Skip to main content

UC San Diego COVID-19 Campus Health Management Program Privacy Practices

THE FOLLOWING IS AN INTERIM GUIDELINE, PROTOCOL, POLICY, AND/OR PROCEDURE THAT IS EFFECTIVE IMMEDIATELY AND REMAINS IN EFFECT UNTIL FURTHER NOTICE. THE RELEVANT PROVISIONS WITHIN THIS DOCUMENT SUPERSEDE EXISTING CAMPUS HEALTH MANAGEMENT PROGRAM PRIVACY PRACTICES DOCUMENTS.

During the COVID-19 public health emergency, all UC San Diego students, staff, faculty, student employees, and on-site UC San Diego-employed independent contractors who are reporting to campus or any other physical UC San Diego location for work must participate in the Campus Health Management Program (“The Program”), including testing and symptom screening, in accordance with the current San Diego County Health Order.

For UC San Diego to administer the Program, UC San Diego needs to properly maintain records. For example, UC San Diego needs records of who has signed up for testing and when those tests were administered. If someone tests positive for COVID-19, UC San Diego must also keep records of its compliance with all state and local laws related to health and safety and records of appropriate notifications to the COVID-19-positive individuals.

Your privacy is important to you, and it is important to us. UC San Diego is committed to treating all information generated as a result of the Program with a high level of privacy and security protections.

Who do these privacy practices apply to

These privacy practices apply to UC San Diego students and employees, including staff, faculty, student employees, and volunteers. These privacy practices do NOT apply to UC San Diego Health employees who may be subject to different standards and policies due to the services they provide caring for patients and other vulnerable populations while at work.

Please read the following to learn more about how the university treats the information we process as part of the Program.

Overview of the Campus Health Management Program

The Campus Health Management Program involves symptom screening on a daily basis, testing and treatment, case investigation and contact tracing for individuals who test positive for COVID-19, and vaccinations when they are available. UC San Diego Center for Occupational and Environmental Medicine (“COEM”) will coordinate and administer the Program for campus employees, and Student Health Services (“SHS”) will coordinate and administer the Program for UC San Diego students.

The personal information we process

As part of the Program, you will use UC San Diego-supported technology platforms to register for and conduct daily screenings and sign up for testing and treatment including vaccinations. To ensure a high level of privacy and security, UC San Diego will store information related to COVID-19 testing and vaccinations in UC San Diego Health’s electronic health record system known as Epic. Contact tracing will be coordinated through the COEM within the UC San Diego School of Medicine for employees and through Student Health Services for students.

We will obtain personal information in the following ways:

