Pennsylvania to cut ties with contact-tracing vendor after data compromise
About 72,000 Pennsylvanians may have had their personal information compromised by a contact-tracing vendor working with the state’s health department, the agency said on Thursday.
Employees at Insight Global, a staffing agency the state hired last year to hire and train nearly 1,000 contact tracers, “disregarded security protocols established in the contract and created unauthorized documents” including the phone numbers, emails, genders, ages, sexual orientations, COVID-19 diagnoses and exposure statuses of state residents, health department spokesperson Barry Ciccocioppo told the Associated Press. Pennsylvania’s state computer systems and contact-tracing apps were not affected, Ciccocioppo said, though the Atlanta-based company is still investigating whether the information was misused.
The company says it became aware of the breach on April 21 and secured it by April 23, and Pennsylvania lawmakers were briefed on the incident on Thursday morning, nearly a week later. Company employees exposed the information by setting up an “unauthorized collaboration channel,” meaning Google accounts, to share information, some of which was related to contact-tracing efforts, according to the company.
“We deeply regret this happened and are committed to restoring the trust of any residents of Pennsylvania who may have been impacted,” a press release issued on Thursday by Insight Global read. “All necessary steps are being taken to secure any personal information, and we intend to learn and grow from this. We remain committed to continue helping slow the spread of COVID-19 in Pennsylvania.”
Pennsylvanians who were contacted by contact tracers between last September and April 21, 2021 could have been affected, the company said, and can receive free credit monitoring and identity protection services, though the company claims Social Security and financial information were not exposed.
The state said it won’t renew its contract with Insight Global when it ends in July. Pennsylvania has paid the company $28.7 million for its services since March 2020, according to the AP.
