Why Only Some Oregon Businesses Must Keep Customer Registries for COVID-19 Contact Tracing

Listen to the audio version of this story, originally aired in XRAY’s daily podcast The Local.

As most of Oregon’s reopening gets underway, there are new rules for businesses to protect against the spread of COVID-19. However only certain types of establishments here are required to gather names and contact information from customers for contact tracing purposes.

Oregon’s contact tracing efforts do not involve any sort of tracking technologies or mobile apps. Still, even these manual contact tracing requirements have some wondering why the state is requiring only some businesses to collect and share customer contact information. Others question the efficacy of the plan in stemming the spread of infection.

And there are civil liberties and privacy concerns. In Washington state, similar rules were overturned when the ACLU highlighted the civil liberties implications of manual contact tracing as a surveillance tool.

So who has to collect customer information in Oregon? Personal services like barbershops, nail salons, tattoo shops and massage therapy places must keep customer registries. Fitness centers and gyms, childcare centers and summer schools and day camps for kids are also required to keep customer logs.

Restaurants, on the other hand, do not have to ask customers for their names and contact information. Neither do all sorts of other businesses like coffee shops or grocery stores or clothing retailers or car dealerships.

Those that are required to keep customer registries would have to provide customer information to Oregon public health officials if requested. Contact tracers would use it to identify people who may have been exposed and therefore at risk of contracting COVID-19.

Reluctance Among Oregon Business Owners

When Oregon authorities in late April first floated the idea of requiring all workplaces to consider keeping customer logs, the restaurant and lodging industries balked.

“Contact tracing documentation of patrons will prove to be problematic and we are adamantly opposed,” the Oregon Restaurant and Lodging Association said in a letter sent to Oregon Governor Kate Brown. The group said they understood the value of contact tracing and privacy concerns but argued that businesses shouldn’t have to ask customers to sign a form, and worried about confrontations between staff and customers.

“We don’t want to set up anybody to be in conflict with a customer who comes in and is told they have to give this information or they won’t be allowed to eat there,” said Greg Astley, director of government affairs for the restaurant and lodging industry group.

Astley also cited privacy concerns. And he questioned whether businesses would have to verify customer information. “If everybody that came into a restaurant gave their name as Kate Brown do we have to ask for ID to verify that information?” he asked.

“I hate to say it’s economically influenced, but that’s what it appears to me,”
– Andrea Montera, licensed massage therapist in Hillsboro

After the ORLA criticized the plan, the state swiftly changed its draft guidance. Oregon’s final rules do not require that restaurants or hotels keep customer registries for COVID-19 contact tracing.

But some questioned why only some types of businesses have to keep customer registries. Andrea Montera, a licensed massage therapist and founder of Integrity Bodyworks in Hillsboro, wondered if some industries just don’t have as much political or economic clout to influence government policy as others such as restaurant or lodging.

Andrea Montera stands in a sanitized massage therapy room at Integrity Bodyworks in Hillsboro.

Her colleagues in the massage therapy industry are not as well-networked or supported by influential lobbyists, she said. “I don’t feel like I have a voice,” she said regarding government decisions in response to the pandemic.

“I hate to say it’s economically influenced, but that’s what it appears to me,” she said during a socially-distanced interview in her still-shuttered massage studio in May.

“The guidelines were finalized with input from health experts on how practices could be modified to achieve public health outcomes, as well as from business owners on what would be feasible to implement,” a spokesperson from Oregon Governor Kate Brown’s office said. “We’ve found through our discussions with various business stakeholders that gathering contact information from customers would be difficult in some sectors.”

Montera also said she was concerned about legal and privacy implications of the contact tracing rules. As a provider of medical massage, she must comply with HIPAA requirements protecting personal health data, for example. The Oregon Health Authority only wants businesses like hers to gather names and contact information, rather than record or supply information about the purpose of a client’s visit, however.

“You do have the right to not provide the information. It also means you don’t get the services.”
Clarence Belnavis, law firm Fisher & Phillips

Clarence Belnavis, regional managing partner at law firm Fisher & Phillips suggested concerns regarding medical information privacy in relation to the contact tracing program are minimal. “[Medical information] is not at issue here when somebody’s going into a service provider appointment,” he said. “It literally is just who did I provide services to on what date.”

