Privacy concerns hang over workplace surveillance

With help from Darius Tahir (@dariustahir), Tucker Doherty (@tucker_doherty), Tim Starks (@timstarks) and Eric Geller (@ericgeller)

Programming announcement: Our newsletters are evolving. Morning eHealth will continue to publish daily for POLITICO Pro subscribers, but starting on July 13th will consolidate to a weekly newsletter for all others. There will be no changes to the policy newsletters available to POLITICO Pro subscribers. To continue to receive Morning eHealth daily, as well as access POLITICO Pro’s full suite of policy tools and trackers,get in touch about a Pro subscription. Already a Pro subscriber?Learn more here.

Quick Fix

— Workplace surveillance plans raise alarms: Privacy advocates warn that business’ efforts to enforce social distancing and track potential coronavirus exposure could move the nation further on a path toward permanent and widespread data collection.

— A step toward permanent telehealth policy: CMS’ proposal late Thursday would extend virtual care flexibilities granted during the pandemic.

— Health care cyber roundup: Health care companies are seeing abnormal Internet traffic, and the Cybersecurity and Infrastructure Security Agency lends a hand on vaccine research.

eHealth Tweet of the day: Sam Baker @sam_baker reality show where a doctor tries to teach a journalist how to use a fax machine and the journalist tries to teach the doctor how to use slack

in the end they bond after they both try to use electronic medical records software and both give up on it after 30 seconds, albeit for opposite reasons

It’s FRIDAY at Morning eHealth where your author is deeply apologetic for sending emails like this. News tips and responses to last year’s emails go to [email protected]. Tweet us at @dariustahir, @ravindranize, @POLITICOPro and @Morning_eHealth.

Given the unprecedented public health challenge confronting regulatory affairs teams, the AgencyIQ leadership team has decided to pull our research and analysis content concerning the virus and its regulatory implications in front of the paywall. It is available here: https://agencyiq.com/covid-19-resource-center/

Driving the Day

EMPLOYERS USING APPS, WRISTBANDS TO ENFORCE SOCIAL DISTANCING— As states open up, businesses are buying new technology to ensure their workers stay safely apart and can be sent home after potential exposure to anyone who’s self-reported as positive for the coronavirus. But privacy advocates warn that employers have few restrictions on the use of any data collected from these systems, and that the technology could “normalize” workplace surveillance.

“The risk is that [tracking technologies] become an avenue for more extensive data collection that’s really unconnected with the public health emergency and they will continue on after the public health emergency is over,” said Pauline Kim, an employment law expert at Washington University in St. Louis.

“Routine tracking of people’s movements [even] on premises is not something we’ve historically ever needed, outside of these circumstances,” said Alan Butler, interim head of the influential Electronic Privacy Information Center.

...Companies such as Amazon, Ford, and PricewaterhouseCoopers are testing out such technology internally. Video monitors stationed around Amazon offices provide instant visual feedback when employees come within six feet of each other, though the system doesn’t store any data on individuals.

PwC’s smartphone uses Bluetooth to detect when two people are close enough to each other to constitute an exposure risk, though HR only accesses workers’ names if they’ve been around someone who’s self-reported as testing positive for the virus or having been exposed. The company is rolling the app out internally in the next few weeks, and is also selling it to other companies ranging from small startups to large global corporations. PwC employees will be required to download the app as a condition of returning to the office, though most can still work from home.

...Ford is testing out wristbands that buzz when employees get too close; about 1,000 employees across four facilities are voluntarily participating in that pilot.

It’s not clear how useful such apps will be to public health departments, many of whom are building their own contact tracing and exposure notification apps.

“Contact tracing in your office doesn’t do you any good when Johnny goes home and exposes the rest of the family,” said Georges Benjamin, who heads the American Public Health Association.

CMS MOVES TO MAKE HOME TELEHEALTH BENEFIT PERMANENT— Regulations giving home health agencies more flexibility to use telehealth during the pandemic would be extended permanently under a proposed rule released by the agency Thursday afternoon. The proposal was released alongside a routine update of the Home Health Prospective Payment System for 2021, which will boost Medicare payments to home health agencies by $540 million, a 2.6 percent increase over current levels, according to CMS.

