Documentation needed for HAs for PathCheck GPS

A draft list of the set of documentation needed for HAs. To compare with what we actually have, to identify work to be done. This has been written with PathCheck GPS in mind. An equivalent list for PathCheck BT would probably have some overlap, but also some differences.

This documentation is an important input for Testing, as it clarifies the context in which the product will be deployed.

Acceptance by Path Check
- Organization: Conditions an organization must meet to be a Path Check Health Authority
  - TBD - what is our definition of a “Health Authority”?
- Deployment: Conditions a deployment must meet for Path Check to move ahead
  - (see: Ethical Compliance Assessment for COVID Safe Paths )
  - (TBD whether we enforce all these, or whether there would be some flexibility in moving forward with an HA that did not align on all of these).
  - Use of App must be voluntary
  - Any incentives used must be governed by clear Ethical principles.
  - Independent oversight committee
  - Clear published privacy policy (with some defined standards this must meet)
  - All data to be deleted within 30 days
  - Clear conditions for termination of program
  - Program not to be used for other healthcare purposes (e.g. seasonal flu)
  - No data to be shared with any organization that is not directly involved with public health.
  - Systematic monitoring for effectiveness, benefits, harms, and fair distribution of benefits and harms.
Deployment
- Technical Infrastructure
  - Database
  - Back-end server
  - HTTPS server for published data
  - HTTPS Certificates
  - User Authentication System
  - “pre-production” instance of all the above
  - Sparing/Redundancy
  - Security
- Tech for Contact Tracers
  - Web Browser for Contact Tracers
  - Phone system for outbound calls
  - Case tracking IT system
  - Phone system for incoming calls
- Digital Assets
  - HA Name (as it is to appear in Path Check GPS)
  - Info Website
  - Reference Website
  - Privacy Policy
  - News Website
  - Sensitivity settings for Exposure Notifications
  - Guidelines on what to do in the event of an exposure notification
  - (is there any other per-HA customization of the app?)
  - Translated versions of above assets for all offered languages.
- Human Resources procedures
  - Training procedures
  - Onboarding procedures
  - Offboarding procedures
- Pre-Pilot Testing
  - Test Plan
Maintenance
- Upgrade procedure (including pre-production, test & roll-out to production)
- Failure procedures (e.g. hardware failure)
Clinical capabilities
- PCR Tests available
- Predictable elapsed time to receive test results
- Known PCR testing capacity
Support mechanisms
- Support for community members who may be exposed to follow protocols
- Support needed may be financial, practical, emotional.
Procedures / protocols
- Contact Tracing Interview procedure
  - Principles for redaction
  - Principles for adding data points.
- Data Publishing procedure
- Exposure Notification protocol
Measurement & Efficacy
- Definition of success
- Metrics used for that definition of success
- How those metrics will be gathered
- “control” of the experiment
- Statistical analysis of the data (assess significance, p-values etc.)
- Capture information on any resulting harms
- Measure community distribution of harms & benefits.
Equitability
- What measures can be taken if benefits or harms are unevenly distributed?
- E.g. On benefits: increase level of non-digital contact tracing for those communities not benefitting
- E.g. On harms: compensation for, or mitigation of, harms resulting from the program.
Optimization
- Plan for tuning of parameters / protocols
- Efficacy Model - e.g. to assess the overall impact of changes to parameters / protocols.
- A/B testing capability