Skip to main content

UC San Diego COVID-19 Campus Health Management Program Privacy Practices

Under the Campus Health Management Program (“The Program”), all UC San Diego staff, faculty, student employees, and on-site UC San Diego-employed independent contractors who are reporting to campus or any other physical UC San Diego location for work must conduct a daily self-screening for COVID-19 symptoms (“Symptom Screening Program”) in accordance with the current San Diego County Health Order. Employees and students who have symptoms of COVID-19 will be offered free voluntary testing at UC San Diego Health. Individuals who test positive for COVID-19 will be referred for case investigation and contact tracing in coordination with the San Diego County Public Health Department. As part of UC San Diego’s Return to Learn Program, the university will offer testing to asymptomatic employees and students when there is testing capacity.

For UC San Diego to administer the program of broad asymptomatic testing that is a signature feature of the Return to Learn program, UC San Diego needs to properly maintain records. For example, UC San Diego needs records of who has signed up for testing and when those tests were administered. If someone tests positive for COVID-19, UC San Diego must also keep records of its compliance with all state and local laws related to health and safety and records of appropriate notifications to the COVID-19-positive individuals.

Your privacy is important to you, and it is important to us. UC San Diego is committed to treating all medical information generated as a result of the Return to Learn program with a high level of privacy and security protections. To ensure this high level of privacy and security protections, UC San Diego will store information related to COVID-19 testing in UC San Diego Health’s electronic health record system known as Epic.

Who do these privacy practices apply to

These privacy practices apply to UC San Diego employees, including staff, faculty, student employees, students, and volunteers. These privacy practices do NOT apply to UC San Diego Health employees who may be subject to different standards due to the essential services they provide caring for patients and other vulnerable populations while at work.

Please read the following to learn more about how the university treats the information we process as part of the Program.

Overview of the Campus Employee Management Program

The Campus Employee Management Program involves daily symptom screening, voluntary testing and treatment, and case investigation and contact tracing for individuals who test positive for the novel coronavirus. UC San Diego Center for Occupational and Environmental Medicine (“COEM”) will coordinate and administer the Program for campus employees.

The personal information we process

As part of the Program, you will use UC San Diego-supported technology platforms to register for screening and testing and to respond to daily screening surveys. UC San Diego Health’s electronic health record system (Epic) will be used to aid administration of testing and potential treatment for employee health. UC San Diego Health has many safeguards in place for how it protects electronic health records. Contact tracing will be coordinated through the COEM within the UC San Diego School of Medicine for employees and through Student Health Services (“SHS”) for students.

We will obtain personal information in the following ways:

  1. Daily Symptom Screening Survey Registration
    During daily symptom screening registration, we collect your name, email address, preferred phone number, registration date, campus/Health affiliation, job category, primary work site, specific campus location, and your supervisor’s name and email, as well as whether you have been or received information that you have been exposed to a person with COVID-19. You will be asked if you would like to receive daily email reminders and whether you’d like to be contacted for voluntary COVID-19 testing, if it is available.
  2. Daily Symptom Screening Survey
    On days when you will be physically on on-site either on campus or another assigned work location, you are required to access the daily symptom screening survey by logging in using your UC San Diego credentials. You will be asked several questions, including whether you are currently experiencing or have experienced in the past 14 days any COVID-19 symptoms and your “yes” or “no” response will be recorded. Note that the survey does not ask which of the symptoms you have, just whether you have had any of the symptoms.
  3. Work and Health Management Registration (not applicable to students)
    You will be registered in the Employee Health Management Program for documentation of health information required and paid for by your employer. Upon registration in the Employee Health Management Program, UC San Diego will use your name, date of birth, address, gender, and with your consent, Social Security Number (“SSN”) as those are reflected in your existing personnel record to create an electronic health record number with UC San Diego Health in Epic for the purpose of employee health management or identify your existing health record number within Epic for the purpose of employee health management, if you already have an electronic health record with UC San Diego Health. The disclosure of your SSN is voluntary. The purpose of the SSN is to ensure accuracy in creating or identifying health records. The request for your SSN is made under the authority of the Regents of the University of California under Art. IX, Sec. 9 of the California Constitution. If you do NOT wish to allow use your SSN to assist in administering the Return to Learn Program, you may opt out of such use.
  4. Testing and Treatment for employee health purposes
    UC San Diego Health is committed to protecting medical and personal information (“Protected Health Information”) about you. Your testing and treatment information is Protected Health Information under the federal Health Insurance Portability and Accountability Act (“HIPAA”). UC San Diego Health is required by law to maintain the privacy of your Protected Health Information, provide you information about its legal duties and privacy practices, inform you of your rights and the ways in which it may use Health Information and disclose it to other entities and persons. UC San Diego Health’s HIPAA Notice of Privacy Practices apply to this information. You can read about how UC San Diego Health handles your Protected Health Information in the Notice of Privacy Practices.
  5. Testing and Treatment at non-UC San Diego Health providers
    You are welcome to receive health care, including COVID-19 testing and treatment, at any non-UC San Diego healthcare provider of your choice. If you test positive for COVID-19, whether that test is administered by a UC San Diego Health provider or another healthcare provider, and your work requires you to be physically on site, you must report your positive result to the UC San DiegoCenter for Occupational and Environmental Medicine (COEM) at COEMexposure@health.ucsd.edu so that they can coordinate with public health and the contact tracing team for contact tracing,monitor symptoms, and provide return to work documentation if seen at COEM.

