Updated on May 17, 2020

COVID-19 Contact Tracing for Health Departments

Version 1.2

Introduction

The following preliminary1 criteria define minimum and preferred characteristics of digital contact tracing tools to help 

health departments overcome one or more obstacles in the COVID-19 contact tracing workflow2. They are based on 

preliminary research and targeted discussions with contact tracing and informatics experts across county, state, and 

federal government; national public health associations; academic consortia; and nongovernmental organizations.

The table below lists minimum and preferred criteria for two categories of contact tracing technology: those for case 

management3, and those for proximity tracing4. Minimum and preferred criteria of the tools’ technical and general 

attributes are described in Table 2. 

= case management = proximity tracing

Table 1. Minimum and Preferred Capabilities of Digital Contact Tracing Tools

Contact Tracing 

Task

Criteria

Minimum Preferred

Patient 

Identification / 

Follow-up

• Enables public health authorities (PHAs)5

to import existing data (e.g., from PHA 

information systems)

• Can be configured for real-time 

synchronization of data from PHA 

information systems

• Enables confidential collection of data 

(via PHA manual input) facilitating the 

connection of laboratory-confirmed 

patient with services needed to support a 

14-day self-isolation process (e.g., safe 

housing, food)

• Enables patients to report their 

validated testing status, relevant 

demographic data, data facilitating 

the connection with supportive

services, and the best means of 

communication

Contact Elicitation 

/ Identification

• Enables PHAs to manually record data on 

contacts of patients

• Enables patients to self-report 

contacts

• Can seamlessly import proximity 

data from patient once consent is 

received

Contact 

Notification

• Enables manual and automated 

notifications6 to known contacts in the 

following order of priority: recorded voice 

message, email, and SMS

• Messaging can be tailored to the 

likelihood of exposure, include links to 

health information resources, and provide 

next steps (e.g., testing, self-isolation)

• Enables automated notification to 

community contacts who opt in to 

being notified, based on history of 

proximity to patient (i.e., within 6 feet 

for 30 minutes or more) while also 

preserving anonymity of patients7

Contact Follow-up • Enables PHA to initiate direct, manual 

follow-up with known contacts and collect 

longitudinal data and data facilitating the 

connection of contacts with services 

needed to support a 14-day self-isolation 

process

• Enables seamless restart of logic model / 

workflow upon confirmation of case 

status among any known contact

• Enables automated dispatch of 

reminders to known contacts and 

community contacts for 14 days with 

directions to call PHA or 

electronically self-report symptoms 

and other information facilitating the 

connection with supportive services

• Self-reported data are used for 

automated prediction of case 

classification and provide immediate 

notification to contacts and PHA 

when infection is likely

Preliminary Criteria for the Evaluation of 

Digital Contact Tracing Tools for COVID-19
2

Table 2. Minimum and Preferred Attributes of Digital Contact Tracing Tools

Attribute Minimum Preferred

Technical

Platform Support • Can be easily used within web 

browser on mobile and desktop 

environments

• Provides cross-platform 

functionality (Android, and iOS, with 

reasonable backwards compatibility 

for older Android and iOS versions)

• Supports offline data entry and 

caching

• Supports offline data entry and 

caching across platforms

Data 

Interoperability

• Supports manual data import from 

PHA information systems

• Supports manual data export in 

common formats

• Use programmatic means of secure 

data transfer 8 between information 

systems within and between 

jurisdictions

Trustworthiness • Uses open architectures and open 

standards

• Is open source

Users • User access for PHAs • User access by patients and their 

contacts

Availability • Ready to use and rapidly deployable • Already being used successfully by 

jurisdictions

Customizability • Requires vendor to perform all 

customizations for PHAs

• Allows PHAs to perform some of 

their own customizations (e.g., 

adding new data elements, 

implementing data validation rules)

Privacy • Transparently informs users of which 

data is collected, how it is used, and 

how long it will be retained

• Implements measures to prevent 

introduction of false data

• Requires consent of both index 

patient and contact before using of 

personally-identifying information 

(PII)

• Encrypts data in transit and at rest

• Provides individuals access to their 

own data and ability to revoke 

consent at any time

• Provides individuals the ability to 

delete their own data

• Provides publicly available 

independent security and privacy 

assessment that address issues of 

trustworthiness, security, and privacy

• Authorized data access only for 

PHAs and must be limited to need-toknow basis

General

Technical 

Support

Developer / vendor provides comprehensive technical support for PHAs

Vendor 

Experience

The developer / vendor has experience working in public health settings

Localization Self-reporting features are available in patient’s and contact’s language of choice
3

1 This document should be viewed as a living body of knowledge. It will be updated as more is learned.

2 This includes each task included in the first column of Table 1.

3 Tools to streamline the electronic capture and management of data on cases and contacts; may also provide means of automating 

communication and follow up with contacts of an infected individual. Workforce management software (e.g., for orchestrating virtual call centers) 

is currently beyond the scope of this document.

4 Tools that use Bluetooth or GPS technologies to estimate the proximity and duration of an individual’s exposure to an infected person; used in 

addition to contact tracing case management tools.

5 Local, state, tribal, and territorial public health departments

6 We recommend that automated messaging incorporate rapport-building human elements (e.g., delivered in audio or video by trusted local or 

national health figure)

7 For tools using geolocation-based proximity tracing, we recommend participatory sharing methods that require health departments to validate 

case status. For tools with Bluetooth-enabled proximity tracing, we recommend decentralized, bidirectionally anonymous methods. For an example 

of a protocol that employs this method, see the PACT protocol. Inclusion does not indicate endorsement. 8 E.g., RESTful API transferring data over HTTPS or SSH