Skip to main content
Return to Learn Return to Learn
  1. HOME
  2. About
  3. Privacy

UC San Diego COVID-19 Campus Health Management Program Privacy Practices

THE FOLLOWING IS AN INTERIM GUIDELINE, PROTOCOL, POLICY, AND/OR PROCEDURE THAT IS EFFECTIVE IMMEDIATELY AND REMAINS IN EFFECT UNTIL FURTHER NOTICE. THE RELEVANT PROVISIONS WITHIN THIS DOCUMENT SUPERSEDE EXISTING CAMPUS HEALTH MANAGEMENT PROGRAM PRIVACY PRACTICES DOCUMENTS.

During the COVID-19 public health emergency, all UC San Diego students, staff, faculty, student employees, and on-site independent contractors who are reporting to campus or any other physical UC San Diego location must participate in the Campus Health Management Program (“The Program”), including testing and symptom screening, in accordance with the current San Diego County Health Order, and the UC Vaccine Mandate.

For UC San Diego to administer the Program, UC San Diego (as an employer and educational institution) and UC San Diego Health (as a healthcare provider) need to properly maintain records. Your privacy is important to you, and it is important to us. UC San Diego is committed to treating all information generated as a result of the Program with a high level of privacy and security protections.

Who do these privacy practices apply to

These privacy practices apply to UC San Diego students and employees, including staff, faculty, student employees, and volunteers. These privacy practices do NOT apply to UC San Diego Health or Health Sciences employees who may be subject to different standards and policies due to the services they provide caring for patients and other vulnerable populations while at work.

Please read the following to learn more about how the university treats the information we process as part of the Program.

Overview of the Campus Health Management Program

The Campus Health Management Program involves symptom screening, testing and treatment, case investigation and contact tracing for individuals who test positive for COVID-19, and the UC Vaccine Mandate. UC San Diego Center for Occupational and Environmental Medicine (“COEM”) will coordinate and administer the Program for employees, and Student Health Services (“SHS”) will coordinate and administer the Program for UC San Diego students.

The personal information we process

We will obtain personal information in the following ways:

