Contact Tracing for COVID-19 for businesses in New Zealand

As New Zealand enters an extended period of managing the impact of COVID-19, effective contact tracing will be critical to the success of our efforts to contain the spread. There are two primary goals to contact tracing:

  • Stop the spreading of the disease through timely containment
  • Where spreading has occurred, identify potentially infected people.

As the nation changes alert levels and the protocols that need to be observed, businesses need flexible systems so they can adapt. These systems incorporate people, processes, resources and information systems.

The uncertainty of the situation and the constraints of the alert levels will continue to have a pronounced effect on people. Any contact tracing system needs to be sensitive to these factors if it’s going to achieve optimal compliance.

This discussion paper outlines an approach that businesses can take to strike a balance between robust contact tracing systems and disruption to business activity.

NOTE: This discussion paper is intended for businesses that do not normally operate under high consequence Health and Safety conditions. Businesses such as hospitals, construction sites, forestry, transport, etc., need to incorporate health and safety requirements that extend beyond the scope of this document.


Businesses are complex organisations. At its simplest level, contact tracing for a business is maintaining records of who was where, and when. The business activity is the ‘why’ they are interacting. This provides a basic structure to frame up the design of contact tracing systems:

A flow diagram to represent the design of a contact tracing system.

Workplace Contact Tracing

By defining zones for workplaces, it is possible to implement different contact tracing procedures appropriate to each zone or location. A circulation zone may have rules that mitigate the need to contact trace because close contact is avoided. A dedicated work zone may only be occupied by named personnel, and meeting zones may require detailed record keeping.

Some system factors to consider are:

  • Sign In/Out/Registration on site – perimeter identity and access management
  • Perimeter procedures – advising new/changed policies and protocols on entry. Consider options such as contactless proximity cards, contactless motion opened doors, voice interfaces, digital signage, and facial recognition to eliminate physical contact with kiosks, pens, doors, lift buttons etc.
  • Location Alert Level Policies – organise policies into alert level descriptions, to simplify communications and understanding
  • Oversight and incident reporting – assign personnel to be responsible for monitoring and handling of incident reporting
  • Onsite Surveillance options:
    • Passive systems such as
      • Wireless Access Point device tracking
      • Security Camera and Video Analytics monitoring (observing occupancy, crowd and individual policy compliance)
      • Access Card log monitoring – Active Directory Security Group activity logging
    • Active systems such as
      • Bluetooth beacon monitoring systems
      • Self-trace mobile applications, SaaS tools, bespoke systems.

Workforce Contact Tracing

Businesses have a duty of care for their staff when they are working for the business. Business activity often occurs in places that are not managed by the business. Contact tracing from this perspective requires a workforce monitoring approach.

Some system options to consider are:

  • Check In/Out: confirm location/destination, wellbeing, receive important notices about the location
  • Notification – mechanisms to report suspected COVID-19 infection, spreading, or risky behaviour
  • Activity tracking – record of meetings and locations. Record of location changes and times
    • Passive monitoring of systems such as calendar schedules, timesheets, job scheduling
    • Active monitoring systems such as self-tracing mobile applications, business specific online registers/forms, SaaS tools.

Public Contact Tracing

Where a business is operating in an area where people movement is typically unmanaged, there are unique challenges to contact tracing. Fundamentally, if a business is responsible for a space and it cannot enforce policy or identify occupants, it is unable to operate at that location under COVID-19 constraints. To overcome this, businesses can erect barriers with perimeter controls to create managed zones, or leverage workforce systems such as location/proximity beacons to enable people tracing.

Some system options to consider are:

  • Self-Trace
    • Bluetooth Beacon logging – capture details of Beacons encountered
    • QR/NFC perimeter registering. Restricting access enables sign in/sign out tracking
  • Location Surveillance
    • camera recording/AI pattern recognitions of social clusters (closer than 2m, for more than 10 minutes)
    • Triangulation/Vector recording: Wifi/cell tower device logs (device ID, router location, time entered, time exited, signal strength spot measures).

