Covid-19 testing and diagnosis: where privacy stops

One of the most controversial aspects of smartphone contact tracing is the thorny problem of diagnosis. It’s easy to build an automated diagnostic system into an app, but anything based on self-reported symptoms is unreliable, because the early symptoms of Covid-19 infection are so non-specific. The medical world has been studying automated diagnostic systems for at least fifty years now, and although they can perform quite well in the right circumstances, Covid-19 isn’t one of those.

The current World Health Organisation definitions for surveillance purposes distinguish between suspect, probable and confirmed cases of Covid-19. To go from suspect or probable to confirmed, laboratory confirmation is required. If a contact tracing app only works with suspect cases, then it will alert far too many contacts. That not only quarantines too many people unnecessarily, but it weakens the user’s confidence in the app’s recommendations, leading people to ignore its advice to go into quarantine, defeating the whole purpose.

One of the critical questions is what percentage of suspect cases prove positive when tested. The answer from all studies that I can find is worryingly low. You can get a rough idea of this from national figures for testing, only that isn’t straightforward as most countries now test people for two different reasons: diagnosis, where they’re already suspected of having Covid-19, and screening, which includes people who are completely asymptomatic. Headline testing figures invariably combine the two, as politicians are keen to make it appear that their state has been proactive in dealing with the pandemic. Unfortunately, confounding the numbers makes it hard to make any sense of them (and the claims of the politicians).

The latest cumulative figures for UK testing predominantly on those admitted to hospital, therefore mainly for diagnostic purposes, show that 169,366 tests have been positive on 825,627 people, an overall rate of 21%. For most other diagnostic tests, that would be considered unacceptably low, but for Covid-19 that seems fairly typical at present. So in all probability, of those meeting an app’s criteria for being suspect cases of Covid-19, only around 20% are likely to test positive.

The complementary question is what percentage of people who test positive don’t have symptoms which would make them suspects in the first place. These would form the app’s false negatives – the cases of Covid-19 who are so mild that they aren’t noticed at all. Recent reports from groups such as healthcare workers suggest these could be as high as 7-10%, although other population studies claim that could be higher in other groups.

The NHS app currently being trialled on the Isle of Wight integrates with a testing and reporting service, but that is performed outside the app, and has its own issues over the protection of privacy. When you report symptoms which the app considers make you a suspect case, you are then offered a test. For that to happen, you are given a reference number and a call centre to contact. If you take that offer up, the call centre obtains your name, address and email address, and sends a home test kit (actually a sampling kit, as the test is still performed in a laboratory) to arrive within 24 hours.



In practice, in this trial, this is one of its great successes. In the one case I know of who has entered the testing phase, the kit was delivered within 24 hours with clear instructions for it to be used the following morning. It was then collected within a couple of hours, and the test result returned by email within a further 24 hours, even though the laboratory is in Northern Ireland. Total time elapsed between the user first reporting their symptoms on the app and their receipt of the result was under 60 hours.

That may still seem a long time. However, it is a great improvement on existing hospital-based testing, which is unlikely to occur for two weeks or more after the onset of symptoms. The app therefore results in near-instant reporting of suspect cases, and its testing service can transform those suspects into confirmed cases in less than three days. Similar results should be delivered by the online and call centre systems provided for those who can’t or won’t use the app, but they can’t perform tracing of anonymous contacts, and appear less likely to be used.

At the moment, ordering tests and reporting results takes place outside the UK app, and it doesn’t appear that the database to which the app connects has any knowledge of testing or its results.

There is a proposal that a future version of the UK app will incorporate test kit ordering and the handling of results. This brings further potential: by integrating test results with contact data, contacts could receive two-phase warnings. The first would be as at present, when a close contact judged by the algorithm to have met exposure criteria reports symptoms which make them a suspect Covid-19 case; the second would occur if that contact’s subsequent test proved positive. This is another feature which is relatively simple to incorporate into the centralised tracing model, but which appears difficult if not impossible for a decentralised model.

Reports on the official contact tracing app being developed for Germany, which is intending to use the Apple-Google decentralised model, suggest that its developers have solved these issues and are making a positive test result the requirement to initiate contact tracing. It isn’t clear whether or how users will be able to obtain testing in anonymity, though, or whether the requirement for testing will deter the less symptomatic from reporting, thus lose some of the most infectious cases from tracing of contacts. Another issue to be considered is that laboratory tests have significant false negative rates, particularly from home test kits.

Unfortunately, adding test kit ordering and result recording to the current UK app also adds considerably to the information which is stored centrally about each user. With separate systems, at present, all the app knows is the first part of the user’s postcode and their pseudonymous identifier, a GUID. Adding test features necessarily adds their name, address, email address, and test result.

Critics of smartphone contact tracing consider that, without integration of test results, these apps, whether centralised or decentralised, wlll generate too many false alarms. Apple and Google have, for example, switched from using the term contact tracing to exposure notification in recognition of this and other issues. The only way to discover whether smartphone apps will prove useful tools to control the spread of Covid-19 is to trial them, and that is what NHSX is currently doing here on the Isle of Wight.

This trial has, for most users, been running less than a week, so it is too early to gauge the scale of any of these problems. Early results suggest that around 25 users each day, out of over 50,000 in a total population of 140,000, are reporting symptoms which make them suspect cases. I don’t know how many are being warned that they had risky contacts with those, but the overall rate of positive test results for the Island doesn’t appear to have changed as a result of what should be greatly increased testing.

The number of positive tests remains around 1-3 per day, leaving the incidence at about 120 cases/100,000 (very low for England as a whole), and suggesting that about 20 cases each day turn out to be false alarms. Although not disastrously high, it does suggest that test results need to be integrated to improve the effectiveness of the system. Protecting privacy will then become a major challenge.

I am very grateful to Terry for the images, and don’t worry, the result was negative, and wasn’t my test either.