ISO 9829:2025
(Main)Healthcare organization management — Pandemic response (respiratory) — Contact tracing
Healthcare organization management — Pandemic response (respiratory) — Contact tracing
This document specifies contact tracing procedures for highly contagious respiratory infectious disease cases, including both symptomatic and asymptomatic infections for pandemic response. This document provides: — an overview and general procedures of contact tracing; — requirements and privacy protection guidance in contact tracing.
Management des organisations de soins de santé — Réponse en cas de pandémie (respiratoire) — Traçage des contacts
General Information
Standards Content (Sample)
International
Standard
ISO 9829
First edition
Healthcare organization
2025-11
management — Pandemic response
(respiratory) — Contact tracing
Management des organisations de soins de santé — Réponse en
cas de pandémie (respiratoire) — Traçage des contacts
Reference number
© ISO 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 2
5 Overview of contact investigation and contact tracing . 2
6 Contact tracing . 4
6.1 General .4
6.2 Location information technologies .5
6.2.1 General .5
6.2.2 Wi-Fi communication .5
6.2.3 Satellite-based positioning system .7
6.3 Digital payment transaction logs .8
6.3.1 General .8
6.3.2 Descriptions and general procedures.9
6.3.3 Requirements .10
6.4 Digital customer register entry logs .11
6.4.1 General .11
6.4.2 Descriptions and general procedures. 12
6.4.3 Requirements . 13
6.5 Proximity networking .14
6.5.1 General .14
6.5.2 Descriptions and general procedures. 15
6.5.3 Requirements . 15
7 Privacy protection guidance .16
Bibliography .18
iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 304, Healthcare organization management.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
iv
Introduction
Contact tracing using information technologies enhances the efficiency and accuracy of public health efforts
in controlling the spread of infectious diseases.
In situations like the COVID-19 pandemic, where rapid and widespread transmission of a highly contagious
respiratory infectious disease is a concern, contact tracing can help compensate for limitations such as
incomplete recollection of patients during interviews. By leveraging information technologies, contact
tracing can be enhanced in the following ways.
— Efficient data collection and management:
Contact tracing enables the collection and management of contact information in a more streamlined
and efficient manner. Technologies such as mobile applications, online forms or digital customer
registers can be utilized to gather contact details and relevant information from individuals who could
have been exposed to highly contagious respiratory infectious diseases. This eliminates the need for
manual data entry and reduces the potential for errors.
— Timely and automated notifications:
Information technologies allow for the rapid dissemination of notifications to individuals who could
have come into contact with a confirmed case. Automated systems can send alerts or messages through
various communication channels, such as mobile apps, short message service (SMS) or email, notifying
potential contacts about the need for further assessment or testing. This enables timely interventions
and reduces the risk of further transmission.
— Improved accuracy and traceability:
Contact tracing provides a more accurate and traceable record of potential contacts. By leveraging
technologies like QR codes, digital payment transaction logs or location-based tracking, it becomes
possible to gather precise information about specific locations visited by a confirmed case. This helps
verify the accuracy of the patient's recollection and aids in identifying potential contacts who could
have been missed during interviews.
— Data analysis and visualization:
Information technologies facilitate the analysis and visualization of contact tracing data, allowing
public health authorities to gain insights and identify patterns. By aggregating and analysing data
from multiple sources, such as location information, digital payment records or exposure notification
systems, authorities can identify hotspots, high-risk areas or potential clusters of transmission. This
information can guide targeted interventions and resource allocation.
— Privacy protection:
When implementing information technologies for contact tracing, privacy protection is an important
feature to be considered. Appropriate measures should be in place to safeguard personal data and
ensure data anonymization where possible. Transparent communication and consent mechanisms
should be established to maintain public trust and participation in contact tracing efforts.
Overall, contact tracing using information technologies complements the efforts of public health agencies
by providing efficient data collection, timely notifications, improved accuracy, data analysis and privacy
protection. By leveraging these tools, contact tracing can be conducted more effectively, helping to curb the
transmission of highly contagious respiratory infectious diseases in a faster and more targeted manner.
