Creating an Automated Health Attestation System During the COVID-19 Pandemic with Microsoft 365

Abstract

Identifying and isolating individuals infected with COVID-19 are critical steps in stopping the spread of the coronavirus. Until widespread testing and contact tracing systems are implemented, alternative methods must be considered. One way that organizations can protect employees and clients is by creating their own automated health attestation systems. These systems could be used to reduce the spread of the coronavirus by asking providers and consumers to self-identify COVID-19 exposure, as well as to help mitigate liability for organizations by asking providers and consumers to agree to follow relevant policies and acknowledge the risks inherent in providing or receiving services. The purpose of this article is to outline the steps for creating this type of health attestation system using Microsoft Office 365.

In the United States, the COVID-19 pandemic has disrupted every facet of society (Abrams & Szefler, 2020). It has resulted in state and local governments closing nonessential businesses, schools implementing distance education or prematurely closing, employers furloughing and laying off millions of employees, and health care agencies dramatically changing procedures and services. For citizens in need of mental/behavioral health and social services, the health crisis has interrupted care in numerous ways (Torales, O’Higgins, Castaldelli-Maia, & Ventriglio, 2020).

As state and local governments begin to relax social-distancing restrictions (Lewnard & Lo, 2020) and precautions to prevent the spread of COVID-19 become the new normal, organizations are faced with a fresh set of challenges. Unfortunately, countries that have experienced an outbreak prior to the United States and have since relaxed social-distancing requirements are bracing for an uptick in cases, and the earliest a vaccine is estimated to be ready for mass distribution is 12 to 18 months (Sanger, Haberman, & Weiland, 2020). Scientists refer to this anticipated increase as the “second wave,” and the same pattern is expected to occur in the United States (Xu & Li, 2020). To make matters worse, the second wave is expected to occur in conjunction with the annual flu season. Undeniably, this new reality has serious ethical and legal implications for health care providers and consumers (Colombo, Wallace, & Taylor, 2020; Coyne et al., 2020; Persad & Emanuel, 2020; Szabo, Richling, Embry, Biglan, & Wilson, 2020).

Professionals employed by mental/behavioral health and social service organizations must abide by their respective code of ethics (American Medical Association Council on Ethical and Judicial Affairs, 2020; American Occupational Therapy Association, 2015; American Psychological Association, 2010; American Speech-Language-Hearing Association, 2020; Behavior Analyst Certification Board, 2019; National Association of Social Workers, 2020). Although specific language varies, essentially, each profession’s code makes clear the ethical responsibility to promote clients’ well-being and to do no harm (Smith, 2013). Legally, professionals and organizations can be held liable for providing service (Cash, 2015; Hurford, 2020), providing initial and ongoing assessment to guide treatment, implementing treatment plan objectives, and training direct support staff.

The question, then, is, how can organizations maximize safety and mitigate legal concerns as workers and clients resume in-person services in office, home, and community settings (Cox, Plavnick, & Brodhead, 2020)? Leading organizations provide general guidelines. The World Health Organization recommends that organizational leadership regularly communicate with employees about COVID-19 safety, ensure that those who are sick/symptomatic are immediately isolated and/or stay home, and reassure employees that they will receive paid sick leave (World Health Organization, 2020). For health care professionals, the Centers for Disease Control and Prevention suggests screening for fever and symptoms prior to every shift (Centers for Disease Control and Prevention, 2020); however, the details required for the practical implementation of these guidelines across professions, clients, and treatment locations are lacking.

To address the urgent need to protect employees and clients during an ongoing pandemic, the following tutorial provides the steps necessary to develop a COVID-19 health attestation system using Microsoft Office 365. This is accomplished by providing a step-by-step guide for (a) creating and sharing a health attestation form using Microsoft Forms, (b) generating automatic email reminders for staff and patients to complete the form using Microsoft Power Automate, and (c) setting up email notifications that warn administrators about possible exposure to COVID-19 or the refusal to acknowledge the policies and risks involved in providing or receiving services.

