Risk-scoring algorithm Technical information
Last updated: 29 October 2020
This paper summarises how the NHS COVID-19 app will calculate a risk score for an individual based on their recent contact with people who test positive for Coronavirus.
The NHS COVID-19 app uses Bluetooth Low Energy to assess the distance over time between people who have downloaded the app in a privacy preserving manner.
If a person tests positive for Coronavirus and agrees to share their app data, this algorithm calculates the risk to every app user they came into contact with in the previous few days.
This data is presented to the algorithm via V1.6 of Google's and V2.0 of Apple's Application Programming Interface (API). For simplicity, we refer to this as “API Mode 2”.
This risk is only calculated for potentially affected users if a person tests positive for Coronavirus and agrees to share their app data. If a user has not been in Bluetooth range of a user that subsequently tests positive, then no calculations are performed.
Risk score calculation
The app uses Bluetooth signal strength between devices to estimate the distance between two people.
Signal strength between two close devices is measured every 3.6 minutes (on average).
Signal strength depends on a number of external factors, such as where the phone is on the body and the surrounding environment.
While a Bluetooth signal continues to be detected between two devices (an encounter), API Mode 2 gathers signal strength measurements that are transmitted by another user’s device approximately 4 seconds every 3.6 minutes (on average).
A range of sample measurements relating to the signal strength are gathered by the API and used together to estimate of distance. Sets of measurements within an encounter are shuffled to ensure anonymity and then assessed together to build an estimate of the distance between the two devices during this period.
For each encounter, a score is calculated as follows:
- Estimated within 1m of the other device: total time spent within 1m
- Estimated 1m or beyond from the other device: sum of [total time at each distance / distance squared]
These scores are summed across the interactions someone has had in a single day with the contact who has tested positive. The app does not look at interactions across multiple days as it uses new anonymous IDs every day in order to protect the privacy of users.
Finally, the total score is multiplied by a factor recognising infectiousness (of the individual testing positive) on the day of the encounter.
Risk threshold and notifications
When someone develops symptoms related to Coronavirus, they are asked when these symptoms first appeared and asked to request a test through the app. If they test positive, they are asked whether the app can notify other app users they may have passed the virus on to.
The algorithm uses the date of symptom onset to calculate who they are most likely to have infected. The algorithm looks at the daily risk for every app user who they came into contact with from 2 days before symptoms first appeared, up to a maximum of 10 days after symptoms first appeared.
If an app user’s risk score on any of these days crosses the risk threshold it is identified as high-risk and they will be notified and directed to further guidance.
For the purposes of contact tracing, a high-risk encounter is classed as one where an individual has been within 2 metres of someone who has tested positive for Coronavirus for at least 15 minutes. The risk threshold for the app has been set to identify high-risk encounters based on this principle along with infectiousness (of the individual testing positive) on the day of the encounter; balancing the need to slow the rate of infection by identifying high-risk encounters whilst mitigating the risk that those at lower risk may be notified to self-isolate.
This threshold can be changed as the app is updated, more data is available about the transmission rate of the virus, or due to behavioural factors.
Changes to this algorithm
This document describes the implementation of the algorithm using API Mode 2.
Changes to this algorithm, either to change the relationship between these parameters, or include new ones, will be published.
The risk threshold and related guidance may change as we adapt to information about the transmission rate of the virus, changes to other lockdown measures, data on the uptake of the app, and how likely app users are to follow the guidance.