However, the implementation of these techniques may be tailored to the specific contexts and capabilities of
each country or region, considering that not all countries and regions have the infrastructure or resources
to implement the techniques described in this document for contact tracing.
v
International Standard ISO 9829:2025(en)
Healthcare organization management — Pandemic response
(respiratory) — Contact tracing
1 Scope
This document specifies contact tracing procedures for highly contagious respiratory infectious disease
cases, including both symptomatic and asymptomatic infections for pandemic response. This document
provides:
— an overview and general procedures of contact tracing;
— requirements and privacy protection guidance in contact tracing.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
contact tracing
process of identifying, analysing, and managing individuals who could have been exposed to a confirmed
case of a highly contagious respiratory infectious disease, utilizing conventional methods and digital
technologies to enhance accuracy and efficiency in exposure assessment and response
3.2
contact investigation
interviewing of a person known to have a particular disease to detect exposure to others and to determine
the need for subsequent screening for the disease of interest
3.3
digital payment transaction
financial transaction that is conducted electronically, typically involving the transfer of funds between
parties through digital means
Note 1 to entry: This can encompass a wide range of payment methods and platforms that do not require physical
exchange of money, such as credit/debit card payment, online banking transfers and a digital wallet, also known as an
e-wallet or mobile wallet, that is an online service, electronic device, or software program that allows users to make
electronic transactions.
3.4
mobile payment
payment involving a mobile device and using a payment instrument and associated infrastructures
[SOURCE: ISO 12812-1:2017, 3.29]
4 Abbreviated terms
® a
BLE Bluetooth Low Energy
COVID-19 coronavirus disease
SMS short message service
a ®
Bluetooth is the trademark of products supplied by Bluetooth Special Interest Group. This information
is given for the convenience of users of this document and does not constitute an endorsement by ISO of the
product named. Equivalent products may be used if they can be shown to lead to the same results.
5 Overview of contact investigation and contact tracing
Contact investigation and contact tracing play an important role in preventing the further transmission
of highly contagious respiratory infectious diseases, referring to respiratory infections with high
transmissibility through airborne or droplet transmission, by identifying and supporting individuals
who could have been exposed to an infected patient. These activities involve working closely with both
symptomatic and asymptomatic patients to gather information about their contacts and provide necessary
support.
Conventional contact investigation and contact tracing typically rely on proxy interviews with the patient.
However, these interviews can be prone to omission and errors due to factors like incomplete recollection or
potential intent to hide the patient's route of exposure. Table 1 shows some of the key limitations.
Table 1 — Some of the key limitation of conventional contact investigation and contact tracing
Limitation Description
Reliance on memory Conventional contact tracing often depends on the accurate recall of individuals
who could have been exposed to an infected person. However, relying on memory
alone can lead to incomplete or inaccurate information due to forgetfulness,
confusion, or intentional withholding of information.
Time sensitivity Traditional contact tracing methods can be time-consuming. As the process
involves manually interviewing individuals, delays can occur in identifying and
notifying potential contacts. During outbreaks of highly contagious respiratory
infectious diseases, time is of the essence, and delays can lead to increased
transmission.
Incomplete information It is possible that individuals do not always remember or are not aware of all
their contacts, especially if they were in crowded or public spaces. This can
result in the omission of potentially exposed individuals, leading to gaps in
the contact tracing process.
Limited reach Conventional methods can have limitations in reaching and identifying contacts
beyond immediate social circles. Contacts in public spaces, public transportation,
or other larger gatherings can be challenging to trace through traditional means.
Subject to human error Human errors during the interviewing and data entry process can introduce
inaccuracies. Misinterpretation of information, transcription errors, and other
mistakes can compromise the reliability of the collected data.
Stigma and privacy concerns Contact tracing can raise concerns about privacy and potential stigmatization.
Individuals can be hesitant to disclose their contacts due to fear of social con-
sequences, leading to incomplete or misleading information.
Resource intensive Traditional contact tracing requires a significant workforce to conduct inter-
views, follow-ups, and data management. This can be resource-intensive and
can strain public health systems, particularly during large-scale outbreaks.
TTabablele 1 1 ((ccoonnttiinnueuedd))
Limitation Description
Limited real-time data It is possible that the information collected through conventional contact tracing
is not always available in real-time or near real-time. Delays in data processing
and analysis can hinder the swift implementation of interventions to contain
the spread of highly contagious respiratory infectious diseases.
Inability to track asymptomatic car- Conventional contact tracing can be less effective in identifying and tracking
riers asymptomatic carriers who can unknowingly transmit the disease. It is possi-
ble that asymptomatic individuals will not seek testing or cannot recall their
contacts, making it challenging to interrupt the transmission chain.