  1. Daily Symptom Screening Survey Registration
    All students and employees are expected to complete this registration. During daily symptom screening registration, we collect your name, email address, preferred phone number, registration date, campus/Health affiliation, job category, current work arrangement, primary work site, specific campus location, flu vaccination attestation, and your supervisor’s name and email, as well as whether you have been or received information that you have been exposed to a person with COVID-19. You will be asked if you would like to receive daily email reminders.
  2. Campus Health Management Registration (not applicable to students)
    All employees are expected to complete this registration. You will be registered in the Campus Health Management Program for documentation of health information required and paid for by your employer. Upon registration in the Campus Health Management Program, UC San Diego will use your name, date of birth, address, gender, and with your consent, Social Security Number (“SSN”) as those are reflected in your existing personnel record to create an electronic health record number with UC San Diego Health in Epic for the purpose of employee health management or identify your existing health record number within Epic for the purpose of employee health management, if you already have an electronic health record with UC San Diego Health. The disclosure of your SSN is voluntary. The purpose of the SSN is to ensure accuracy in creating or identifying health records. The request for your SSN is made under the authority of the Regents of the University of California under Art. IX, Sec. 9 of the California Constitution. If you do NOT wish to allow use your SSN to assist in administering the Return to Learn Program, you may opt out of such use. In that case, your name, date of birth, address, and gender will be used to create or locate your record. 
  3. Daily Symptom Screening Survey
    All employees and students are expected to complete daily symptom screenings on days they will be physically on-site either on campus or another assigned work location. You will be asked several questions, including whether you are currently experiencing or have experienced in the past 14 days any COVID-19 symptoms and your “yes” or “no” response will be recorded. Note that the survey does not ask which of the symptoms you have, just whether you have had any of the symptoms.
  4. Testing and Treatment at UC San Diego Health or Student Health Services
    Employee health: UC San Diego Health is committed to protecting medical and personal information about you. Your medical information, which includes COVID testing and treatment information required for employment, is Protected Health Information under the federal Health Insurance Portability and Accountability Act (“HIPAA”). UC San Diego Health is required by law to maintain the privacy of your Protected Health Information, provide you information about its legal duties and privacy practices, inform you of your rights and the ways in which it may use Health Information and disclose it to other entities and persons. UC San Diego Health’s HIPAA Notice of Privacy Practices apply to this information. You can read about how UC San Diego Health handles your Protected Health Information in the Notice of Privacy Practices.
    Student health: UC San Diego Health is committed to protecting medical and personal information about you. Your medical information, which includes COVID testing and treatment information required for physical presence at UC San Diego, are protected under the federal Family Educational Rights and Privacy Act (“FERPA”). UC San Diego Health is required by law to maintain the privacy of your personal information, provide you information about its legal duties and privacy practices, inform you of your rights and the ways in which it may use FERPA information and disclose it to other entities and persons.
  5. Testing and Treatment at non-UC San Diego Health providers
    You are welcome to receive health care, including COVID-19 testing and treatment, at any non-UC San Diego healthcare provider of your choice. If you test positive for COVID-19, whether that test is administered by a UC San Diego Health provider or another healthcare provider, and you will be physically on site, you must report your positive result to the UC San Diego Center for Occupational and Environmental Medicine (COEM) at COEMexposure@health.ucsd.edu for employees or Student Health Services at studenthealth@health.UCSD.edu for students so that they can coordinate with public health and the contact tracing team for contact tracing, monitor symptoms, and provide return to work documentation if necessary.
  6. Case Investigations and Contact Tracing
    Individuals who test positive for COVID-19 will be referred for case investigation and contact tracing in coordination with the San Diego County Public Health Department. The case investigation and contact tracing teams contact the positive individual and collect information about the individual’s health, contacts, and activities.

Why and how we use your personal information

UC San Diego and UC San Diego Health will only use your personal information as described below or as required or permitted by law. 

To ensure a high level of confidentiality and privacy protection, UC San Diego Health will store information related to COVID-19 testing and treatment in Epic. This record will be used to administer employer-paid and student health services, including testing and vaccinations. 

Responses to daily screening surveys are primarily used to assess whether you have symptoms currently associated with COVID-19 to determine if you can be present on site for work that day. 

 We will use your information for the purposes described below.

    1. Daily symptom screening registration and responses
      1. To meet State of California and San Diego County requirements for UC San Diego to allow you to be present on site;
      2. To provide you and your supervisor/college/Division with documentation showing whether you should be present on site;
      3. To coordinate localized sanitation procedures;
      4. To prioritize individuals, groups, or roles for asymptomatic testing;
      5. To contact you if testing is available for you or your department;
      6. To help UC San Diego's COVID Monitoring Team ("CMT") identify possible outbreaks on campus;
      7. To facilitate voluntary testing and treatment at UC San Diego Health;
      8. For reporting purposes in accordance with public health requirements;
      9. For analysis and reporting to inform campus re-opening plans; and
      10. For potential research use in accordance with applicable laws, regulations, and University policies
    2. Campus Health Management Registration
      To create an electronic health record for you, if you do not currently have one at UC San Diego Health, or if you already have an electronic health record, to flag your existing electronic health record as an “employee.” By adding an “employee” flag, electronic health records will receive additional compliance and privacy safeguards.
    3. Testing and Treatment at UC San Diego
      1. To provide you with COVID tests and vaccinations, when available for you;
      2. To help UC San Diego’s CMT to identify and respond to possible outbreaks on campus (students only);
      3. For reporting purposes in accordance with public health requirements and state and federal laws; and
      4. For analysis and reporting to inform campus re-opening plans
    4. Contact tracing
      1. For case investigation, contact tracing, and public health purposes, including to notify people who test positive for COVID-19 as well as their close contacts of isolation and quarantine procedures to help prevent further spread of the novel coronavirus (your name will not be disclosed to close contacts without your consent);
      2. To meet State of California and San Diego County requirements for public health and workplace safety;
      3. To help UC San Diego's CMT to identify possible outbreaks on campus (students only);
      4. For reporting purposes in accordance with public health requirements; and
      5. For potential use by UC San Diego researchers in accordance with applicable regulations and University policies

