48-961. COVID-19 contact tracing privacy act; duties of secretary of health and environment and local health officers; regulation of persons acting as contact tracers; use of contact data, confidentiality; violations, remedies and penalties; rules and regulations; expiration of section. (a) This section shall be known and may be cited as the COVID-19 contact tracing privacy act.

(b) The purpose of this act is to protect the privacy of persons whose information is collected through contact tracing and the confidentiality of contact data.

(c) (1) Except as provided by paragraph (2), neither the state nor any municipality, officer or official or agent thereof, may conduct or authorize contact tracing.

(2) Whenever the secretary or a local health officer determines contact tracing is necessary to perform a public health duty assigned by statute to such official, the secretary or local health officer may conduct or authorize contact tracing as provided by this section.

(d) (1) Subject to the availability of appropriations, the secretary or local health officer may employ, contract for or engage contact tracers.

(2) Persons acting as contact tracers under authority of this subsection shall meet the qualifications and training prescribed by rules and regulations of the secretary adopted pursuant to subsection (j). Until such rules and regulations are adopted, but no later than August 1, 2020, persons acting as contact tracers may act under the supervision of the secretary and in compliance with the other provisions of this act.

(3) (A) Before collecting any contact data, each person acting as a contact tracer shall execute, under oath, on a form prescribed by rules and regulations of the secretary adopted pursuant to subsection (j) an acknowledgment of familiarity with this section and the duties it imposes upon such person, including the duty of confidentiality.

(B) The state or municipal entity hiring, contracting with or engaging the contact tracer shall maintain a copy of each such executed form for not less than one year after such person's duties as a contact tracer end, or pursuant to applicable records retention schedules, whichever is later.

(4) A contact tracer employed, contracted or engaged by the secretary shall be deemed a state employee under the Kansas tort claims act, K.S.A. 75-6101 et seq., and amendments thereto. A contact tracer employed, contracted or engaged by a local health officer shall be deemed an employee of the county under the Kansas tort claims act, K.S.A. 75-6101 et seq., and amendments thereto.

(e) (1) A contact tracer shall not disclose the identity of an infected person to a contact.

(2) Only contact data specifically authorized by the secretary pursuant to rules and regulations of the secretary adopted pursuant to subsection (j) may be collected as part of contact tracing.

(3) The secretary, a local health officer or a contact tracer shall not produce contact data pursuant to a subpoena unless such subpoena is issued by a court and is accompanied by a valid protective order preventing further disclosure of such data;

(4) Contact data shall be:

(A) Used only for the purpose of contact tracing and not for any other purpose;

(B) confidential and shall not be disclosed, produced in response to any Kansas open records act request or made public, unless the disclosure is necessary to conduct contact tracing; and

(C) safely and securely destroyed when no longer necessary for contact tracing, pursuant to rules and regulations of the secretary adopted pursuant to subsection (j).

(f) (1) Participation in contact tracing shall be voluntary, and no contact or infected person shall be compelled to participate in, nor be prohibited from participating in, contact tracing.

(2) Any contact or infected person who in good faith discloses to a contact tracer information requested by such contact tracer under authority of this subsection shall be immune from civil, criminal and administrative liability for such disclosure.

(3) No criminal, civil or administrative liability shall arise against a contact or infected person solely due to such person's failure to cooperate in contact tracing conducted pursuant to this subsection.

(g) Contact tracing shall not be conducted through the use of any service or means that uses cellphone location data to identify or track, directly or indirectly, the movement of persons.

(h) (1) No third party shall be required to collect or maintain data regarding infected persons or contacts for the purpose of contact tracing.

(2) Except as provided by paragraph (3), no contact tracer shall obtain contact data related to an infected person or contact from any third party.

(3) Contact data voluntarily collected or maintained by a third party may be obtained by a contact tracer only if:

(A) The third party provides such information to the contact tracer voluntarily and with the consent of the infected person or contact whose information is disclosed; or

(B) such information is provided pursuant to a valid warrant.

(i) (1) A person may bring a civil action to enjoin violations of this section.

(2) A knowing violation of this section is a class C nonperson misdemeanor.

(3) Contact data shall be deemed personal information within the meaning of K.S.A. 50-6,139b(a)(3), and amendments thereto.

(4) The remedies provided by this subsection shall be in addition to each other and to any other available civil or criminal remedies authorized by law.

(j) The secretary shall promulgate rules and regulations to implement, administer and enforce the provisions of this section prior to August 1, 2020.

(k) As used in this section, unless the context otherwise requires:

(1) "Contact" means a person known to have been in association with an infected person as to have had an opportunity of acquiring an infection.

(2) "Contact tracing" means identifying persons who may have been exposed to an infected person for the purpose of containing the spread of COVID-19 by notifying the contact that the contact may have been exposed, should be tested and should self-quarantine.

(3) "Contact tracer" means a person or entity employed, contracted or engaged by the department of health and environment or by a local health agency to conduct contact tracing.

(4) "COVID-19" means the novel coronavirus identified as SARS-CoV-2.

(5) "Contact data" means information collected through contact tracing and includes medical, epidemiological, individual movement or mobility, names or other data.

(6) "Infected person" means a person known or reasonably suspected to be infected with COVID-19.

(7) "Local health officer" means a person appointed by a county board of health pursuant to K.S.A. 65-201, and amendments thereto.

(8) "Municipality" means the same as in K.S.A. 75-6102, and amendments thereto.

(9) "Secretary" means the secretary of health and environment.

(10) "State" means the same as in K.S.A. 75-6102, and amendments thereto.

(l) The provisions of this section shall expire on May 1, 2021.

History: L. 2020, ch. 1, § 16 (Special Session); June 9.