Investigation support

High trust approaches can work, even with less than ideal compliance.

The main goal of tracing contacts is to quickly inform the investigation after an infection or cluster has been identified. This enables investigators to identify close contacts as quickly as possible and reduce the time contagious people are circulating. Where compliance to protocols is difficult to enforce, having more than one point of observation (tracing people, monitoring locations) can yield a high coverage level.

A square diagram to compare workforce compliance and workplace coverage.


Contact tracing systems and practises can serve a few purposes:

  1. Identify potential spreading and contain within a workforce, workplace, or public place
  2. Support investigation efforts by authorities
  3. Enforce and observe compliance with protocols
  4. Reduce business impact

The approach is to establish the systems necessary to enact contact tracing, rather than just taking the actions that need to be performed. Systems can be adapted as requirements change, whereas an actions-oriented approach will require constant allocating of resources and reinvention to adapt.

Principles first – save lives first, then save livelihoods. Save profits last.

Systems can be performed manually or automated. Some guiding principles to urgent systems design:

  • Assign authority to make decisions
  • Start with a low maturity model and rapidly evolve. Only automate systems that have low errors/exceptions
  • Experiment to resolve uncertainty. Consensus takes too long.


People will typically encounter others in one of four places:

  • In their home
  • In a managed workplace
    • Workplaces will have physical separation, hygiene protocols and require some level of contact tracing in place that will enable them to operate under different Alert Levels
  • In an unmanaged space (e.g. public place).
    • These spaces present real challenges to contact tracing, as they are designed to serve social gathering in an open way. Spaces that are unable to meet contact tracing will likely remain closed if contact tracing is required
  • In Transit from one place to another.
    • Travelling typically happens as pedestrians, in private vehicles or public transport. For public transport providers with contactless payment systems have a level of record keeping that can support Contact Tracing
    • Pedestrians are unlikely to encounter close contact clusters (close together for more than 10 minutes)
    • Public Transport providers may be able to achieve a level of contact tracing through existing contactless payment systems.

To perform adequate contact identification, an investigator needs to be able to qualify the following risks:

  • Transmission risks
    • Time and place of potential spreading: when and where have probable or confirmed infected people been
  • Infection Risks
    • If there are times and places where transmission was possible, what was the risk of others getting infected?
      • Close contact: e.g. closer than 2m for more than 10 minutes
      • Casual contact: at the same place and time, but not identified as a close contact
      • Surface contact: identify surfaces that may have been contaminated (door handles, food service, shared equipment, etc).

Rapid deployment

In a crisis, rapid response is crucial to the outcome. A system is only useful if its operational and being used. To enact changes to a business that involves everyone requires special attention to communications to get the message out as fast possible. Another key factor is decision making. It can be impractical to use traditional business decision making and communication approaches to implementing contact tracing systems. They are typically oriented to other needs, such as de-risking investment or optimising operations.

One way to leverage the existing organisation and resources is to overlay COVID-19 specific roles and responsibilities, with a simple three step process:

  1. Organise
    • Define roles and responsibilities, identify support system requirements, define workforce and workplace controls
  2. Activate
    • Stand up systems, communicate changes to workforce, experiment to resolve any uncertainties
  3. Operate
    • Ensure some level of oversight is in place to make sure contact tracing is operating and being used.


This discussion paper is intended to provide some structure and process to forming, implementing, and operating a successful contact tracing system for a business. This is only useful if a business makes a start and moves quickly.

The nature of situation means mistakes are inevitable. Unlike business as usual, these are not failures. These mistakes are learning opportunities – a partially effective contact tracing system today that can be improved tomorrow will become a fully effective system.

There has never been a time like this in our living memory, so everyone is learning as we go. Share ideas and thoughts with staff, customers, and suppliers. We share a common goal.

An artistic representation of a COVID-19 framework.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s