The language provided in the sample forms used throughout the tutorial does not constitute legal advice. Additionally, the sample language provided may require revision as new information about the virus becomes available. Before establishing a COVID-19 health attestation system, organizations should consult with their attorneys on the language that should be included and ensure the system is in compliance with all applicable laws (Health Insurance Portability and Accountability Act of 1996; Family Educational Rights and Privacy Act of 1974; U.S. Department of Health and Human Services, 2020; U.S. Department of Education, 2020). This tutorial assumes all necessary access and permissions have been granted to the Microsoft Forms and Microsoft Power Automate applications within Microsoft Office 365. Finally, the tutorial only describes how to set up a health attestation system; it does not describe or provide guidance on the policies an organization should adopt when the system is used.

Creating a Health Attestation Form

What follows are the steps for creating a COVID-19 health attestation form using Microsoft Forms. The sample text provided should be modified to fit the organization’s specific needs.

• 1. Direct your browser to the https://login.microsoftonline.com website.

• 2. If not already logged in, log in with your Microsoft username and password credentials.

• 3. Type “Forms” in the search box.

• 4. Click the “Forms” option under the “Apps” header.

• 5. Click the “New Form” option.

• 6. Click the “Untitled Form” text.

• 7. Type a relevant title and description.

• 8. Click the “Add new” button.

• 9. Click the “Choice” button.

• 10. In the text box with the “Question” placeholder text, type in “Health Assessment.”

• 11. In the text box with the “Option 1” placeholder text, type in “I hereby acknowledge that within the last 14 days, I and the people I remain in close physical contact with have not knowingly been within 6 feet of someone who has a laboratory-confirmed COVID-19 diagnosis OR experienced a fever, cough, difficulty breathing, chills, muscle pain, headaches, sore throat, and/or new loss of taste or smell.”

• 12. Hover the mouse over the “Option 2” text box and click the trash can icon so only one option is available.

• 13. Click the “Multiple answers” slider button to create checkboxes.

• 14. Click the “Add new” button.

• 15. Click the “Choice” button.

• 16. In the text box with the “Question” placeholder text, type in “Compliance Acknowledgment.”

• 17. In the text box with the “Option 1” placeholder text, type in “I hereby acknowledge my compliance with the policies and procedures of the organization as the same may be updated from time to time, including those related specifically addressing the coronavirus (COVID-19) and the prevention thereof.”

• 18. Hover the mouse over the “Option 2” text box and click the trash can icon so only one option is available.

• 19. Click the “Multiple answers” slider button to create checkboxes.

• 20. Click the “Add new” button.

• 21. Click the “Choice” button.

• 22. In the text box with the “Question” placeholder text, type in “Risk Acknowledgment.”

• 23. In the text box with the “Option 1” placeholder text, type in “I acknowledge that people with certain conditions are recognized by the Centers for Disease Control (CDC) as being at a higher risk for COVID-19. To the extent any of these conditions apply to me, I agree to take all appropriate extra precautions including any such precautions advised by my licensed physician.”

• 24. Hover the mouse over the “Option 2” text box and click the trash can icon so only one option is available.

• 25. Click the “Multiple answers” slider button to create checkboxes.

• 26. Click the “Add new” button.

• 27. Click the “Text” button.

• 28. In the text box with the “Question” placeholder text, type in “Health Attestation.”

• 29. Click the “Required” slider button to force a response.

• 30. Click “···” located next to the “Required” slider button.

• 31. Click the “Subtitle” option.

• 32. In the text box with the “Enter a subtitle” placeholder text, type in “By submitting this form, I hereby represent and warrant that (a) all information I provided herein is accurate and true as of the date hereof, (b) I completed this attestation at the request of the organization, and (c) my full name is:”

• 33. Click “···” located in the top-right corner of the screen.

• 34. Click the “Settings” option.

