Contact Tracing for Air Travel: CDC's Data System Needs Substantial Improvement
Fast Facts
The U.S. Centers for Disease Control and Prevention collects information on air passengers to help local public health authorities trace the potential spread of communicable diseases (e.g., COVID-19).
But some of the ways in which CDC collects and manages passengers' information make it harder to effectively facilitate contact tracing. For example, the outdated data management system CDC uses doesn't allow it to connect related cases or easily report the number of passengers exposed to a single infected person on a flight.
We recommended ways to improve CDC's air passenger data system.
Highlights
What GAO Found
The Centers for Disease Control and Prevention (CDC) plays a key role in contact tracing for air travel—the process of identifying and notifying passengers who may have come into contact with a person infected with a communicable disease during a flight. However, several factors affect CDC's ability to collect timely, accurate, and complete air passenger information to support contact tracing by local public health authorities. For example, airlines may not have accurate and complete information about passengers to share with CDC because the contact information provided to book a ticket may be for a third party, like a travel agent, not for passengers. Further, because no single, complete, and reliable source of passenger information exists, CDC often conducts research to fill in gaps, extending the time it takes to share information with local public health authorities.
Overview of Process for Collecting Air Passengers' Contact Information
Since the start of the COVID-19 pandemic, CDC has taken some actions to improve the quality of information it collects. For example, since November 2021, CDC has required airlines to collect certain information—including name, phone number, email, and physical address—no more than 72 hours before departure from passengers traveling on flights into the United States and to transmit the information to CDC in a defined format.
However, limitations in how CDC collects and manages air passengers' contact information—including CDC's use of an outdated data management system—hinder the agency's ability to monitor public health risks and facilitate contact tracing. The data management system—developed in the mid-2000s—was not designed for rapid assessment or aggregation of public health data across individual cases. For example, CDC is unable to quickly and accurately identify the number of passengers exposed to a specific infected passenger on a flight. Nor does the system contain the necessary data fields to assess the quality of air passenger information CDC receives, such as a field to determine the timeliness of airlines' responses to CDC's request. Consequently, CDC is not positioned to efficiently analyze and disseminate data to inform public health policies and respond to disease threats. Nor is it positioned to evaluate its performance in collecting and sharing quality passenger information.
Why GAO Did This Study
The COVID-19 pandemic has underscored the importance of public health measures aimed at controlling the transmission of communicable diseases. Air travel can play a role in quickly spreading communicable diseases across the world and throughout communities. Given this potential, contact tracing for air passengers is an important measure for protecting public health.
GAO was asked to examine CDC's process for collecting and managing air passengers' contact information to facilitate contact tracing. This report addresses: (1) the factors that affect CDC's ability to collect this information, (2) recent actions CDC has taken to improve the quality of the information it collects, and (3) how effectively it collects and manages this information.
GAO reviewed relevant federal documentation, including regulations, orders, technical guidance, and public comments, as well as available CDC data. GAO also interviewed officials from CDC, U.S. Customs and Border Protection, and the Federal Aviation Administration, and selected representatives from the aviation, travel, and public health industries.
Recommendations
GAO is making three recommendations, including that CDC redesign its data management system for air passenger information or deploy a new one. CDC concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Disease Control and Prevention | The Director of CDC should implement controls for the entry of data into its Quarantine Activity Reporting System (QARS), including by providing adequate training and standard operating procedures that are documented and institutionalized for system users and by conducting consistent validation checks. (Recommendation 1) |
The CDC concurred with GAO's recommendation. In March 2026, GAO confirmed that CDC had taken steps to implement controls for the entry of data into its Port Health Activity Reporting System (PHARS), which has replaced the Quarantine Activity Reporting System (QARS). Specifically, GAO confirmed that CDC had taken steps to update the standard operating procedures and operations manual for PHARS. GAO reviewed draft copies of two new operations manual chapters, which provide detailed information on how the PHARS website works. This includes instructions on data entry and access to the system, as well as instructions on system functionality and reporting. Although still in draft status, these new chapters provide documentation that CDC is taking steps to standardize the entry of data in PHARS. Further, in addition to reviewing the new operations manual, GAO confirmed that CDC is institutionalizing data entry controls by including data quality responsibilities in the job description of key staff supporting the effort. While these are positive steps, further action is needed to fully institutionalize these data controls, including finalizing the PHARS operations manual. GAO will continue to monitor CDC's efforts to implement this recommendation.
|
| Centers for Disease Control and Prevention | The Director of CDC should assess additional opportunities to improve the quality of air passenger information it collects and manages— including opportunities to increase automation by adopting or establishing data exchange standards—and take action, as appropriate, based on this assessment. (Recommendation 2) |
The CDC concurred with GAO's recommendation. In March 2026, GAO confirmed that CDC has made improvements to incorporating automated traveler data exchange between CDC and state, local, and territorial health departments. Specifically, as part of a broader agency-wide initiative Epidemic Information Exchange (Epi-X) notifications of air travel contacts to State, Local, and Territorial Health Departments are now sent through One CDC Data Platform (1CDP), replacing an older communication system. GAO reviewed a March 2026 Epi-X Report Summary email notification detailing passengers that may have been exposed to Measles on a flight from Abu Dhabi Internation Airport in the United Arab Emirates to John F. Kennedy International Airport in New York. Further, according to CDC officials, an automated data feed from FlightAware automatically populates certain data fields, including flight number, origin, destination, connections and flight duration. While these are positive steps, further documentation is needed to verify these efforts. GAO will continue to monitor CDC's efforts to implement this recommendation.
|
| Centers for Disease Control and Prevention | The Director of CDC should re-design QARS or deploy a new data system that would allow CDC to more effectively facilitate contact tracing for air passengers and conduct disease surveillance for air travel. (Recommendation 3) |
The CDC concurred with GAO's recommendation. In March 2026, GAO confirmed that CDC had taken steps to redesign a new data system that would allow CDC to more effectively facilitate contract tracing for air passengers and conduct disease surveillance. GAO reviewed a summary of the requirements for all the Quarantine Activity Reporting System (QARS) functionality that needs to be migrated to the Port Health Activity Reporting System (PHARS). According to CDC, these requirements must be met by the contractor or developer to meet data quality control measures. According to the summary GAO reviewed, only the Active Surveillance module has partially migrated to PHARS. The other four modules have not undergone any migration. The summary GAO reviewed includes summaries of each of the modules, with a description of the features, workflow, and functionality. While progress has been made, further action is needed to complete the re-design of the PHARS system or begin deployment. GAO will continue to monitor CDC's efforts to implement this recommendation.
|