead, the app uses low-energy Bluetooth attenuation. Notification of a possible exposure is a private, encrypted conversation between the user and the state health agency. All data is encrypted through public key encryption while at rest and in transit.

As we collaborated to develop the app, user privacy was an essential design principle and critical to user acceptance. Whenever we faced a design decision, we erred on the side of more privacy and confidentiality. Our strategy was to never identify individuals, even for our own records. In this way, we could never lose an individual's private data because we never had it. This approach led to protecting user identification so there is no unique user identification; instead, the app randomly generates user IDs every fifteen to twenty minutes. User contacts are not needed for a notification, so they are not accessed. We retain data only as long as necessary to support a positive user notification, which is fourteen days. Older data is deleted.

Collaboration Based on Shared Values

To speed development, we quickly negotiated a contract with a local software development company^Footnote3 whose CEO shared our belief in the project and wanted to contribute to the well-being of her fellow citizens. No funding was available initially, so central IT covered the cost of the contract from our reserves. This is not uncommon, but we had to believe in our ability and in the project. Daily meetings and sprints began because the requirements were unclear and constantly evolving. Our engagement with Apple and Google was fruitful and frequent as we jointly explored development and configuration of the system. At one point, medical doctors from UAB, ADPH, Apple, and Google collaborated on a particular setting. The collaboration was open, creative, and intensely focused on saving lives. While we initially believed we would complete the project in May, that date kept shifting as we actively debated functionality and the best ways to implement the desired features. This was not going to be a linear project with crisp start and finish dates but instead an agile project with a great deal of uncertainty.

An Innovative Solution to Verification

The concept of verification was particularly problematic. A verification system ensures that the app cannot be used to spread false results, and the medical doctors initially advocated for no verification, choosing sensitivity over selectivity (i.e., better to have false positives than false negatives). This position shifted over time such that a couple of weeks later, a verification system became a requirement for the first release. Given the politicization of COVID-19, we reluctantly came to the conclusion that some elements of society were less interested in saving lives and more interested in making a political statement.

While most states have used a manual verification system, we developed an automated system in an effort to minimize additional work for the state public health organization. They were already working as hard as they could through formal contact tracing. Apple and Google were working on a solution that was many weeks away, and this timing presented an unacceptable delay to our project. A brainstorming session was held with the vice president/CIO and associate vice president/CTO, and then with the technical teams. An innovative verification system that uses two-factor authentication was rapidly developed over the next 72 hours by rising stars on our team. Full coding of the system between the app development team and ADPH would take several more weeks.

The verification system we developed requires independent action by both the cell phone user and a medical doctor/lab. Notification through the app only occurs if there is a match. It is a simple but elegant verification system that contributes to a very secure and fast notification system where verification occurs within hours. In contrast, other exposure-notification apps use a manual notification system for which the response time is measured in days. This agility in verification saves lives and does not increase the workload of the state public health organization.

Launching the App and Managing Perceptions

During this time, the central IT organization at UAB assumed an increasingly prominent role in programming the app and shepherding it through a formal code review with Apple and Google. There was an urgency to deploy the app in time for students to return to college and university campuses for the fall term. As we were evolving the app, Apple and Google were evolving and improving their programming interfaces that we were using. August 17 was set for the launch of the app, which would be in time for the return of students to campus.

On August 5, Virginia launched its own great app,^Footnote4 and two weeks later, we launched our great app in Alabama.^Footnote5 Virginia had 300,000 downloads in 24 hours.^Footnote6 In contrast, Alabama had 50,000 downloads in the first three weeks. Various factors, including demographic and cultural differences between the two states, likely contributed to this disparity in uptake. Working to understand those factors and to try to address them through our ongoing marketing efforts became an important component of the work we did.

The assumptions made by the general public and media regarding the app were challenging. We engaged in a constant dialogue about how the app works.

• No, the app does not drain your battery. It has a minimal effect on battery life.
• No, the app does not access your contact list.
• No, the app does not use GPS data. It does not know where you are on the planet. It does not know who you are. It only knows that you came within six feet for fifteen minutes of someone who was later diagnosed as COVID-positive.
• No, there is not a magic number of downloads. More is better.
• No, it is not perfect, but it is exceptionally good at alerting strangers and those you cannot remember.
• It is not contact tracing, which is a concerted effort typically via public health departments to actively work with a COVID-positive person to identify people the individual has been in contact with and then to contact those people to determine the appropriate strategy to break the chain of transmission (e.g., quarantine, test, etc.).^Footnote7 Our app is exposure notification, which is a passive, anonymous process that only notifies people who have the app (and the notification permissions enabled) and whose device has been within six feet for fifteen minutes or longer. It complements the excellent work of contact tracing and accelerates notification, helping individuals make informed decisions.

For the most part, the community listened, but communication about what the app does and doesn't do remains an area of constant engagement with the public.