• 35. Click in the checkbox next to the “Customize thank you message” label located under the “Options for Responses” header.

• 36. In the text box with the “Your response was submitted” placeholder text, type in “Thank you for your response. If you did not check ALL of the boxes on the form, then you must check in with your organizational representative BEFORE delivering or receiving services.”

• 37. Click the “Preview” button located at the top of the screen and complete a test submission of the form (Fig. 1).

Fig. 1

Screenshot showing a sample COVID-19 health attestation form in Microsoft Forms

As new questions are added, the form automatically saves. Whenever the form is submitted, a time-stamped entry is recorded documenting the responses provided. It should be possible for an individual to submit the form using any device with a browser and Internet connection (e.g., mobile devices, laptops, desktops).

Sharing a Health Attestation Form

What follows are the steps for sharing a health attestation form created in Microsoft Forms. Caution is recommended when sharing administrative access, as it allows others to view and edit form settings and submission data.

• 1. Direct your browser to https://login.microsoftonline.com.

• 2. Log in with your Microsoft username and password credentials.

• 3. Type “Forms” in the search box.

• 4. Click the “Forms” option under the “Apps” header.

• 5. Click the name of the form created previously.

• 6. Click the “Share” button located in the top-right corner of the screen to share the form with individuals within or outside the organization (e.g., caregivers).

• a. Click the “Only people in my organization can respond” link. Under this setting, users must be logged in to their organizational Microsoft account to access and submit the form. This setting also allows the form to automatically collect the names and email addresses of anyone submitting the form.

• b. Click the “Anyone with the link can respond” option. Under this setting, the form is publicly accessible, and anyone with the link can access and submit it. The form does not automatically collect the names and email addresses of anyone submitting the form. However, questions can be added to the form.

• 7. Click the “Copy” button under the “Send and collect responses” heading.

• 8. Paste the link in an email and send it to all relevant parties.

• a. Optional: BCC all email addresses to help ensure privacy.

• b. Optional: Encourage all parties who are sent the link to bookmark the form’s web address for easy access in the future.

• c. Optional: Share the link using a reminder email automatically sent via Microsoft Power Automate (see later instructions).

• 9. Share administrative access to the form with others.

• a. Click the “Share” button on the form edit page.

• b. Click the “+ Get a link to view and edit” under the “Share to collaborate” heading.

• c. Click the “Users with an Office 365 work or school account . . .” link.

• d. Click the relevant option for the organization.

• e. Click the “Copy” button under the “Share to collaborate” heading.

• f. Paste the link in an email to share administrative access to the form.

Accessing Submitted Health Attestation Forms

What follows are the steps for accessing health attestation form submissions within Microsoft Forms. Submission data downloaded as a Microsoft Excel file can be filtered using the drop-down arrows in the table headers. For example, within the downloaded Excel file, the data table could be arranged to show only the attestation submissions from a specific person, or all submissions made on a particular date.

• 1. Direct your browser to https://login.microsoftonline.com.

• 2. Log in with your Microsoft username and password credentials.

• 3. Type “Forms” in the search box.

• 4. Click the “Forms” option under the “Apps” header.

• 5. Click the health attestation form created earlier.

• a. Colleagues can access shared forms by clicking the “Shared with me” link located at the top of their Microsoft Forms account page.

• 6. Click the “Responses” tab at the top of the screen.

• 7. Click the “Open in Excel” link.

• 8. Open the downloaded Excel file to view submissions.

Sending Automated Reminder Emails

What follows are the steps for creating an automated email reminder system using Microsoft Power Automate. To ensure compliance with privacy laws, special attention should be paid when entering patient email addresses. These addresses should be entered in the “BCC” section of the email message and not the “To” section. This helps prevent sharing contact information with everyone receiving the reminder message. Importantly, using “BCC” is often not enough to satisfy privacy law requirements unless the transmission of the data is also encrypted. Fortunately, at the time of writing, it appears Microsoft Office 365 uses Transport Layer Security to encrypt the connection between two servers. Organizations should speak with their compliance and information technology officers before implementing this feature to ensure they are not in violation of applicable privacy laws.

