Class action lawsuit over Pennsylvania’s contact tracing data breach leaves senators’ questions unanswered

(The Center Square) – Pennsylvania senators want answers about the data security breach that impacted 72,000 residents who participated in the state’s contact tracing efforts.

But the Department of Health dropped out of the Communications and Technology Committee’s scheduled hearing on the matter at the last minute, citing a pending class action lawsuit filed in federal court last week.

Majority chairwoman Kristin Phillips-Hill, R-Jacobus, said the questions lawmakers have are “simple” and come directly from constituents, including why the contract with Insight Global continues despite the company’s obvious failures.

“When was the department first made aware of this data breach? Who is impacted, and does it include children under the age of 18? Where does this data go after the pandemic is over,” Phillips-Hill said. “These are all questions we wanted to have answered in a transparent, open and public hearing. And unfortunately, we still have zero answers.”

The lawsuit, filed May 5 in the Middle District of Pennsylvania, followed a bombshell report from Target 11 published last month about a whistleblower from the Atlanta-based Insight Global who alerted the news outlet to a security breach after concerns about the company’s data collection processes expressed by other employees went ignored.

The state Department of Health awarded Insight Global a no-bid $23 million contract for its contact tracing services last summer. The agreement, set to expire July 31, will not be renewed, the department said.

According to the report, a former employee said that contact tracers collected personal identifying information about residents in unsecured Google spreadsheets. Target 11’s investigators viewed the sensitive data by clicking a link.

In a statement posted to its website, Insight Global claimed it uses “robust security” on its in-house platforms, but said some employees created an “unauthorized collaboration channel” for sharing information that included names, addresses, household members, emails and phone numbers.

“We deeply regret this happened and are committed to restoring the trust of any residents of Pennsylvania who may have been impacted,” the company said. “All necessary steps are being taken to secure any personal information, and we intend to learn and grow from this.”

The lawsuit, filed against the Department of Health and Insight Global, alleges that the data breach “was a direct result of Defendants’ failure to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect consumers’” personal health information.

Insight Global knew about employees’ use of the unsecured spreadsheets as early as November, according to the complaint. The department learned about the breach in February, but neither party took action to secure residents’ information until April 21, the lawsuit alleges.

Participants in the class action seek punitive, actual, compensatory and statutory damages, as well as attorneys fees, a jury trial and seven years of paid credit monitoring services.

Both the department and Insight Global maintain that no financial information was compromised as part of the breach. Still, the company established a hotline for residents concerned about their personal information and is offering free credit monitoring services through TransUnion to affected individuals. The breach includes data collected between September 2020 and April 21, 2021, according to the company’s statement.

“We have worked closely with the Pennsylvania Department of Health to identify any individuals whose information may have been affected,” the statement concludes. “Individuals whose information may have been affected will also be notified by mail once address information is identified.”

Disclaimer: This content is distributed by The Center Square