Your personal information from the Program will be used, as needed, to assess, improve, or modify the Program; for auditing and monitoring of the Program; and if required for an investigation conducted by appropriate authorities. We may disclose your information to governmental licensing, auditing, regulatory, and accrediting agencies, as authorized or required by law.

For information about the uses of your electronic health record, please see UC San Diego Health’s Notice of Privacy Practices.

Who has access to your personal information

We will only share or disclose your personal information as described below or as required or permitted by law.

      1. Daily Symptom Screening Survey Data
        1. Your supervisor, work lead, and, if applicable, symptom screener check-in person will see your primary work location and the results of the symptom screen; your supervisors will not have access to your answers to specific symptom screening questions;
        2. You can see your own responses to the survey (sent to your email);
        3. The members of the campus CMT;
        4. The UC San Diego Center for Occupational and Environmental Medicine;
        5. ServiceNow and Qualtrics administrators in Health IT/ITS who are administering the survey; and
        6. Researchers with appropriate approvals/exemptions from the data steward, the Institutional Review Board ("IRB"), and privacy and security offices
    1. Campus Health Management Registration
      Your registration information will be visible to UC San Diego Health IT and Campus ITS.
    2. Testing and vaccinations provided to students or as an employer to employees
      1. UC San Diego’s Center for Occupational and Environmental Medicine (COEM) and Infection of Prevention and Clinical Epidemiology (IPCE) will have access to your employee test results. All employee testing, vaccinations, and demographic information will be maintained as confidential Protected Health Information and will be protected in accordance with UC San Diego Health’s Notice of Privacy Practices.
      2. UC San Diego's Student Health Services will have access to student test results;
      3. Members of the campus CMT (students only);
      4. Union representatives when required by state law (employees only);
      5. As part of the Program, campus human resources will be notified of your compliance with (but not results of) required testing and vaccinations; 
      6. When required by law, public health authorities, and other state and federal authorities; and
      7. Sexual orientation and gender identity: California Senate Bill 932 requires public health officials to collect and report data relating to the sexual orientation and gender identity of individuals diagnosed with COVID-19 . The electronic medical record stored in UC San Diego Health’s EPIC system allows for patients to identify their gender identity and sexual orientation. If employees or students share this information when participating in the Campus Health Management Return to Learn testing program, it is reported as required by state law SB 932. Sexual orientation and gender identity information can be updated at any time through the MyChart system to ensure the county and state have the patient’s intended record of sexual orientation and gender identity. Updating overwrites former information that was entered.
    3. Contact Tracing
      1. The case investigation and contact tracing team;
      2. Members of the campus CMT team (students only)
      3. When required by law, public health authorities and other state and federal authorities

How we protect your personal information

UC San Diego Health has many safeguards in place for how it protects electronic health records. We maintain technical, physical, and administrative safeguards to protect the security, integrity, and privacy of personal data, including the following practices:

