Monitoring Vital Signs for COVID-19

For colleges that are hoping to fill their residence halls and run in-person classes this fall, nothing seems off the table. Miles of PlexiGlas, personal air filtration, socializing in pods; the list goes on.

Now, at least one college has announced that it will be deploying and encouraging wearable technology that will collect vital signs from students, faculty and staff. But how the product will fare in a campus environment, and whether the university can assuage privacy concerns, still remains to be seen.

"We're particularly interested in finding ways to limit outbreaks," said David Stone, chief research officer at Oakland University, in Michigan. "The BioButton we think suits that need pretty well."

The BioButton is about the size of a half dollar. It's meant to be stuck onto the skin, near the upper chest. The button collects heart rate, skin temperature and respiratory rate at rest. Using a proprietary algorithm, the company claims the button can alert the wearer to very early signs of COVID-19, before symptoms arise or a diagnostic test would return positive. The technology was originally developed for medical patients and applications for COVID-19 were developed later.

In Oakland's plan, Stone said, the university is not able to actively monitor any specific person's data. University health services will simply receive an alert from the company if a wearer is showing early signs of COVID-19, but won't be told what specific data prompted the alert. The health office will get in touch with the wearer to ask questions, triage and advise isolation if needed.

"We would like to think that the BioButton, if the uptake is strong and people really use it and it works as its designed to, that it will limit outbreaks and reduce the likelihood that we would have to shut down," Stone said.

The university is also planning to use the device in contract tracing. BioButtons can't geolocate, but they can sense one another. If a wearer ends up infected, the university will be able to find those who may have been in close contact with that person, Stone said.

Oakland University enrolls about 19,000 students -- 15,000 of whom are undergraduates -- per year, with many of those being commuters. Residence halls, which typically house about 3,000 students, will be 85 to 88 percent full this year, Stone said. Classes will be hybrid.

A webpage, now deleted, on Oakland University's site originally advised that the BioButtons would be mandatory for all students living in residence halls.

"There had been discussions for the weeks and weeks that we'd been exploring this about both options," Stone said, referring to mandatory or optional wear.

After a petition was started by a student asking the university to make buttons optional, the Oakland Facebook page said the buttons were not mandatory.

The student who started the petition, Tyler Dixon, updated it with a thank you note, saying he applauded the university's decision.

Stone said the administration decided to strongly encourage rather than mandate the buttons, since some students or staff might refuse to wear the technology simply to press against the mandate.

Stone also said he understood why students might be initially skeptical.

"We had not put out any information about how it works and what it does, and that it doesn't geolocate and that your data stays private with you and we can't see your data," he said. "None of that information was available when people started to worry that we were going to mandate it."

The university will make BioButtons available for faculty, administrators, and contracted workers, Stone said, but they will similarly only be encouraged, not mandated, to wear the technology.

"Even if you don't want to wear it, at least carry it, because if you carry it and you come in contact with somebody, we can do the contract tracing," Stone said.

"A Lack of Forethought"

Amelia Vance, director of youth and education privacy at the Future of Privacy Forum, said the technology raises a number of concerns.

"The school has chosen in this case to apparently not weigh the adoption of the technology against any potential misuse or the psychological impact of this kind of surveillance on students," she said.

The privacy policy of BioIntelliSense, the maker of BioButton, raises some potential red flags for Vance.

"The major privacy mention on this product's website is 'We're subject to HIPAA [the Health Insurance Portability and Accountability Act].' and that's lovely, but the thing about technologies being adopted for COVID by schools is that HIPAA does not apply overwhelmingly," she said. "When HIPAA doesn't apply, there should be significant other privacy protections."

The fact that the policy doesn't mention the Family Educational Rights and Privacy Act, which protects student's educational records, is also concerning, she said.

The privacy policy also mentions, Vance noted, that by using BioIntelliSense products the company may record certain body sounds and activities, to be used for quality assurance purposes. (Elsewhere in the policy, BioIntelliSense says body sounds recordings are "similar to a stethoscope.")

BioIntelliSense does make another product, the BioSticker, and so it is unclear whether the product used at Oakland would necessarily record bodily sounds.

BioIntelliSense also advertises that its technology can analyze gait, sleep, cough frequency, and identity management, although it is similarly unclear from marketing materials whether these are part of the BioButton or BioSticker technology. ("As I understand it, the BioButton only gathers temperature, and heart and breathing rate at rest," Stone said via email.)

Vance said that, in general, concerns with this sort of technology aren't only about what a company might do with a user's data, but what a university might do with it.

"You need the college itself to make a promise -- ideally a legally binding promise -- that they're only going to use this data to combat the coronavirus and not downstream uses like tracking how often an employee goes to the bathroom or using data to police a school's general code of conduct," she said. Using button data to track attendance or litigate sex discrimination cases would also be potentially problematic, she said.

Stone emphasized that the university cannot see and monitor the data for itself. Only a user can actively monitor their own data with a downloaded app.

"We can just see it as that red or green indicator every morning on your daily health assessment. That's all we'll see," he said.

"We would only see the data about if you were close to another button if someone tested positive," he added. "There's no interest in using the button for anything else and no ability to use it for anything else."

Vance said the petition and other blowback from students to the introduction of the button underscores the importance for an administration of communicating transparently with everyone on campus and creating clear policies around how data will be collected, stored, shared and accessed.

"The fact that there aren't reassurances here, that there's so much emphasis on the tool being HIPAA compliant when HIPAA doesn't apply, that the institution didn't have clearly defined parameters for how privacy will be protected, really shows that there was a lack of forethought in actually adopting this tool," she said.

Though the National Basketball Association is using a slightly different activity tracker, the Oura Ring, there are few to no other colleges currently advertising their use of the BioButton or similar technology. Though Oakland and BioIntelliSense are still in negotiations over pricing, Stone said the technology will very likely cost more than $1 million.

"I certainly don't think it's common," he said. "I'm very confident we're not the only ones they're talking to."