Global mobility challenges In the context of a highly contagious respiratory infectious disease with a glob-
al impact, conventional contact tracing faces challenges in tracking contacts
across borders. International travel can complicate efforts to identify and notify
individuals who could have been exposed in different countries.
In response to these limitations, the integration of technology and innovative methods aims to overcome
some of these challenges and enhance the effectiveness of contact investigation and tracing efforts.
To enhance the reliability of the data collected during these interviews, various technologies and methods
can be utilized.
— Location-based tracking:
Location information, such as Wi-Fi or satellite-based positioning systems, can be employed to track
and verify the patient's route. By analysing location data, it becomes possible to identify specific places
visited by the patient and trace their movement. This helps validate the information provided during
the interview and ensures the accuracy of contact tracing efforts.
— Digital payment transaction logs:
Digital payment transaction logs, including credit card transactions and mobile payments, can serve
as valuable sources of information for contact tracing. These logs provide a record of the places where
the patient made transactions, offering additional insights into their movement and potential contacts.
Analysing these transaction logs can help identify relevant locations and individuals who could have
come into contact with the patient.
— Digital customer register using QR codes:
Digital customer registers that utilize QR codes can streamline the contact tracing process. Customers
can scan QR codes displayed at establishments they visit, providing their contact information. This
allows for efficient identification of potential contacts if a confirmed case is later detected. The digital
nature of this register reduces the reliance on manual data entry and enhances the speed and accuracy
of contact tracing efforts.
— Proximity networking: ®
Proximity networking for exposure notification involves the use of Bluetooth technology to detect and
notify individuals who have been in close proximity to someone later diagnosed with a highly contagious
respiratory infectious disease. It is often employed in mobile applications designed for contact tracing
and exposure notification. This technology helps identify potential contacts, even if the patient did not
disclose those encounters during the interview.
— Closed-circuit television (CCTV):
CCTV footage from surveillance cameras can be utilized as a supplementary tool for contact tracing. By
reviewing the footage, it becomes possible to identify the patient's presence in specific locations and
identify potential contacts. CCTV can provide visual evidence to validate or complement the information
gathered through interviews or other methods.
This document specifies contact tracing using location-based information, digital payment transaction logs,
digital customer register using QR codes and exposure notification.
6 Contact tracing
6.1 General
Figure 1 shows a conventional contact tracing workflow.
Figure 1 — Conventional contact tracing workflow
Based on the interview with a patient, people (contacts) who could have been exposed to the patient are
triaged for assignment. Contacts are notified of the possibility of exposure and are guided to be under self-
quarantine or tested if available. However, this workflow can have a flaw caused by a patient as stated in
Clause 5.
Figure 2 gives a stepwise approach that compensates for the flaws of information technologies. This
document specifies a method/tool using information technologies such as location information (Wi-Fi,
satellite-based positioning systems), digital payment transaction (e.g. credit card transaction and mobile ®
payment), digital customer register (QR codes) and proximity networking (Bluetooth ).
Figure 2 — Stepwise approach in contact tracing and monitoring
The initiation of real-time contact tracing should take into account the characteristics of highly contagious
respiratory infectious diseases, particularly the transmission speed, incubation period, and public health
risk level.
6.2 Location information technologies
6.2.1 General
Location information is used to identify the route of the patient to verify the consistency of the patient
claims and additionally check the previous routes. Location information can be used to select the scope of
contact investigation and monitor detailed route within a location.
For example, if a patient visits a specific store, all individuals who entered that store can be identified, and
their contact and health status can be monitored. This information can be used to identify and take actions
regarding the health status of other individuals who have come into contact with the patient.
6.2.2 Wi-Fi communication
6.2.2.1 Descriptions and general procedures
Wi-Fi technology is a widely used communication tool that has proven to be very effective in contact tracing,
especially in indoor environments such as multi-story buildings, airports, alleys and parking garages. The
high accuracy of Wi-Fi-based location information makes it an ideal choice for tracking individuals in such
settings, especially when satellite-based navigation systems are not as effective.
One of the most significant advantages of using Wi-Fi for contact tracing is its ability to accurately locate
individuals in crowded indoor environments during a pandemic. This can be especially useful in areas such
as railway platforms and airports, where large numbers of people congregate, and accurate tracking of their
movements is essential for controlling the spread of disease.
Moreover, Wi-Fi technology is highly versatile and can be easily integrated with various types of devices,
including smartphones, wearables and tracking tags. This allows for a wide range of applications, from
contact tracing of individuals to monitoring the movement of goods and equipment in a warehouse or other
commercial settings.
