Contact Tracing for Employers: A Beginner’s Guide

June 5, 2020

The topic of contact tracing has dominated the public conversation for weeks, and with it a host of different suggestions of how to execute effectively - mobile apps, wearable devices, camera surveillance, and more. When it comes to contact tracing, what are an employer’s responsibilities and how should they prepare for the task?

Introduction to contract tracing

While there has been much conversation about technological assistance with contact tracing, contact tracing is a process, not a product. The seeds of the idea date back to the 1700s, and its use to stop the spread of disease has been well-documented beginning in the 1930s. Today, the CDC defines contact tracing as follows:

“In contact tracing, public health staff work with a patient to help them recall everyone with whom they have had close contact during the timeframe while they may have been infectious. Public health staff then warn these exposed individuals (contacts) of their potential exposure as rapidly and sensitively as possible.”

At a very high level, there are three primary steps in contact tracing: 

  1. Diagnose an individual and isolate them from others
  2. Identify contacts of that individual
  3. Notify and quarantine contacts, and monitor their health for possible infection

In the event one of the contacts is later diagnosed, step 3 cycles back to step 1 and the process repeats; in this way, contact tracing is a cascading process.

Within public health departments this process is performed by teams of contact tracers, who are trained in a suite of skills ranging from how to effectively interview infected patients to how to resourcefully find and notify contacts. In Wuhan, China, where SARS-CoV-2 was first identified, there were at least 9,000 contact tracers working to identify, notify, and monitor contacts of diagnosed individuals. In the United States, public health agencies are rapidly recruiting and training contact tracers to perform this vital work. 

How do employers fit into this process? 

Employers can play pivotal roles in steps 2 and 3 of the contact tracing process: Identifying contacts in the workplace, and notifying and following up with each one. In fact, in the event of a confirmed or presumed workplace infection,* the CDC’s “Interim Guidance for Businesses and Employers” sets the expectation that employers “determine which employees may have been exposed to the virus and may need to take additional precautions.” In other words, you should have a process in place to quickly identify and notify workplace contacts, either through the more traditional means of interviewing an infected employee, or with assistance from digital tools. Given the recent media attention to digital tools, we provide a brief overview of digital tools before diving into the process of employer contact tracing.

An overview of digital tools to assist contact tracing

Depending on the specific tool, digital technologies can help with steps 2 (Identify) and/or 3 (Notify) of the contact tracing process, automating and accelerating what is typically a long and labor-intensive process. The technologies that have seen the most media attention are programs for “proximity tracing,” in which cell phone applications leverage GPS, Bluetooth, and/or WiFi signals to identify individuals that have been in a patient’s proximity. Examples of proximity tracing tools include the protocol from Apple and Google, which enables public health agencies to develop their own contact tracing applications for iOS and Android devices (Apple and Google do not intend to create their own apps). Other tools in this category include the Check-in app from PricewaterhouseCoopers, the TraceTogether app in Singapore, or the state health department apps in use in Utah, North Dakota, and South Dakota


While these kinds of digital tools can expedite the contact tracing process, experts agree they are a supplement, not a replacement, for “manual” contact tracing. Their most obvious limitation is that they require widespread adoption to be most effective. A model from the University of Oxford suggests that “we can stop the epidemic if approximately 60% of the population use [a proximity tracing] app.” While lower usage is still helpful, the utility for contact tracing diminishes with fewer users. In the US, the highest adoption rate has been in South Dakota, at a mere 2% of the population.

Beyond concerns about adoption, there have been some questions regarding the accuracy of digital proximity tracing. In an article published on Friday in the Canadian Medical Association Journal, Dr. Robert Kleinman of Stanford Medical School describes limitations in both Bluetooth and location-based measurement precision, and notes, “As a result of measurement errors, digital contact-tracing technologies will have less than 100% sensitivity and specificity for identifying exposures among users of an app.” Finally, many (including Dr. Kleinman) have raised concerns about the privacy implications of these technologies. In summary, former CDC director Tom Frieden lamented in an interview with The Washington Post that proximity tracing faces “very serious questions about its feasibility and its ability to be done with adequate respect for privacy.”

While digital tools have limitations, the possible advantages of rapidly identifying and notifying contacts have many employers exploring their use. One advantage employers may have over public health agencies is they may be able to require employees to download such an application, which would overcome the hurdle of widespread adoption. According to international law firm Ropes & Gray, “In general, private employers likely could lawfully mandate that employees utilize a contact-tracing app, provided that the mandatory program is administered in a manner that is no more intrusive than necessary to meet the legitimate business concern.” There are nuances, however, depending on the precise functionality of the app and your organization’s specific jurisdiction; see the full report here

From a practical point of view, you should consider whether all your employees have smartphones and keep their smartphones with them throughout the day. If your workforce does not have employer-issued smartphones, Ropes & Gray points out that “employers will face practical difficulties actually forcing their employees to install apps on their personal devices.” If employees will incur additional costs for the use of the app (e.g., if they need to purchase a smartphone, or will incur SMS or data charges), an employer would likely be obligated to reimburse them.