Why and how we use your personal information

UC San Diego and UC San Diego Health will only use your personal information as described below or as required or permitted by law. 

To ensure a high level of confidentiality and privacy protection, UC San Diego Health will store information related to COVID-19 testing and treatment in Epic. This record will be used to administer employer-paid health services, including testing and vaccinations. The following information will be extracted from your existing personnel record: your name, date of birth, address, gender, and, with your consent, Social Security Number. If you already have a UC San Diego Health electronic health record, this information will be used to associate your existing record with your status as an employee. If you do not have a UC San Diego Health electronic health record, one will be created for you and populated with this information. To expedite this procedure, you will be asked if you do NOT consent to disclosure of your SSN to UC San Diego Health. The disclosure of your SSN is voluntary.

Responses to daily screening surveys are primarily used to assess whether you have symptoms currently associated with COVID-19 to determine if you can be present on site for work that day. Note that the screening survey is not used to diagnose, treat, or provide medical advice for any health condition. The screening information is not maintained in your electronic health record.

 We will use your information for the purposes described below.

  1. Daily symptom screening registration and responses
    1. To meet State of California and San Diego County requirements for UC San Diego to allow you to be present on site;
    2. To provide you and your supervisor with documentation showing whether you should be present on site;
    3. To coordinate localized sanitation procedures, by helping UC San Diego to identify areas where those who have had symptoms have been on campus;
    4. To prioritize individuals, groups, or roles for asymptomatic testing as it becomes available (only if you select to be contacted for voluntary testing during registration) or for symptomatic testing, if you select “Yes” in a daily symptom survey);
    5. To contact you if testing is available for you or your department (only if you select to be contacted for voluntary testing during registration or if you select “Yes” in a daily symptom survey);
    6. To help UC San Diego identify possible outbreaks on campus by being able to efficiently review aggregated data of UC San Diego employees as they return to working on campus;
    7. To facilitate voluntary testing and treatment at UC San Diego Health;
    8. For reporting purposes in accordance with public health requirements;
    9. For analysis and reporting to inform campus re-opening plans;
    10. For potential research use in accordance with applicable laws, regulations, and University policies. 
  2. Work and Health Management Registration
    To create an electronic health record for you, if you do not currently have one at UC San Diego Health,or if you already have an electronic health record, to flag your existing electronic health record as an “employee.” By adding an “employee” flag, electronic health records will receive additional compliance and privacy safeguards. 
  3. Contact tracing
    1. To notify people who test positive for COVID-19 as well as their close contacts of isolation and quarantine procedures to help prevent further spread of the novel coronavirus(your name will not be disclosed to close contacts without your consent);
    2. To meet State of California and San Diego County requirements for public health;
    3. For reporting purposes in accordance with public health requirements;
    4. For potential use by UC San Diego researchers in accordance with applicable regulations and University policies.

Your personal information from the Program will be used, as needed, to assess, improve, or modify the Program; for auditing and monitoring of the Program; and if required for an investigation conducted by appropriate authorities. We may disclose your information to governmental licensing, auditing, regulatory, and accrediting agencies, as authorized or required by law.

For information about the uses of your electronic health record, please see UC San Diego Health’s Notice of Privacy Practices.

Who has access to your personal information

We will only share or disclose your personal information as described below or as required or permitted by law.

Daily Symptom Screening Survey Data

  1. Your supervisor, work lead, and, if applicable, symptom screener check-in person will see your primary work location and the results of the symptom screen; your supervisors will not have access to your answers to specific symptom screening questions, any test results, or any other medical information about you;
  2. You can see your own responses to the survey (sent to your email);
  3. The UC San Diego Center for Occupational and Environmental Medicine;
  4. ServiceNow and Qualtrics administrators in Health IT/ITS who are administering the survey.

Work and Health Management Registration

Your registration information will be visible to UC San Diego Health IT and Campus ITS.

