Health Information Privacy

FAQs in Connection with Screening, Testing, and Contact Tracing

BU’s COVID-19 Screening, Testing, and Contact Tracing program for the BU community is administered by Student Health Services (SHS), BU Occupational Health Center (BUOHC), and the BU Clinical Testing Laboratory (the Clinical Laboratory). It is important for each member of the BU community who is returning to campus to understand how your health information is protected and the circumstances under which either SHS, BUOHC, or the Clinical Laboratory may disclose any of your health information. 

Your health information, including your responses to the COVID-19 Symptom Screens and the results of your COVID-19 testing, is confidential health information at SHS, BUOHC, and the Clinical Laboratory.

However, because COVID-19 is a highly contagious disease and we are operating in the context of a public health emergency, we are required to share certain information with government public health agencies such as the Massachusetts Department of Public Health (MA DPH). We may also share your health information with individuals within the BU community on a need-to-know basis. We will update the FAQs as new information becomes available.  

Privacy & Security of Health Information

What kind of health information do BU healthcare providers have about me?
Each of the healthcare providers involved in the COVID-19 Screening, Testing, and Contact Tracing program stores and uses your health information to provide healthcare services to you:

  • Students: SHS has health information that you are required to provide in order to enroll at BU (e.g., proof of immunizations) or to participate in various BU programs (health screening for clinical activities, dive program medical clearance, screening for athletic activity participation, etc.). SHS also provides general medical care to BU students, including preventive medical care, diagnosing and treating injuries and illnesses, behavioral health services, and more. If you have had any of these services at SHS, there will be a record of it.
  • Faculty and Staff: BUOHC has health information related to employees’ work at BU. For example, immunization records for clinical staff, fitness for duty evaluations for certain job functions, and information related to the prevention, diagnosis, and treatment of occupational illnesses and injuries. BUOHC also has medical information related to your medical leaves of absence and return to work. Unlike SHS, BUOHC does not provide general primary care services to BU employees.
  • The Clinical Laboratory has specimens for testing, test results, the BU ID for anyone tested, and the bar code associated with each sample kit. The Clinical Laboratory does not have the names or other identifying information of persons tested because it is not necessary.

How do BU healthcare providers keep my information secure?
Your health information is stored in electronic medical records, each of which meets stringent security standards set by BU’s Information Services & Technology. The information is accessible only by persons working for these healthcare providers. Your health information is considered “Confidential” under BU’s Data Classification Policy and is subject to BU’s stringent security standards for confidential data. You can find more information on data protection in the information security data classification and management policies.

Which laws protect my health information at SHS, BUOHC, or the Clinical Laboratory?
None of these healthcare providers are required to follow the federal HIPAA privacy and security rules. However, they are required under Massachusetts law and their professional obligations to keep your health information private and confidential.

Symptom Screening & Privacy

Who receives the information in my responses to the Symptom Screening?
Your responses to the Symptom Screens go to SHS (for students) or BUOHC (for faculty and staff).

What is done with my answers to the Symptom Screen?
SHS and BUOHC use your answers to determine whether you may come on campus, or if you should schedule a COVID test and self quarantine.  

Will BUOHC tell a BU manager or department head that a faculty or staff member has reported a COVID-19 symptom on the Symptom Screen?
No, BUOHC will not disclose what you report on your Symptom Screen to your manager.

If BUOHC advises you to remain off campus based on your answers to a Symptom Screen, you should tell your manager you are not able to come to work, but you do not need to explain the specific medical reason. BUOHC will handle your absence the same way that all medical issues are handled for BU employees. BUOHC will send a Work Status Form (indicating you are off work) to you, your manager, and HR. The form will not indicate a medical reason.

Does SHS tell anyone when students report COVID-19-like symptoms on their Symptom Screen?
No. If SHS advises you to not engage in campus activity, you should communicate with professors/supervisors to inform them, but you do not need to disclose any medical information.

Does SHS or BUOHC tell the BU Contact Tracing team about my positive symptoms?
No. The Contact Tracing team is only notified of positive test results. It does not receive symptom reports.

Does BU report my positive symptoms to any public health agencies?
No. We do not report positive symptoms outside of BU.

If I don’t complete my Symptom Screen when I am on campus, will anyone be told about that?
Your failure to complete a screen is not medical information, so it may be reported to your manager or to the Dean of Students, and it may affect your ability to take part in on-campus working, learning, and other on-campus activities. It will also prevent you from having a clearance pass, or badge. We have put in place compliance measures for all students and for faculty and staff.

Clinical Testing Laboratory & Privacy

What kind of health information does the Clinical Laboratory keep for me?
The Clinical Laboratory does not hold the names of persons being tested. The Clinical Laboratory collects your BU ID and, for students, QR code given when an appointment for testing is made. After testing, the Clinical Laboratory has the results of your test.  

Does HIPAA or any other law protect my health information at the Clinical Laboratory?
The Clinical Laboratory is not a HIPAA-covered component, and is not required to follow the HIPAA privacy and security rules. However, it is required to keep all health information confidential as a CLIA and MA DPH licensed laboratory and pursuant to BU policies.  

Test Results & Privacy  

Who gets the results of my COVID-19 test?
The Clinical Laboratory conducts the test, stores the result in the Laboratory Information Management System, and transmits your test results electronically to SHS or BUOHC. Your results are tied only to a bar code and your BU ID, and not to your name or any other identifying information. You will receive your testing results from SHS or BUOHC, with appropriate follow-up and instructions.