As long as the usage is outlined on the plan of care and tied to a specific goal, the rule allows home health agencies to continue utilizing remote patient monitoring, phone calls, two-way audio-video and similar technologies to connect Medicare patients and clinicians, POLITICO’s Tucker Doherty writes. The rule allows agencies to continue reporting related costs as allowable administrative costs, but usage cannot be considered a visit for the purpose of patient eligibility or payment. CMS Administrator Seema Verma touted the proposal as “one of many system upgrades we’re making to ensure our Medicare program runs smoothly for our beneficiaries & providers.”

Your chance to shape telehealth regulation: The National Committee for Quality Assurance-, the Alliance for Connected Care-, and the American Telemedicine Association-led Taskforce on Telehealth Policy wants public input as it drafts recommendations for robust telehealth regulations that allow for widespread use of the technology while also protecting against its misuse. The public comment deadline is July 8.

“We urge all telehealth stakeholders to share their insights,” said ATA’s Ann Mond Johnson.

CISA IN THE AGE OF COVID-19 — CISA has been working to protect Covid-19 vaccine and therapeutics manufacturers that are part of “Operation Warp Speed” to develop a vaccine by January 2021, the agency’s director, Chris Krebs, said at an event hosted by GovExec and Forcepoint. CISA has also been collaborating since March with HHS, the Pentagon and the FBI to identify certain “tier one” companies and universities vital during the pandemic — under an initiative called “Project Taken” — to offer them vulnerability scans and educate them about threats.

“We’ve really picked up momentum up to now with significant uptake and enrollment from some of the most critical and large well-known pharmaceutical brands to smaller companies that are part of that critical supply chain,” Krebs’ cybersecurity deputy, Bryan Ware, said at a CrowdStrike event. They’ve also “seen an increase in vulnerabilities in that sector, but we’ve seen that sector — amongst all the others that we scan — is much more attentive and much faster at addressing the vulnerabilities that we find.”

Speaking of CISA: The FBI and CISA recently briefed senators who requested information about the agencies’ responses to China’s cyberattacks on U.S. coronavirus research efforts, our colleagues at Morning Cybersecurity report. Officials met on Tuesday with Sens. Thom Tillis (R-N.C.) and Richard Blumenthal (D-Conn.), the senators’ offices confirmed.

The two lawmakers, along with Sens. Ben Sasse (R-Neb.) and John Cornyn (R-Texas), sent a letter in May asking the agencies if they needed more authorities or funding to help defend American companies from state-sponsored hackers, as well as how they notified high-value targets about these attacks. (Sasse’s office didn’t respond when asked if the senator attended the briefing while a Cornyn spokesperson didn’t answer the question.)

Health care’s risky cyber practices: Expanse’s study of six Fortune 500 health care companies finds many have observed abnormal internet traffic — half had communications with exposed Remote Desktop Protocol servers, and two had outbound communications with Iran, among other tidbits.

LABS WANT STREAMLINED REPORTING REQUIREMENTS —The American Clinical Laboratory Association thinks HHS’s reporting mandates could use streamlining. The ACLA says the department’s requirements aren’t well-targeted and that information like sex, race, and ethnicity aren’t available to labs. The ACLA also cites duplicative requirements between HHS, CDC, and various states, plus a host of technical issues, as other problems with the department’s requirements.

CALIFORNIA’S NEW DATA PORTAL — Gov. Gavin Newsom unveiled a new open-source coronavirus data portal this week to help residents and programmers examine the data more easily, our colleague Jeremy B. White writes. “We want to put this out there,” Newsom said. “We want it tested and we want it challenged.”

...He suggested that California was the first state to release data on such a broad scale, and said it would help the state’s 58 counties share data with each other, providing deeper insight about the virus’ spread.

What We're Reading

— Federal News Network’s Nicole Ogrysko reports on VA’s drastic expansion of telehealth.
— MobiHealthNews’ Sara Mageit writes about mental health trackers for construction workers.