Apple has responded to a letter from the Senate asking questions about its COVID-19 detection tools. The company sought to allay concerns about an app and website it launched in late March, in collaboration with the Centers for Disease Control and Prevention (CDC), the Federal Emergency Management Agency (FEMA), and the White House. It promises that the tools include “strong privacy and security protections” and that Apple “will never” sell the data it collects.
The letter answers several questions raised by Senators Robert Menendez (D-NJ), Richard Blumenthal (D-CT), Kamala Harris (D-CA), and Cory Booker (D-NJ). Among other things, it reveals the terms of Apple’s agreement with the US Department of Health and Human Services (HHS). These include prohibitions on sharing any user-identifying information with CDC.
Apple’s senior director of government affairs Timothy Powderly also tells the Senate that his tools are not covered by the HIPAA health privacy law. HIPAA governs when a company may disclose data to a third party, and Apple says there are no third parties involved in the collection of information, as “users enter the data directly into the website and the app.”
The screening tool does not ask for a user’s name but asks for information about their age, travel history, possible exposure to infected people, and other details that could determine whether to test for the new coronavirus. Apple says it “collects only the information necessary” to run the app, including analytics like bug reports, and if it decides to store and share more data in the future, it would get the user’s consent.
These tools are separate and much less complex than the COVID-19 contact tracking system that Apple is developing together with Google. This tool will launch in mid-May and raises its own set of privacy questions, despite both companies working hard to address them.
In a statement to The Verge, Menendez said he appreciated the responses. “Apple’s response reflects a commitment to data privacy and the importance of taking proactive steps to protect it. I hope they will honor this commitment and I will be there to hold them accountable if they fail,” he said. “I hope the Department of Health and Services Humans – and the Trump Administration as a whole – follow similar steps to be more transparent and, for example, publish the full agreements they have signed with technology companies like Apple. “