• 1. Direct your browser to https://login.microsoftonline.com.

• 2. Log in with your Microsoft username and password credentials.

• 3. Type “Power Automate” in the search box.

• 4. Click the “Power Automate” option under the “Apps” header.

• 5. Click the “Create” option in the menu bar located on the left side of the screen.

• a. For new users, click “Choose your region” and select your region.

• b. Click “Get started.”

• 6. Click the “Scheduled flow” button.

• 7. Type in a name for the flow under the “Flow Name” label.

• 8. Select a date and time when the reminder email should be sent out under the “Run this flow” label.

• 9. Change the settings so the flow is repeated once every week.

• 10. Select the days the reminder email should be sent out.

• 11. Click the “Create” button.

• 12. Click the “New step” button.

• 13. Type in “Send an email” in the text box located under the “Choose an action” header.

• 14. Click the “Send an email (V2)” option next to the Office 365 Outlook icon.

• 15. Click the text box next to the “To:” label.

• 16. Type in an administrator’s email address.

• 17. Click the text box next to the “Subject” label.

• 18. Type a subject line for the email notification.

• 19. Click the text box next to the “body” label.

• 20. Type the text for the body of the email. Include a link to the health attestation form created earlier.

• 21. Click the “Show advanced options” link located underneath the body of the email.

• 22. Click the text box next to the “BCC” label.

• 23. Type in the email address(es) for anyone who should receive an email reminder to fill out the attestation form. Separate multiple email addresses with a semicolon.

• 24. Click the “Save” button located at the bottom of the screen (Fig. 2).

Fig. 2

Screenshot showing a recurring email reminder flow in Microsoft Power Automate

Receiving Notifications When Health Attestation Forms Are Submitted

There are two ways to receive notifications when forms are submitted in Microsoft Forms. The first way involves setting email notifications anytime a form is submitted. This method is easy to set up but has the potential to overwhelm an email inbox and therefore delay action when respondents indicate that they may have been exposed to COVID-19 on the form or refuse to acknowledge the policies and risks involved in providing or receiving services.

• 1. Direct your browser to https://login.microsoftonline.com.

• 2. Log in with your Microsoft username and password credentials.

• 3. Type “Forms” in the search box.

• 4. Click the “Forms” option under the “Apps” header.

• 5. Click the health attestation form created earlier.

• 6. Click “···” located in the top-right corner of the screen.

• 7. Click the “Settings” option.

• 8. Click the “Get email notification of each response” checkbox.

The second way to set up email notifications involves creating a workflow using Microsoft Power Automate. With this method, all submissions continue to be recorded in Microsoft Forms. However, administrators only receive email notifications when respondents attest that they may have been exposed to COVID-19 or if they refuse to acknowledge the policies and risks involved in providing or receiving services.

• 1. Direct your browser to https://login.microsoftonline.com.

• 2. Log in with your Microsoft username and password credentials.

• 3. Type “Power Automate” in the search box.

• 4. Click the “Power Automate” option under the “Apps” header.

• 5. Click the “Create” option in the menu bar located on the left side of the screen.

• 6. Click the “Automated flow” button.

• 7. Type in a name for the flow under the “Flow name” label.

• 8. Type in the “Type “When a new response is submitted” under the “Choose your flow’s trigger” label.

• 9. Click the circle next to the “When a new response is submitted” option next to the Microsoft Forms icon.

• 10. Click the “Create” button.

• 11. Select the name of the form created earlier under the “Form Id” label located in the “When a new response is submitted” box.

• 12. Click the “+ New step” button.

• 13. Type “Get response details” under the “Choose an action” header.

• 14. Click the “Get response details” option next to the Microsoft Forms icon.

