Secure Data and Privacy for Contact Tracing Act of 2020

This bill requires the Centers for Disease Control and Prevention to award grants to public health agencies in states, tribes, and territories to incorporate digital contact tracing technology in COVID-19 (i.e., coronavirus disease 2019) contact tracing programs.

This technology must meet requirements with respect to contact tracing functions, data security and privacy, and voluntary use. Grantees that develop or procure technology that does not meet these requirements lose eligibility for this funding and future funding for COVID-19 contact tracing technology.

Furthermore, as a condition of receiving funding, grantees must (1) undertake an independent security assessment, and (2) develop a plan that delineates how the technology augments existing COVID-19 contact tracing and response efforts and addresses interoperability and protections to limit access to the data.

In addition, the bill expressly applies federal privacy standards for the use and disclosure of personal health information by health care providers, health plans, health clearinghouses, and their business associates to contact tracing technology and its use. Current law provides an exception to these standards for personal health information used by, or disclosed to, a public health authority that is legally authorized to collect the information. The bill also prohibits the use of data derived from the contact tracing technology in legal proceedings or for immigration enforcement.

The Government Accountability Office must evaluate this program within 90 days.