Fired Contact Tracers Still Had Access To Patient Records: Report

CHICAGO — Last year, Chicago launched a campaign to find and train contact tracers, people who would track and contain the spread of COVID-19. On Thursday, the city's inspector general announced nearly a quarter of those contact tracers who were fired or left their jobs still had access to health care files for at least a month after they left — though none were found to have taken advantage of it.

Inspector General Joe Ferguson's office investigated the contract tracing program, which is run by a company under contract with Chicago, and said the Chicago Department of Public health failed to revoke terminated users' access to the system that was used to track COVID-19 patients.

The report found that of the 50 tracers who had been fired or resigned, only 11 had their login information deleted from a system that houses patient data within the standard 7 days after their termination. A month after they'd left, about 15 former employees still had the ability to look up patient records.

City officials proved to investigators that no ex-employees attempted to access records, but the possibility casts doubt on what is supposed to be a confidential and voluntary service.

COVID-19 contact tracers are trained to track the spread of the virus, meaning they often ask where, when, and with whom a positive person did something. Oftentimes, they'll ask for names and contact information of people who may have been infected during the days when a person wasn't aware they had COVID-19.

"Contact tracing will continue to play an integral part in tackling the current pandemic by helping to address and manage cases," Ferguson said in a statement. "As part of its overall and ongoing work to protect communities from both disease transmission and cybersecurity risks, we encourage CDPH to continue to implement and update security needs as they develop."

Despite the possible security risk, the investigators' report found the city's contact tracing program did a good job overall, though it recommended some improved safety measures such as training contact tracers to tell patients how long their data will be on file with the city.

The Chicago Department of Public Health responded by agreeing to "incorporate employment status reviews into its weekly check-ins with the community-based organizations."

The program is made possible by community partnerships with nearly 30 organizations through the Chicago Cook Workforce Partnership. By asking when an employee has left one of the contact tracing locations, the city can quickly delete that employee's login access.