• 15. Select the name of the form created earlier under the “Form Id” label located in the “Get response details” box.

• 16. Click inside the “Response Id” text box.

• 17. Click the “Add dynamic content” link located under the “Response Id” text box.

• 18. Click the “List of response notifications Response Id” option to populate the text box.

• 19. Click the “New step” button.

• 20. Click the “Control” icon.

• 21. Click the “Condition” icon.

• 22. Click the “Choose a value” text box located in the “Condition” box.

• 23. Click the “Add dynamic content” link.

• 24. Select the “Health Assessment” variable from the question created earlier.

• 25. Click the “is equal to” drop-down box.

• 26. Select the “contains” option.

• 27. Select the last “Choose a value” text box located to the right of the “contains” drop-down box.

• 28. Type the following into the text box: “I hereby acknowledge that within the last 14 days, I and the people I remain in close physical contact with have not knowingly been within 6 feet of someone who has a laboratory-confirmed COVID-19 diagnosis OR experienced a fever, cough, difficulty breathing, chills, muscle pain, headaches, sore throat, and/or new loss of taste or smell.”

• a. The text entered here should match the answer option provided for the Health Assessment question.

• 29. Click the “+ Add” button.

• 30. Click the “Add row” option.

• 31. Click the “Choose a value” text box located in the “Condition” box.

• 32. Click the “Add dynamic content” link.

• 33. Select the “Compliance Acknowledgment” variable from the question created earlier.

• 34. Click the “is equal to” drop-down box.

• 35. Select the “contains” option.

• 36. Select the last “Choose a value” text box located to the right of the “contains” drop-down box.

• 37. Type the following into the text box: “I hereby acknowledge my compliance with the policies and procedures of the organization as the same may be updated from time to time, including those related specifically addressing the coronavirus (COVID-19) and the prevention thereof.”

• a. The text entered here should match the answer option provided for the Compliance Acknowledgment question.

• 38. From the Microsoft Form created earlier, copy and paste the answer option that responders are expected to select for the Compliance Acknowledgment question.

• 39. Click the “+ Add” button.

• 40. Click the “Add row” option.

• 41. Click the “Choose a value” text box located in the “Condition” box.

• 42. Click the “Add dynamic content” link.

• 43. Select the “Risk Acknowledgment” variable from the question created earlier.

• 44. Click on the “is equal to” drop-down box.

• 45. Select the “contains” option.

• 46. Select the last “Choose a value” text box located to the right of the “contains” drop-down box.

• 47. Type the following into the text box: “I acknowledge that people with certain conditions are recognized by the Centers for Disease Control (CDC) as being at a higher risk for COVID-19. To the extent any of these conditions apply to me, I agree to take all appropriate extra precautions including any such precautions advised by my licensed physician” (Fig. 3).

• a. The text entered here should match the answer option provided for the Risk Acknowledgment question.

• 48. In the “No” box, click the “Add an action” link.

• 49. Type in “Send an email” in the text box located under the “Choose an action” header.

• 50. Click the “Send an email (V2)” option next to the Office 365 Outlook icon.

• 51. Click the text box next to the “To:” label.

• 52. Type in the email address(es) for anyone who should receive the email notification if the form submission indicates exposure to COVID-19 or refusal to acknowledge the policies and risks involved in providing or receiving services.

• 53. Click the text box next to the “Subject” label.

• 54. Type a subject line for the email notification. Variables can be added to the subject line using the “Add dynamic content” link.

• 55. Click the text box next to the “body” label.

• 56. Type the text for the body of the email. Variables can be added to the body of the email using the “Add dynamic content” link (Fig. 4).

• 57. Click the “Show advanced options” link located underneath the body of the email.

• 58. Click the text box located under the “Importance” label.

• 59. Select the “High” option.

• 60. Click the “Save” button located at the bottom of the screen.