Does SHS, BUOHC, or Healthway report positive results to anyone at BU outside of SHS?
Positive results are reported to BU Healthway Contact Tracers so that they can contact you to learn who in the BU community has been in close contact with you during the time you may have been contagious. More details on Contact Tracing are below. 

Healthway will also disclose positive test results to other individuals at the University on a need-to-know basis. For example, Healthway Contact Tracers may need to disclose your positive result to Residence Life, if you live in a BU residence, so that University staff can facilitate your move to isolation housing.

Facilities will be informed whenever there is a positive result so they can make sure the BU locations the positive person visited are adequately sanitized, but they are not told who the person is who tested positive.

Does BU report my test information to anyone outside of BU?
Yes, we are required by law to report all COVID-19 test results, as well as certain information including name, date of birth, address, sex, race, ethnicity, and phone number, to the MA DPH. Demographic information is provided to the MA DPH so that public health authorities (and the public) can assess the impact of the pandemic on certain racial, ethnic, age, gender, and community groups and conduct contact tracing. MA law authorizes the MA DPH to obtain medical records and other information that it deems necessary to carry out its responsibilities to investigate, monitor, prevent, and control diseases dangerous to the public health.

MA DPH compiles positive test data and makes it available to the local public health agency of your city/town. As such, your local public health agency or MA DPH may contact you for purposes of Contact Tracing. More on Contact Tracing below.

Contact Tracing & Privacy

What is Contact Tracing?
Contact Tracing is one of the most critical tools in controlling pandemics. It allows us to break the chain of infection by identifying and notifying the “close contacts” of each person who tests positive for COVID-19 so they can get tested. You can find more information on this essential public health tool on the CDC website.

Why is BU conducting Contact Tracing?
BU has established our own Healthway Contact Tracing team, under the supervision of SHS and BUOHC. The Contact Tracing team will quickly identify and notify close contacts of anyone in the BU community who tests positive in an effort to keep our entire community safer and healthier.

Are the BU Healthway Contact Tracers licensed nurses?
Sometimes, but not usually. Contact Tracing does not involve providing healthcare treatments to individuals and therefore does not require a healthcare license. At BU, Contact Tracing is performed under the supervision of licensed healthcare professionals at SHS and BUOHC. All BU Healthway Contact Tracers are trained in BU’s health information privacy and security as well as in Contact Tracing practices recommended by the CDC and MA DPH.

How will the BU Healthway Contact Tracers work?
The Healthway Contact Tracing team or BUOHC will be notified any time a member of the BU community tests positive for COVID-19 and will specify the time period during which the person may have been contagious. If you tested positive, a BU Contact Tracer will contact you and ask who you had close contact with at BU during the period of time you may have been contagious. (According to the CDC, a close contact is an individual who has been within 6 feet of a person who has tested positive for COVID-19 for 15 minutes or longer over a 24-hour period.) The Contact Tracer will enter that information into the SHS or BUOHC electronic medical record. Furthermore, the Contact Tracer will contact each of the persons in the BU community who may be a close contact to inform them they may have been exposed, help arrange for their prompt COVID-19 testing, and instruct them to self-quarantine until they receive the test results.

Do BU Healthway Contact Tracers tell my close contacts that I am the one who tested positive?
No. BU Healthway Contact Tracers do not reveal the identity of the person who tested positive who may have exposed others. However, depending upon your circumstances and relationships, others may guess that you may be the positive person. For example, if you tell your friends you are moving out of the campus residence to Isolation Housing, when the Contact Tracer calls them, they will probably assume you might be the person who exposed them.

What about close contacts who are not affiliated with BU?
BU will only be contacting members of our BU community for Contact Tracing. The BU Healthway Contact Tracers may recommend you inform your non-BU contacts so that they can get tested promptly. The MA DPH or your local public health agency may also contact you and your BU and non-BU close contacts.

How does BU’s Contact Tracing program interact/share information with the Contact Tracing done by the city and state? Is any information shared with the city and state?
Healthway works closely and shares information with the Boston Public Health Commission and the Massachusetts Department of Public Health’s case investigation and Contact Tracing efforts in order to strengthen resources and not duplicate vital efforts.

Data Dashboard

What BU health data is made available to the public?
Aggregated, de-identified data are reported on the number of tests conducted, including total positive results. “De-identified” means that no one is identified by name or in any other way. We publish this aggregated data because we believe it’s important to keep the Boston University community informed on the status of Symptom Screening, Testing, and Contact Tracing of students, faculty, and staff.

Does BU use health data in any other way?
BU professionals and administrators involved with campus planning, safety, facilities management, and procurement of medical and personal protection equipment will also monitor additional aggregated, de-identified data. This includes aggregated data on Symptom Screening and Contact Tracing, and capacity and use of quarantine and isolation housing. No identifiable health data is needed or used for these purposes.  

Is my personal health record being viewed in this process?
No. Aggregate counts are used in analytics and reporting of public health data. No personally identifiable data is exposed.

More Questions?

If I have more questions about the privacy or security of my health information related to BU’s Screening, Testing, and Contact Tracing program, who can I contact?
Please contact BU’s Director of Health Privacy and Compliance at