A staffing company contracted for COVID-19 contact tracing in Pennsylvania has agreed to a $2.7 million settlement with the U.S. Justice Department and a whistleblower after exposing the private medical information of approximately 72,000 residents.
Insight Global, based in Atlanta, received tens of millions of dollars from the Pennsylvania Department of Health to administer the state’s contact tracing program during the peak of the pandemic.
However, employees utilized unauthorized Google accounts to store sensitive data, including names, contact details, COVID-19 exposure status, and even sexual orientations of residents reached for contact tracing. This breach of privacy occurred despite the company’s contractual obligation to safeguard such information.
Following the revelation of the data breach, state health officials terminated Insight Global’s contract in 2021. A subsequent federal whistleblower lawsuit revealed that the company had knowingly operated without secure computer systems and sufficient cybersecurity measures.
The whistleblower, a former contractor for Insight Global, raised concerns about the accessibility of residents’ health information to the public, initially met with indifference from company management. Despite being urged to invest in necessary computer security systems, Insight Global opted to allocate contract funds towards hiring additional workers instead.
It took Insight Global five months to implement measures to secure residents’ protected medical information, according to the U.S. Justice Department. Maureen R. Dixon, from the U.S. Department of Health and Human Services, emphasized that contractors must adhere to procedures to safeguard individuals’ personal health information or face accountability.
Insight Global, with offices across the U.S., Canada, and the U.K., admitted to mishandling sensitive data and issued an apology. The company claimed it was unaware of the unauthorized Google accounts until later stages.
As part of the settlement, the whistleblower is expected to receive nearly $500,000. Insight Global has been reached out to for comment on the settlement.