Finally, the use of a digital tool would need to be implemented in a non-discriminatory manner that upheld the Americans with Disabilities Act (ADA). You may need consent from employees regarding any information you as an employer could access, particularly if health information is involved. These restrictions apply both in the implementation of a digital tool as well as any contact tracing process an employer may implement,  which leads us to the final question: How should employers conduct contact tracing in the immediate aftermath of a confirmed or presumed diagnosis?

Contact tracing as an employer

Identifying contacts:

In the event that an infection occurs in your workplace, you will need to act quickly to identify those who may be considered a “contact” of the infected individual. The CDC defines a close contact as “someone who was within 6 feet of an infected person for at least 15 minutes starting from 48 hours before illness onset until the time the patient was isolated.”

Based on this definition, you first want to define a period of time that you will focus on, “starting from 48 hours before illness onset.” Within that period of interest you should identify individuals who meet the CDC definition of close contact, a process that should likely be managed by your HR team given the confidential nature of the topic. 

If you are using a more “manual” method of contact tracing, an HR representative will likely need to interview the infected individual. Some inquiries you might consider include:

  • Ask the individual to walk through their days step-by-step: “Walk me through [Day 1]. When did you arrive on-site? What did you do first? Did you come into contact with anyone there? What happened next?”
  • Ask the individual whether they carpooled with any others to get to work.
  • If the individual performs shift work, ask which shift they worked on each day, and in what areas they worked. You may need to also follow up with their manager to ask who else worked on that shift or worked in those areas.
  • Probe on whether they had any group meetings, discussions, or stand-ups. If they have a work calendar, ask them to consult it to refresh their memory of any meetings.
  • Ask about use of shared spaces or equipment, where they were most likely to come into contact with others: “Did you use a restroom? What about a break room? The coffee area? Stairwell? Elevator? Was anyone else there?”
  • Remember to inquire about non-employees: “Did you come into contact with any third parties for work-related reasons? Vendors? Delivery personnel? Customers?”

These questions will yield a list of contacts you will immediately notify in the next step.

If you are using a digital solution to identify contacts, you likely can engage the system to quickly and automatically create a list of possible contacts. However, given some of the concerns with system accuracy, you may want to check that list with the infected individual before moving to notify contacts. Also remember that any non-employee, such as a customer or vendor, would likely not be in your app system and therefore would not be represented on your list.

Notifying contacts:

Once you have identified contacts, your HR team will need to notify them that they have potentially been exposed and instruct them on next steps. If there are more than a handful of contacts, you may want to divide the task out across multiple HR representatives in order to notify contacts as quickly as possible. In these conversations, you should NOT identify the infected employee by name, nor share anything about their health condition, even if you are explicitly asked.

  • Notifying employees: If you are using a digital tool to assist with contact tracing, it is possible the tool manages notifications to employees as well. Even so, it is probably better to privately and individually reach out to those who have been identified as close work contacts, given the sensitivity of the topic, and the anxiety and questions it might cause. An article in Harvard Business Review recommends sharing a message like the following: “Someone in our workplace has tested positive for Covid-19, and they have identified you as a close contact according to the CDC definition. We are here to support you. If you are at work, please prepare to leave as quickly as you can.”

    Keep the tone of the conversation calm and empathetic, and provide them simple and clear instructions on next steps and what they can expect. For example, the CDC advises close contacts of an infected individual to:

    “Stay home until 14 days after your last exposure.
    “Check your temperature twice a day and watch for symptoms of COVID-19.
    “If possible, stay away from people who are at higher-risk for getting very sick from COVID-19.”

    You should consider how you would like to stay in touch with these contacts, and whether there are situations in which you would want to be notified. For example, if one of these contacts were to develop symptoms the next day, you may want to be notified so you could initiate another contact-tracing effort. You may also want to ask for personal contact information, in case you need to follow up with them for more information, or simply want to check in before they return to work. Note that you should not ask about any health information unrelated to symptoms of SARS-CoV-2.


  • Notifying third parties (contractors, temporary workers, vendors, delivery personnel, customers, etc.): Even if you have mandated employee use of a digital tool to help with contact tracing, such a tool will not help with third parties like vendors or customers. You will need to individually notify third parties of possible exposure, again maintaining the confidentiality of the infected employee and their condition. If it is necessary to facilitate contact tracing, the EEOC currently allows you to share the employees identity to a “staffing agency or contractor that places an employee in an employer’s workplace.”

Finally, as other organizations perform contact tracing you should be prepared to receive notifications from other entities, including public health agencies, regarding the possible exposure of one of your employees. Your team should be ready to respond with a similar process and policy for notifying such contacts in a confidential manner.

With all these processes in place, employers can help protect their team members who may have been exposed, whether they choose to use digital tools or more traditional methods. 
*For more information on responding to a SARS-CoV-2 diagnosis, see our article here.

Commentary from TeamSense should not be construed to be authoritative legal or public health guidance. Organizations should follow the latest guidance from relevant governmental and public health authorities and seek counsel from appropriate Legal, HR, and EHS professionals.