An Atlanta consulting firm that performed COVID-19 contact tracing for the Pennsylvania Department of Health is settling a federal investigation into its cybersecurity measures, which potentially exposed personal information to the public.
Insight Global will pay $2.7 million to the U.S. Department of Justice to resolve allegations that it violated the False Claims Act. A sizeable chunk of that money, $499,500, will go to Terralyn Williams Seilkop, the employee whistleblower who brought the case to court. Insight Global also will pay her legal fees.
MORE: Drivers with illegally-tinted windows can be fined $100 under new Philly law
Seilkop and federal attorneys argued that Insight Global failed to keep sensitive information secure by sharing it in the body of unencrypted emails and in Google files that were not password-protected, potentially making it available to internet users via links. Staffers also allegedly shared passwords used to access personal details.
According to justice department, Insight Global was aware of the problem as early as November 2020, but did not take steps to address the issue until April 2021. That same month, the Pennsylvania Department of Health reported a contact tracing data breach that may have exposed the personal information of 72,000 residents. Insight Global was linked to the leak, which included ages, sexual orientations, phone numbers, email addresses and COVID diagnoses. The health department demanded the firm to contact all people impacted, and declined to renew its contact with Insight Global, which expired on July 31, 2021.
Federal prosecutors said that Insight Global's multi-million dollar settlement resolved allegations only, and it may still be criminally liable. The firm denied the allegations.
Follow Kristin & PhillyVoice on Twitter: @kristin_hunt
| @thePhillyVoice
Like us on Facebook: PhillyVoice
Have a news tip? Let us know.