    1. Daily Symptom Screening Survey Registration
      All students and employees are expected to complete this registration. During daily symptom screening registration, we collect your name, email address, preferred phone number, registration date, campus/Health affiliation, job category, current work arrangement, primary work site, specific campus location, flu vaccination attestation, and your supervisor’s name and email, as well as whether you have been or received information that you have been exposed to a person with COVID-19. You will be asked if you would like to receive daily email reminders.
    2. Campus Health Management Registration (not applicable to students)
      All employees are expected to complete this registration. You will be registered in the Campus Health Management Program for documentation of health information required and paid for by your employer. Upon registration in the Campus Health Management Program, UC San Diego will use your name, date of birth, address, gender, and with your consent, Social Security Number (“SSN”) as those are reflected in your existing personnel record to either 1) create an electronic employee health record with UC San Diego Health in Epic for the purpose of employee health management, or 2) identify your existing health record number within Epic for the purpose of employee health management, if you already have an electronic health record with UC San Diego Health. The disclosure of your SSN is voluntary. The purpose of the SSN is to ensure accuracy in creating or identifying health records. The request for your SSN is made under the authority of the Regents of the University of California under Art. IX, Sec. 9 of the California Constitution. If you do NOT wish to allow use of your SSN to assist in administering the Return to Learn Program, you may opt out of such use. In that case, your name, date of birth, address, and gender will be used to create or locate your record.
    3. Daily Symptom Screening Survey
      All employees and students are expected to complete daily symptom screenings on days they will be physically on-site either on campus or another assigned work location. You will be asked several questions, including whether you are currently experiencing or have experienced in the past 14 days any COVID-19 symptoms and your “yes” or “no” response will be recorded. Note that the survey does not ask which of the symptoms you have, just whether you have had any of the symptoms.
    4. Testing and Treatment at UC San Diego Health or Student Health Services
      To ensure a high level of privacy and security, UC San Diego will store information related to COVID-19 testing, treatment, and vaccination in UC San Diego Health’s electronic medical record system known as Epic. We will collect medical information related to COVID-19, including test results and the date and type of vaccine administered.
      Employee health: Your medical information contained in the UC San Diego Health electronic medical record system, including COVID testing and treatment information required for employment, is Protected Health Information under the federal Health Insurance Portability and Accountability Act (“HIPAA”). UC San Diego Health is required by law to maintain the privacy of your Protected Health Information, provide you information about its legal duties and privacy practices, inform you of your rights and the ways in which it may use Health Information and disclose it to other entities and persons. UC San Diego Health’s HIPAA Notice of Privacy Practices apply to this information. You can read about how UC San Diego Health handles your Protected Health Information in the Notice of Privacy Practices.
      Student health: Your medical information, which includes COVID-19 testing and treatment information required for physical presence at UC San Diego, are protected under the federal Family Educational Rights and Privacy Act (“FERPA”). UC San Diego Health is required by law to maintain the privacy of your personal information, provide you information about its legal duties and privacy practices, inform you of your rights and the ways in which it may use FERPA information and disclose it to other entities and persons.
    5. Testing and Treatment at non-UC San Diego Health providers
      You are welcome to receive health care, including COVID-19 testing, treatment, and vaccinations, at any non-UC San Diego healthcare provider of your choice. If you test positive for COVID-19, whether that test is administered by a UC San Diego Health provider or another healthcare provider, and you will be physically on site, you must report your positive result to the UC San Diego Center for Occupational and Environmental Medicine (COEM) at COEMexposure@health.ucsd.edu for employees or Student Health Services at studenthealth@health.UCSD.edu for students so that they can coordinate with public health and the contact tracing team for contact tracing, monitor symptoms, and provide return to work documentation if necessary.
    6. Case Investigations and Contact Tracing
      Individuals who test positive for COVID-19 will be referred for case investigation and contact tracing in coordination with the San Diego County Public Health Department. Contact tracing for UC San Diego employees and students will be coordinated through the UCSD Contract Tracing Team within the UCSD School of Public Health. The case investigation and contact tracing teams contact the positive individual and collect information about the individual’s health, contacts, and activities from them.
    7. SARS-CoV-2 (COVID-19) Vaccination Program (“UC Vaccine Mandate”)
      For the safety and well-being of the entire university community, the policy requires, with few exceptions, that all students, faculty and staff be vaccinated against the COVID-19 virus before they will be allowed on campus or in a facility or office. The policy allows for medical exceptions consistent with Centers for Disease Control and Prevention guidance and manufacturer labeling on contraindications and precautions. Faculty, staff and students are also eligible to request accommodations based on disability or religious belief, and deferrals may be available for those who are pregnant. As part of complying with the UC Vaccine Mandate policy, you will be asked to provide a) proof of your vaccination, b) a request for religious exception, c) a request for accommodation based on a disability, or d) a request for a deferral based on pregnancy. With your authorization and for your convenience, if you received your vaccines at UC San Diego Health, your vaccination status can be transferred to UC San Diego campus automatically. If you do not consent, you must provide/upload your proof of vaccination (e.g., CDC vaccine card) as described on the Return to Learn Vaccine Mandate website.

Why and how we use your personal information

UC San Diego and UC San Diego Health will only use your personal information as described below or as required or permitted by law.

We will use your information for the purposes described below.

    1. Daily symptom screening registration and responses
      1. To meet State of California and San Diego County requirements for UC San Diego to allow you to be present on site;
      2. To provide you and your supervisor/college/Division with documentation showing whether you should be present on site;
      3. To coordinate localized sanitation procedures;
      4. To prioritize individuals, groups, or roles for asymptomatic testing;
      5. To help UC San Diego's COVID Monitoring Team ("CMT") identify possible outbreaks on campus;
      6. To facilitate voluntary testing and treatment at UC San Diego Health;
      7. For reporting purposes in accordance with public health requirements;
      8. For analysis and reporting to inform campus re-opening plans; and
      9. For potential research use in accordance with applicable laws, regulations, and University policies
    2. Campus Health Management Registration
      To create an electronic medical record for you, if you do not currently have one at UC San Diego Health, or if you already have an electronic medical record, to flag your existing electronic medical record as an “employee.” By adding an “employee” flag, electronic medical records will receive additional compliance and privacy safeguards.
    3. Testing, Treatment, and Vaccination at UC San Diego
      1. To provide you with COVID tests, treatment, and vaccinations;
      2. To help UC San Diego’s CMT to identify and respond to possible outbreaks on campus (students only);
      3. For reporting purposes in accordance with public health requirements and state and federal laws; and
      4. For analysis and reporting to inform campus re-opening plans
    4. Contact tracing
      1. For case investigation, contact tracing, and public health purposes, including to notify people who test positive for COVID-19 as well as their close contacts of isolation and quarantine procedures to help prevent further spread of the novel coronavirus (your name will not be disclosed to close contacts without your consent);
      2. To meet Federal, State, and County requirements for public health and workplace safety;
      3. To help UC San Diego's CMT to identify possible outbreaks on campus (students only);
      4. For reporting purposes in accordance with public health requirements; and
      5. For potential use by UC San Diego researchers in accordance with applicable regulations and University policies
    5. Vaccination Data, Exception or Deferral information
      1. For compliance with the UC SARS-CoV-2 (COVID-19) Vaccination Program and with federal and state law;
      2. To provide you and your supervisor/college/Division with documentation showing whether you are authorized to be present on-site without additional precautions; authorized to be on-site but with additional precautions (g., masking, distancing); or not authorized to be on-site;
      3. To help UC San Diego's CMT to assess re-opening plans on campus (students only);
      4. To provide UC’s third-party administrator information regarding your exception or deferral submission for assessment.
      5. For reporting purposes in accordance with public health requirements; and
      6. For potential use by UC San Diego researchers in accordance with applicable regulations and University policies

