Under the October 29, 2020 Gatherings and Face Masks Epidemic Order, many organizations
are required to collect information about customers to aid in COVID-19 contact tracing efforts. The MDHHS has released a MDHHS Q&A on Collection of Information for Contact Tracing to help provide additional guidance to business owners.
Below is a summary of a few key items from the document:
- The following businesses are required to request contract information from patrons: Barbering, cosmetology services, body art services (including tattooing and body piercing), tanning services, massage services, or similar personal care services; Recreational sports and exercise facilities, and entertainment facilities (except for outdoor, non-ticketed events), including arenas, cinemas, concert halls, performance venues, sporting venues, stadiums and theaters, as well as places of public amusement, such as amusement parks, arcades, and bingo halls; all businesses or operations that provide in-home services, including cleaners, repair persons, painters; all dine-in food service establishments, including bars and restaurants.
- Bars and restaurants are required to request contact information from patrons, but are not required (but it’s recommended) to deny entry to a patron who does not provide their contact information
- Organizations should store the collected information securely for 28 days (two COVID-19 incubation periods) after the information was collected. After the 28 days, organizations are required to properly destroy the data.
- Organizations are required to provide the collected information to MDHHS and/or Local Health Departments investigating COVID-19 cases and exposures upon request.
- Organizations are not allowed to sell the contact data collected or use it for sales or marketing purposes.
- Collected contact information will not be shared with any law enforcement agency without a lawful subpoena from the court.
Download a copy of the MDHHS Q&A on Collection of Information for Contact Tracing