Vigilance and a Culture of Trust

The road forward is positive. The app continues to gain adoption and is an important tool in combating the virus. This fight against the COVID virus is a war, not a battle. Every day we will make the app better. We are in active partnership to join a national repository so that the Alabama app works nationwide while retaining our unique verification system so that we do not create unnecessary work for our public health organization.^Footnote8 Apple and Google continue to add new functionality to ease adoptability, and we will incorporate that functionality into subsequent versions of the app.^Footnote9 The team is refining the app to try to add nuance to our messaging and increase app adoption. We continue to advocate for functionality that lessens the workload of state public health organizations.

Within the central IT organization, the development of team members and building a culture and reputation as being an agent of innovation was an essential factor for the success of the project. We had spent the previous five years investing in our employees through training, hiring hungry and talented innovators, and building capacity within our organization. Our "100 Technology Wins a Year for the campus" campaign reinforced an organizational culture of relentless and widespread improvement in the lives of our students, faculty, and researchers.^Footnote10 This created an environment in which university organizations actively recruited central IT involvement in projects.

A second contributing factor was the degree of trust in the central IT organization among its subordinate leaders. In addition to this project, central IT was supporting normal operations, new "return to campus" initiatives involving CARES Act funding and significant changes to the way teaching and business processes had traditionally occurred on campus, as well as a new CARES-funded statewide program for periodic COVID-19 testing of students and employees. This could only be accomplished by delegating some authority for decision-making while amplifying internal communications to ensure alignment. Had the vice president/CIO tried to manage all of these initiatives, they would have failed. Instead, the senior technology leader moved between projects as necessary to ensure each was successful while each initiative was led by his subordinate leaders. The subordinate leaders were fully empowered to make decisions. In the case of exposure-notification app, the university chief technology officer led day-to-day initiatives on behalf of central IT to deploy the app, and this structure worked splendidly.

Technology in Service to the Common Good

Overall, the project was very successful. For many participants, this is the project they will never forget. Our exposure-notification app was the third app of its kind developed and deployed in the United States. This app is the only one for which the majority of programming came from a university, and the app features a novel verification system that automates much of the work a state public health agency must perform to deploy such an app. Key to the success of the project was the close and collaborative partnership between numerous private and public organizations. Everyone was keenly focused on delivering an app that would save lives. It is impossible to list everyone who contributed to the project—medical, communications, marketing, and technical staff from centralized and decentralized university units, as well as public and private agencies and companies, actively collaborated to deploy this app. As these disparate individuals and organizations worked together and built trust, the Alabama exposure-notification app was delivered before the start of classes as a component in the multifaceted plan to protect our students, faculty, and fellow citizens against the COVID-19 virus. Trust, partnership, innovation, and leadership were needed to successfully compete this project. These characteristics and partnerships will serve us well on future projects and initiatives.

Notes

1. Anna Beahm, "Apple's Tim Cook in Birmingham to Tout Ed Farm, Which Teaches Coding to Young and Old Alike," AL.com, February 27, 2020. Jump back to footnote 1 in the text.↩
2. Leada Gore, "Alabama 1 of 3 States to Sign On with Google, Apple for Coronavirus Contact Tracing App," AL.com, May 21, 2020. Jump back to footnote 2 in the text.↩
3. Tyler Patchen, "MotionMobs Working with UAB and ADPH on COVID-19 Contact Tracing App," Birmingham Business Journal, May 29, 2020. Jump back to footnote 3 in the text.↩
4. marianhunter, "COVIDWISE Exposure Notification App Launched to Help Contain COVID-19," Virginia Department of Public Health, August 5, 2020. Jump back to footnote 4 in the text.↩
5. Amy Yurkanin, "Alabama Launches Statewide Coronavirus Tracking App," AL.com, August 17, 2020. Jump back to footnote 5 in the text.↩
6. Jacob Taylor, "Application That Alerts Virginia Users of Possible COVID-19 Exposure Downloaded More Than 300,000 Times," Tennessee Star, August 18, 2020. Jump back to footnote 6 in the text.↩
7. "Contact Tracing—CDC's Role and Approach" [https://www.cdc.gov/coronavirus/2019-ncov/downloads/php/contact-tracing-CDC-role-and-approach.pdf], Centers for Disease Control and Prevention, 2020. Jump back to footnote 7 in the text.↩
8. Mikey Campbell, "APHL Partners with Apple, Google, and Microsoft on National COVID-19 Exposure Notification Server," Apple Insider, July 2020. Jump back to footnote 8 in the text.↩
9. Russell Brandom, "Apple and Google Announce New Automatic App System to Track COVID Exposures," The Verge, September 1, 2020. Jump back to footnote 9 in the text.↩
10. "UAB IT Wins," University of Alabama at Birmingham. Jump back to footnote 10 in the text.↩

---

Curt Carver is Vice President and Chief Information Officer at the University of Alabama at Birmingham.

Brian Rivers is Associate Vice President and Chief Technology Officer at the University of Alabama at Birmingham.

Robert Howard is Associate Vice President and Deputy Chief Information Officer at the University of Alabama at Birmingham.