Table 1.

Receiver-specific rules in contact tracing.

Receivers	Permitted purposes	Permitted content and granularity
General public (including citizens, employers, and insurers)	Situational awareness and risk avoidance	Population-level, nonidentifying information only (eg, regional spread status and high-risk area alerts)
Individuals (data subjects)	Awareness of one’s own exposure or status	Full-resolution information about oneself, accessible only to the individual concerned
Public health planners	Cluster detection, epidemic modeling, and resource allocation	Pseudonymized, aggregated cluster or mesh-level information and no individual-identifying granularity to third parties
Enforcement or notification bodies	Issuing exposure notifications	Only the minimum information necessary for notification, with no broader behavioral history
Health care institutions	Treatment of the specific patient	Only the data of the patient under that institution’s care
Research institutions	Analysis, modeling, and simulation	May drive repeated analysis on the inside-boundary data analyzer and only nonidentifying products (model parameters, aggregate or differentially private statistics, and simulation results) leave the boundary