Debbie George runs Person’al Barbershop in Albany, Oregon. She said she worried some customers might not appreciate the customer registry rules. “If they don’t comply then I can’t cut their hair,” she said. “It’s a tall order for some, but it’s the law and we have to abide by it.”

Belnavis said businesses like hair salons or massage providers would be noncompliant if they were to serve customers without collecting their information. As for customers, he said, “You do have the right to not provide the information. It also means you don’t get the services.”

The ACLU Helped Stop Washington’s Customer Logging Mandate

In Washington state, reopening rules originally called on all businesses to keep customer information for COVID-19 contact tracing purposes. But the ACLU of Washington quickly sent a letter to Governor Jay Inslee’s office about the plan’s threats to privacy and civil liberties.

“While we respect that the recently issued customer logging requirements aim to improve the process of manual contact tracing, the mandatory collection of contact information from customers is an invasion of privacy,” the group wrote. “Tracking which businesses a person enters, and when and where individuals congregate together, will also have a substantial chilling effect on people’s freedom of association and freedom of expression.”

“Surveillance tools deployed to fight specific crises often outlive those crises.”
– Jennifer Lee, ACLU of Washington

Washington made an about-face just a few days after the letter was sent. Now gathering customer information for contact tracing is voluntary in Washington.

The thing is, it does not appear that the ACLU’s Oregon chapter has weighed in on the state’s customer registry requirements here. Multiple calls and emails to comment for this story went unanswered.

Higher Risk of Infection at Some Businesses

The state’s decision limiting customer registry requirements to certain types of businesses makes sense from a public health perspective, said Doctor Melissa Sutton, a public health physician and senior health advisor for the Oregon Health Authority.

She said personal services and gyms are more likely to meet requirements for risk, for example. “If you’re going for a massage or a facial, you’re going to be one-on-one with someone typically within six feet and typically for longer than 15 minutes,” said Sutton.

“So from a contact tracing perspective, we’re always going to want to identify those people. And because they’re working with the public – multiple members of the public over time – we’re going to want to get to those people as quickly as possible,” she continued.

Sutton explained that the final requirements would have been subject to evaluation and approval by the state’s senior health advisory group comprised of public health physicians, a standard procedure for evaluating public health rules.

“Authorities need to be resourced well enough to use those registries when the time comes for them.”
– Stephen Mooney, assistant professor of epidemiology at the University of Washington

So how would the health authority use the information? If someone tests positive with COVID-19, a contact tracer would get in touch with businesses that are required to store customer logs which that person recalls visiting.

Sutton explained a scenario: “It would be the public health epidemiologist investigating the case calling up and saying there was an exposure at this facility on this day; could you please answer some basic questions about the facility and then could you give us the names and contact information for people who were there between 1pm and 4pm?”

She said the process is designed to limit the amount of information exposed about the person infected. When contact tracing investigators ask businesses for customer contact information they do not tell the business the name of the person who might have exposed other customers or staff, she said.

Contact Tracers: Are There Enough in Oregon?

Customer logs could have limited value if there aren’t enough disease investigators to use them, said Stephen Mooney, assistant professor of epidemiology at the University of Washington.

“There’s sort of like an implicit contract,” said Mooney. “If the authorities are going to require places to maintain registries they also need to be resourced well enough to be able to use those registries when the time comes for them.”

He described a problem that could result from a lack of contact tracing resources. “If I were to register my name somewhere, and then find out that there was a person who was known to have the disease who was in that place, and I should have been contacted – and no one made an effort to contact me even though I made the effort to register myself – I would be pretty upset about that.”

An OHA spokesperson said there are “roughly 100 existing staff either currently working on contact tracing or ready to work on it if needed.” Oregon counties have been hiring their own contact tracing staff, too.

Ultimately, contact registries should be voluntary, non-punitive and accountable to the public, said Jennifer Lee, technology and liberty project manager for the ACLU of Washington. And they should be designed to end when the pandemic ends.

“We’ve seen, unfortunately in the past with crises of the past, that surveillance tools deployed to fight specific crises often outlive those crises and are repurposed for other means,” she said. “And that’s really what we don’t want to see here.”