Covid Pass Privacy Statement

Introduction

MIT has developed the Covid Pass application to assist members of the MIT community in complying with the policies and requirements pertaining to accessing the MIT campus during the COVID-19 pandemic. This Privacy Statement explains how MIT handles and uses the personal information we collect as part of MIT's Covid Pass application.i

What Personal Information we collect

We collect, use, store and transfer different kinds of personal information about you, which we have grouped together as follows:

  • Biographic information – name, date of birth, email address, MIT affiliation, Kerberos ID
  • Contact information – phone numbers and email addresses
  • Travel information – the location, method of transportation, and days traveled for all travel occurring outside of the Commonwealth of Massachusetts
  • Non-specific health information – daily attestation of symptoms commonly associated with a COVID-19-related illness; the presence of one or more medical conditions known to increase the risk of infection, hospitalization and/or death from a COVID-19 infection.
  • Vaccination information – your current vaccination status, including proof of vaccination (manufacturer, lot, date administered, location).
  • Location information – your current location, if you choose to enable this feature on your mobile device, may be used to provide card reader functionality, but is not stored.

How we collect personal information about you

We collect information, including Personal Information, directly from you when you register for access to campus; enter travel information; sign up for COVID-19 testing; submit eligibility screening for the MIT COVID-19 Vaccination Program; or record your vaccination status. We also collect information, including Personal Information, indirectly through electronic access to MIT Student Records and MIT Human Resources files.

How we use your personal information

We collect, use and process your personal information (1) to determine your eligibility for access to the MIT campus; (2) to schedule COVID-19 testing and report results to you; (3) to determine your eligibility and priority order to receive the COVID-19 vaccine; (4) to support MIT Medical’s health care operations; (5) to monitor public health within MIT and the greater MIT community; (6) to prevent the spread of COVID-19; (7) in limited circumstances to conduct scientific research; and (8) to provide additional services you choose to enable.

When we share your personal information

We will share information we collect (including Personal Information) with third parties (defined as any entity outside of MIT Medical and MIT) only as follows:

  • Testing information – As provided in the authorization for disclosure of protected health information, MIT may share your personal information, including full name, date of birth, mailing address, and email address. Apart from testing providers, your PHI is not shared with any other third party outside of MIT, but individual test results may be shared with Institute officials with a need to know to protect the health and safety of the MIT campus or to support members of the MIT community (including you) who may be affected by a positive COVID-19 test. Testing information may also be shared for purposes of scientific research, provided however, that such information will only be shared in de-identified and/or aggregated form and at no time will any personally identifiable information about you be shared.
  • Travel information – If you register travel, including personal travel, this information may be shared with a limited number of MIT Medical and other MIT employees with a need to know this information for the purpose of maintaining the health and safety of the campus, MIT community, and MIT operations.
  • Vaccine Information – When MIT Medical administers a COVID-19 vaccination, MIT Medical is required by law to report your vaccination status to federal, state and local public health officials and agencies, including specifically the Massachusetts Immunization Information System (MIIS). Please also see MIT Medical’s Notice of Privacy Practices. Apart from required reporting by MIT Medical, your vaccination status (regardless of whether or not it was administered by MIT) may be shared with MIT Medical and other MIT employees with a need to know this information for the purpose of maintaining the health and safety of the campus, MIT community, and MIT operations. Vaccine information may also be shared for purposes of scientific research, provided however, that such information will only be shared in de-identified and/or aggregated form and at no time will any personally identifiable information about you be shared.

How your information is stored and secured

MIT is committed to protecting the Personal Information in its possession or control. This is done through a variety of privacy and security policies, processes, and procedures, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Personal Information that it receives, maintains, or transmits. Nonetheless, no method of transmission over the Internet or method of electronic storage is 100% secure, and therefore we do not guarantee its absolute security.

How long we keep your personal information

  • Your Personal Information and records related to COVID-19 testing will be retained for a period of one (1) year following the expiration of the Commonwealth of Massachusetts Emergency Covid-19 Declaration.
  • Your Personal Information and records related to your travel will be retained for a period of one (1) year from the date of submission.
  • Your Personal Information and records related to your participation in MIT’s COVID-19 Vaccination Program will be retained in accordance with the Commonwealth of Massachusetts record retention schedule for immunization records.

Additional Information

We may change this Privacy Statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.

This policy was last updated in July 2021.


iThe Privacy Statement is intended to cover MIT’s Covid Pass system. For additional privacy practices with respect to MIT’s COVID-19 Vaccination Program, please see MIT Medical’s Notice of Privacy Practices available here. This policy applies specifically to the vaccination program and is in addition to the privacy practices detailed in this Privacy Statement.