    Your personal information from the Program will be used, as needed, to assess, improve, or modify the Program; for auditing and monitoring of the Program; and if required for an investigation conducted by appropriate authorities. We may disclose your information to governmental licensing, auditing, regulatory, and accrediting agencies, as authorized or required by law.

    For information about the uses of your electronic medical record, please see UC San Diego Health’s Notice of Privacy Practices.

    Who has access to your personal information?

    We will only share or disclose your personal information as described below or as required or permitted by law.

      1. Daily Symptom Screening Survey Data
        1. Your supervisor, work lead, and, if applicable, symptom screener check-in person will see your primary work location and the results of the symptom screen; your supervisors will not have access to your answers to specific symptom screening questions;
        2. You can see your own responses to the survey (sent to your email);
        3. The members of the campus CMT;
        4. The UC San Diego Center for Occupational and Environmental Medicine;
        5. Campus human resources and Academic Personnel Leadership;
        6. ServiceNow and Qualtrics administrators in Health IT/ITS who are administering the survey; and
        7. Researchers with appropriate approvals/exemptions from the data steward, the Institutional Review Board ("IRB"), and privacy and security offices
      2. Campus Health Management Registration
        Your registration information will be visible to UC San Diego Health IT and Campus ITS.
      3. Testing and vaccinations provided to students or as an employer to employees
        1. UC San Diego’s Center for Occupational and Environmental Medicine (COEM) and Infection of Prevention and Clinical Epidemiology (IPCE) will have access to your employee test results and vaccinations. Other than for the disclosures provided for under this Notice, all employee testing, vaccinations, and demographic information contained within your UC San Diego Health electronic medical records will be maintained as confidential Protected Health Information and will be protected in accordance with UC San Diego Health’s Notice of Privacy Practices.
        2. UC San Diego's Student Health Services will have access to student test results;
        3. Members of the campus CMT (students only);
        4. Union representatives when required by state law (employees only);
        5. As part of the Program, campus human resources and
          Academic Personnel Leadership will be notified of your compliance with required testing and vaccinations;
        6. When required by law, public health authorities, and other state and federal authorities; and
        7. Sexual orientation and gender identity: California Senate Bill 932 requires public health officials to collect and report data relating to the sexual orientation and gender identity of individuals diagnosed with COVID-19. The electronic medical record stored in UC San Diego Health’s Epic system allows for patients to identify their gender identity and sexual orientation. If employees or students share this information when participating in the Campus Health Management Return to Learn testing program, it is reported as required by state law SB 932. Sexual orientation and gender identity information can be updated at any time through the MyChart system to ensure the county and state have the patient’s intended record of sexual orientation and gender identity. Updating overwrites former information that was entered.
      4. Contact Tracing
        1. The case investigation and contact tracing team;
        2. Members of the campus CMT team (students only);
        3. When required by law, public health authorities and other state and federal authorities
      5. UC Vaccine Mandate
        1. Your supervisor or work lead will see if their employees are in compliance with the UC Vaccine Mandate; Vice Chancellor – Student Affairs will see ifstudents are in compliance with the UC Vaccine Mandate; your supervisor and VCSA will not have access to specific information about your vaccination, exception, or deferral. UCSD Student Health Center will receive and assess student submittals of exceptions or deferrals to the UC Vaccine Mandate.
        2. A third-party administrator has been contracted by the University of California to receive and assess employee submittals of exceptions or deferrals to the UC vaccination mandate.