Fig. 3

Screenshot showing the conditions that trigger an automated email notification in Microsoft Power Automate

Fig. 4

Screenshot showing a sample email notification with form variables in Microsoft Power Automate

After the workflow is created, the settings can be tested by submitting the form so that it triggers the email notification (Fig. 5) and submitting the form again so that it does not trigger the email notification.

Fig. 5

Screenshot showing a sample email sent by Microsoft Power Automate when conditions are triggered. The email notification was triggered because the respondent (Jane Smith) did not acknowledge the compliance statement in the COVID-19 health attestation form

The steps described previously are designed to handle a basic workflow in Microsoft Power Automate; however, these instructions could be adapted to accommodate more advanced workflows. For example, separate email notifications could be sent depending on the answers provided in the form submission. Additionally, a flow could be developed to automatically insert form entries into a table located in an online Microsoft Excel file for further refinement and analysis.

Discussion

The objective of this tutorial was to provide an application of technology to address the unique challenges that accompany service provision in the wake of the COVID-19 pandemic. This procedure offers an immediate, low-cost option that could help protect organizations, their employees, and the clients they serve. The use of an electronic health attestation system addresses many of the concerns that accompany providing health care services during a pandemic. First, by using an electronic interface to collect health attestation information, organizations are able to minimize the risk of in-person data collection and maximize data collection prior to service provision. This enables organizations to enhance preventative measures and intervene prior to any potential exposure. Additionally, this tool may be a powerful method for mitigating legal risk for organizations. Mandating health attestations prior to service delivery allows organizations to have a record of clients and employees agreeing to abide by the organization’s policies and acknowledging their understanding of the risks involved in providing or receiving services during the pandemic. In combination with good organizational policies, these acknowledgments could help mitigate potential liability regarding workplace or service exposure to COVID-19.

Despite the potential of this system, some limitations must be noted. First, technology access and literacy may be a barrier to the completion of health attestation documentation. Because responding to these electronic documents requires an Internet connection and electronic device, organizations would need to ensure that all employees and clients could complete attestations. Second, training on how to complete attestations may be required. Although most organizations could likely create training opportunities for staff, training clients remotely depends highly on their email and technology literacy. Third, the system presented does not offer a complete scope of functionality. For example, service providers only receive a notification if an attestation is completed. However, it does not present a way to show who has yet to fill out the attestation form. This functionality is possible by connecting form submissions to Microsoft Excel Online using Power Automate, but the setup is more complicated and beyond the scope of this article. Finally, and probably most importantly, the self-attestations submitted may not be accurate. There is nothing to prevent employees or clients from falsely attesting that they have not been exposed to COVID-19. Employees may fear losing income and clients may fear losing services if they indicate exposure. Organizations should be mindful of this risk when they develop their policies and procedures around self-attestations.

Other software alternatives for creating automated health attestation systems may be available for organizations that do not have a Microsoft Office subscription. For example, it should be possible to create such a system using Google’s G Suite. Three applications included within G Suite—Google Forms, Gmail, and Apps Script—offer similar functionality to Microsoft Forms, Outlook, and Power Automate, respectively, and could likely be adapted for a similar purpose. Likewise, an organization could also attempt to host health attestation forms on a website using an open-source content management system (e.g., Drupal). This option would likely require more programming knowledge but may offer more flexibility depending on the organization’s needs. Describing how to create an automated health attestation system using these tools is beyond the scope of this article, but alternative options are available.

Although the option for collecting attestations presented in this article is promising and helps address an immediate need, future investigations should examine the process of training staff and families to complete health attestations. The scope of this technology should also be expanded beyond health care practitioners to other industries (e.g., business and education). Future research should also examine the veracity of the attestations submitted and the types of organizational policies that can increase the accuracy of form submissions.

Self-attestations are one way for organizations to help protect their employees and the clients they serve. This system should not be considered a panacea, but it may serve as an important bridge until widespread testing for COVID-19 is available and verifiable. In the meantime, organizations should seek alternative methods to help navigate these difficult times.