  1. To ensure even more privacy protection for UC San Diego employees and students, the records of all UC San Diego employees and students stored in Epic will be coded at the “break the glass” level of privacy protection. Records coded as “break the glass” require a specific justification for access;
  2. Employee and student records stored in the UC San Diego Epic EHR are excluded from research data extractions performed under waivers of consent or HIPAA authorization;
  3. Electronic health records are subject to frequent privacy audits by UC San Diego’s Office of Compliance and Privacy;
  4. UC San Diego Health adheres to University of California requirements described in IS-3 UCOP Policy (Electronic Information Security) in order to secure your information;
  5. Information is housed on systems stored in controlled facilities with limited access;
  6. Encryption, such as the Secure Socket Layer (SSL), is used to protect the transmission of your information over the Internet;
  7. Security technologies and procedures are used to help protect your personal information from unauthorized access, use, or disclosures;
  8. Data access is limited only to authorized personnel;
  9. All authorized personnel are informed of their obligation to maintain the privacy, security, and confidentiality of information;
  10. All authorized UC San Diego Health personnel who will have access to your electronic health record are trained in privacy and security obligations.

The university endeavors to protect the privacy of the personal information we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of your personal information.

How long we keep your identifiable data

The personal information obtained for the Symptom Screening Survey will be retained for 14 days. Members of the CMT will have access to your information for the duration of the public health emergency, as declared by Federal and State authorities, plus 30 days.

Per UCSDHP 325.2, all electronic health records are retained for at least as long as required by State and federal law and regulations, and UC Records Disposition Schedules Manual and UC San Diego Health policies and procedures. Health records retention covers all types of UC San Diego Health records: (1) at a minimum, 20 years or more following the last recorded activity; (2) records of minors must be kept for one year past the age of majority.

Your contact tracing information, if any, will be maintained in accordance with State and County requirements.

Learn more about how long different types of information are retained by UC San Diego.

Knowing your choices and rights

In accordance with current San Diego County Health Orders, UC San Diego employees and contractors reporting physically to the UC San Diego campus or other work site in San Diego County must complete the daily symptom screening survey prior to reporting to work. If you do not complete the survey, your failure may be deemed a refusal of a lawful order and you may be asked to explain the reason for your refusal to your supervisor and/or HR contact. If there is not a valid reason for refusal, you may be placed on a leave without pay and be potentially subject to discipline.

If you do not complete the Health Management registration form, we will remind you when you use multi-factor authentication (i.e., DUO mobile) to log into UC San Diego systems on your devices.

You may choose not to be contacted for voluntary diagnostic testing during registration or withdraw your consent later by contacting the Campus Privacy Office at privacyofficer@ucsd.edu.

You may opt out of sharing your SSN with UC San Diego Health. Your name, date of birth, address, and gender will be used to create an electronic health record for you or associate records for existing patients who are employees. For employees who opt out of sharing their SSN, their SSN will NOT be used. However, an electronic health record will be created or associated for employees. The creation of an electronic health record will allow us to appropriately and efficiently manage the Campus Health Management Program.

If you object to the creation of an electronic health record or the association of an existing electronic health record for employee health purposes, you may contact the Campus Privacy Officer at privacyofficer@ucsd.edu to discuss your concerns and options. If you object to the creation of an electronic health record or the association of an existing electronic health record, you will not be eligible for the benefits of the Program.

You may opt out of having your positive COVID result reported to union representatives, as is currently required by California state law. Information and instructions for opting out are provided here.

You have a right to:

  1. Access your own data; and
  2. Rectify or correct inaccurate or incomplete data concerning you

Changes to this privacy statement

This privacy statement will be updated periodically to reflect any material changes in the Program and practices. These changes will be evident by inserting a new “Effective Date” (see below) and are effective when they are posted to this website. Treatment of information is subject to the version in effect at the time such information is collected.

Contacting us

If you have any general questions about:

  1. The Campus Health Management Program, please contact rtl@ucsd.edu.
  2. Your electronic health record, please contact hscomply@health.ucsd.edu.
  3. Exercising your rights, withdrawing your consent, filing a complaint, or asking general privacy questions, contact privacyofficer@ucsd.edu.

Effective date

This statement is effective as of January 14, 2021.