General procedures for contact tracing using Wi-Fi are as follows:
a) Wi-Fi access point (AP) deployment:
The first step in implementing Wi-Fi-based contact tracing is to deploy Wi-Fi APs in the environment.
The APs should be placed at strategic locations throughout the environment to ensure adequate coverage
and accuracy. The deployment should be carefully planned to ensure that the APs are distributed evenly
and optimized for accurate location tracking.
b) Wi-Fi location tracking:
Once the APs are deployed, a location tracking system should be implemented to track individuals'
movements in real-time. The system should be able to estimate the location of a device or tag accurately,
even in complex environments such as multi-story buildings and crowded spaces.
c) Wi-Fi enabled devices:
Individuals who wish to participate in contact tracing must have a Wi-Fi-enabled device, such as a
smartphone or wearable, with Wi-Fi turned on. The device should be configured to connect to the Wi-Fi
network automatically, and the location tracking application should be installed on the device.
d) Data collection and storage:
As individuals move throughout the environment, their location information is collected and stored
securely in a database. The database should be designed to store location data efficiently, and data
should be deleted once it is no longer needed.
e) Contact identification:
If an individual is diagnosed with a highly contagious respiratory infectious disease, the location data
can be used to identify other individuals who may have been in close proximity to the infected person.
The location data can be cross-referenced with the infected person's movements to identify potential
contacts.
f) Alert and notification:
Once potential contacts are identified, an alert and notification system should be used to notify them of
their potential exposure. The system should provide clear instructions on what actions to take, such as
self-isolation and getting tested for highly contagious respiratory infectious diseases.
6.2.2.2 Requirements
Table 2 shows technical requirements for contact tracing using Wi-Fi.
Table 2 — Requirements for contact tracing using Wi-Fi-communication
Target component Requirement description
Wi-Fi access points (APs) The APs shall be distributed throughout the environment to ensure adequate
coverage and accuracy. The APs shall also support real-time location tracking
with high accuracy and low latency.
Wi-Fi location tracking system A reliable and accurate location tracking system should be used to track individ-
uals' movements in real-time accurately. The system shall be able to estimate
the location of a device or tag with high accuracy, even in complex environments
such as multi-story buildings and crowded spaces.
Real-time contact tracing depends on disease transmission characteristics
(see 6.1).
Wi-Fi enabled devices Devices that are capable of connecting to Wi-Fi networks, such as smartphones
and wearables, shall enable contact tracing. These devices shall support Wi-
Fi-based location tracking and shall communicate with the Wi-Fi network to
transmit location information.
Data storage and management A robust data storage and management system shall store and manage the
location data collected from the Wi-Fi network. This system shall provide
secure storage, efficient retrieval, and easy integration with other contact
tracing systems.
Alert and notification system An alert and notification system shall be implemented to inform individuals
who could have been exposed to a patient. This system shall be timely, reliable,
and provide clear instructions on how to take appropriate actions.
Privacy protection Personal information collected through contact tracing shall be anonymized
and stored securely to protect the privacy of individuals. See Clause 7 for pri-
vacy protection guidance.
6.2.3 Satellite-based positioning system
6.2.3.1 Descriptions and general procedures
Contact tracing using a satellite-based positioning system, such as GPS, Galileo and Beidou, involves utilizing
the satellite-based positioning system available on mobile devices to track individuals' movements and
identify potential contacts. Satellite-based positioning system provides precise location information by
receiving signals from satellites, enabling accurate tracking and tracing capabilities for contact tracing
efforts.
General procedures for contact tracing using satellite-based positioning system are as follows.
a) Data collection:
The first step in contact tracing using satellite-based positioning system is to collect positioning data
from individuals' mobile devices. This requires individuals' mobile devices to utilize satellite-based
positioning functionality.
b) Location tracking:
Once positioning data are collected, it is used to track individuals' movements in real-time. The satellite-
based positioning system technology continuously updates the device's location, allowing for accurate
and up-to-date information on an individual's whereabouts.
c) Contact identification:
If an individual is diagnosed with a highly contagious respiratory infectious disease, their positioning
data can be analysed to identify other individuals who could have come into close proximity or shared
locations during a specific period. This involves analysing the positioning data to determine potential
contacts based on time, distance and duration of exposure.
d) Notification and alert:
Once potential contacts are identified, an alert a
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...