Employer testing and vaccinations

UC San Diego’s Center for Occupational and Environmental Medicine (COEM) and Infection of Prevention and Clinical Epidemiology (IPCE) will have access to your test results. All testing, vaccinations, and demographic information will be maintained as confidential Protected Health Information and will be protected in accordance with UC San Diego Health’s Notice of Privacy Practices.

As part of employee health management, your employer will be notified of your compliance with required testing and vaccinations.

Contact Tracing

The case investigation and contact tracing teams receive notification of positive COVID-19 cases to help prevent the further spread of the novel coronavirus. Data is collected during case and contact interviews and stored in a secure HIPAA-compliant server. Data collected by UC San Diego case investigators and contact tracers will be used for case investigation, contact tracing, and public health purposes only. If a case or contact requires additional assistance or resources, the case or contact will be referred directly to the external organization.

How we protect your personal information

We maintain technical, physical, and administrative safeguards to protect the security, integrity, and privacy of personal data, including the following practices:

  1. To ensure even more privacy protection for UC San Diego employees and students, the records of all UC San Diego employees and students stored in Epic will be coded at the “break the glass” level of privacy protection. Records coded as “break the glass” require a specific justification for access;
  2. Electronic health records are subject to frequent privacy audits by UC San Diego’s Office of Compliance and Privacy;
  3. UC San Diego Health adheres to University of California requirements described in IS-3 UCOP Policy (Electronic Information Security) in order to secure your information;
  4. Information is housed on systems stored in controlled facilities with limited access;
  5. Encryption, such as the Secure Socket Layer (SSL), is used to protect the transmission of your information over the Internet;
  6. Security technologies and procedures are used to help protect your personal information from unauthorized access, use, or disclosures;
  7. Data access is limited only to authorized personnel;
  8. All authorized personnel are informed of their obligation to maintain the privacy, security, and confidentiality of information;
  9. All authorized UC San Diego Health personnel who will have access to your electronic health record are trained in privacy and security obligations.

The university endeavors to protect the privacy of the personal information we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of your personal information.

How Long We Keep Your Identifiable Data

The personal information obtained for the Symptom Screening Survey will be retained for 14 days.

Per UCSDHP 325.2, all electronic health records are retained for at least as long as required by State and federal law and regulations, and UC Records Disposition Schedules Manual and UC San Diego Health policies and procedures. Health records retention covers all types of UC San Diego Health records: (1) at a minimum, 20 years or more following the last recorded activity; (2) records of minors must be kept for one year past the age of majority.

Your contact tracing information, if any, will be maintained in accordance with State and County requirements.

Learn more about how long different types of information are retained by UC San Diego.

Knowing Your Choices and Rights

In accordance with current San Diego County Health Orders, UC San Diego employees and contractors reporting physically to the UC San Diego campus or other work site in San Diego County must complete the daily symptom screening survey prior to reporting to work. If you do not complete the survey, your failure may be deemed a refusal of a lawful order and you may be asked to explain the reason for your refusal to your supervisor and/or HR contact. If there is not a valid reason for refusal, you may be placed on a leave without pay and be potentially subject to discipline.

If you do not complete the Health Management registration form, we will remind you when you use multi-factor authentication (i.e., DUO mobile) to log into UC San Diego systems on your devices.

You may choose not to be contacted for voluntary diagnostic testing during registration or withdraw your consent later by contacting the Campus Privacy Office at privacyofficer@ucsd.edu.

You may opt out of sharing your SSN with UC San Diego Health. Your name, date of birth, address, and gender will be used to create an electronic health record for you or associate records for existing patients who are employees. For employees who opt out of sharing their SSN, their SSN will NOT be used. However, an electronic health record will be created or associated for employees. The creation of an electronic health record will allow us to appropriately and efficiently manage the Campus Health Management Program.

If you object to the creation of an electronic health record or the association of an existing electronic health record for employee health purposes, you may contact the Campus Privacy Officer at privacyofficer@ucsd.edu to discuss your concerns and options. If you object to the creation of an electronic health record or the association of an existing electronic health record, you will not be eligible for the benefits of the Program.

You have a right to:

  • Access your own data; and
  • Rectify or correct inaccurate or incomplete data concerning you

Changes to this privacy statement

This privacy statement will be updated periodically to reflect any material changes in the Program and practices. These changes will be evident by inserting a new “Effective Date” (see below) and are effective when they are posted to this website. Treatment of information is subject to the version in effect at the time such information is collected.

Contacting Us

If you have any general questions about:

Effective Date

This statement is effective as of 13 AUG 2020. The ’Changes to this Privacy Statement” section was revised on Aug. 20th for clarification but there were no changes to policy or practice.