      How we protect your personal information

      UC San Diego Health has many safeguards in place for how it protects electronic health records. We maintain technical, physical, and administrative safeguards to protect the security, integrity, and privacy of personal data, including the following practices:

      1. To ensure even more privacy protection for UC San Diego employees and students, the health records of all UC San Diego employees and students stored in Epic will be coded at the “break the glass” level of privacy protection. Records coded as “break the glass” require a specific justification for access;
      2. Employee health and student health records stored in the UC San Diego Epic system are excluded from research data extractions performed under waivers of consent or HIPAA authorization;
      3. Electronic medical records are subject to frequent privacy audits by UC San Diego’s Office of Compliance and Privacy;
      4. UC San Diego Health adheres to University of California requirements described in IS-3 UCOP Policy (Electronic Information Security) in order to secure your information;
      5. Information is housed on systems stored in controlled facilities with limited access;
      6. Encryption, such as the Secure Socket Layer (SSL), is used to protect the transmission of your information over the Internet;
      7. Security technologies and procedures are used to help protect your personal information from unauthorized access, use, or disclosures;
      8. Data access is limited only to authorized personnel;
      9. All authorized personnel are informed of their obligation to maintain the privacy, security, and confidentiality of information;
      10. All authorized UC San Diego Health personnel who will have access to your employee health record or your electronic medical record are trained in privacy and security obligations.
      11. Exception and deferral information will be securely transmitted to UC’s third-party administrator for storage. Additionally, the third-party administrator’s data processing environment was assessed by the University of California for security compliance.

    The university endeavors to protect the privacy of the personal information we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of your personal information.

    How long we keep your identifiable data

    The personal information obtained for the Symptom Screening Survey will be retained for 14 days. Members of the CMT will have access to your information for the duration of the public health emergency, as declared by Federal and State authorities, plus 30 days.

    Per UCSDHP 325.2, all electronic health records are retained for at least as long as required by State and federal law and regulations, and UC Records Disposition Schedules Manual and UC San Diego Health policies and procedures. Health records retention covers all types of UC San Diego Health records: (1) at a minimum, 20 years or more following the last recorded activity; (2) records of minors must be kept for one year past the age of majority.

    Your contact tracing information, if any, will be maintained in accordance with State and County requirements.

    Information housed within COEM will be retained for 30 years from time of collection as required by state law.

    Third-party Administrator will retain the exception/deferral information in accordance with the UC Retention Schedule.

    Knowing your choices and rights

    In accordance with current San Diego County Health Orders, UC San Diego employees and contractors reporting physically to the UC San Diego campus or other work site in San Diego County must complete the daily symptom screening survey prior to reporting to work. If you do not complete the survey, your failure may be deemed a refusal of a lawful order and you may be asked to explain the reason for your refusal to your supervisor and/or HR contact. If there is not a valid reason for refusal, you may be placed on a leave without pay and be potentially subject to discipline.

    If you do not complete the Health Management registration form, we will remind you when you use multi-factor authentication (i.e., DUO mobile) to log into UC San Diego systems on your devices.

    You may choose not to be contacted for voluntary diagnostic testing during registration or withdraw your consent later by contacting the Campus Privacy Office at privacyofficer@ucsd.edu.

    You may opt out of sharing your SSN with UC San Diego Health. Your name, date of birth, address, and gender will be used to create an electronic medical record for you or associate records for existing patients who are employees. For employees who opt out of sharing their SSN, their SSN will NOT be used. However, an electronic medical record will be created or associated for employees. The creation of an electronic medical record will allow us to appropriately and efficiently manage the Campus Health Management Program.

    If you object to the creation of an electronic medical record or the association of an existing electronic medical record for employee health purposes, you may contact the Campus Privacy Officer at privacyofficer@ucsd.edu to discuss your concerns and options. If you object to the creation of an electronic medical record or the association of an existing electronic medical record, you will not be eligible for the benefits of the Program.

    You may opt out of having your positive COVID result reported to union representatives, as is currently required by California state law. Information and instructions for opting out are provided here.

    If you choose not to comply with the UC Vaccine Mandate, you will not be authorized to be present on-site at any UC Location or for any UC program at any time. Depending on your role and needs of the university, this may lead to discipline and/or dismissal.

    You have a right to:

        1. Access your own data; and
        2. Rectify or correct inaccurate or incomplete data concerning you

    Changes to this privacy statement

    This privacy statement will be updated periodically to reflect any material changes in the Program and practices. These changes will be evident by inserting a new “Effective Date” (see below) and are effective when they are posted to this website. Treatment of information is subject to the version in effect at the time such information is collected.

    Contacting us

    If you have any general questions about:

        1. The Campus Health Management Program, please contact rtl@ucsd.edu.
        2. Your electronic health record, please contact hscomply@health.ucsd.edu.
        3. Exercising your rights, withdrawing your consent, filing a complaint, or asking general privacy questions, contact privacyofficer@ucsd.edu.

    Effective date

    This statement is effective as of 10.1.2021.