Atlanta staffing firm agrees to pay $2.7M for breach

Agency mishandled COVID-19 contact tracing data of 72,000.

A metro Atlanta staffing agency agreed to a $2.7 million settlement for exposing the private medical information of about 72,000 people while assisting with COVID-19 contact tracing during the height of the pandemic, according to federal prosecutors.

Dunwoody-based Insight Global agreed to pay the penalty as part of a U.S. Department of Justice Office of Public Affairs investigation, according to a May 1 news release. The Pennsylvania Department of Health paid Insight Global nearly $23 million to administer the state’s contact tracing program in 2020 but fired the firm the following year after the company sustained a data breach.

Insight Global identified and contacted Pennsylvania residents who had been exposed to COVID-19 so they could quarantine, but the company stored their names, contact information and health data in unauthorized Google accounts. Prosecutors say those data files were not password protected and were publicly accessible. The company’s contract had required Insight Global to safeguard such data.

A former Insight Global contractor acted as a whistleblower, filing a federal lawsuit that alleged the company secured its Pennsylvania contract while knowing it lacked the necessary cybersecurity systems. The whistleblower will receive nearly $500,000 from the settlement.

An Insight Global spokesperson said the company took remedial action before the DO J began its investigation, adding that “we continue to make (data security) a top priority.” Prosecutors said Insight Global was made aware of the unsecure data in January 2021 but did not begin remediating the issue until three months later.

“While we believe that remediation was thorough and appropriate independent of the DO J inquiry, we cooperated with their investigation, and we are pleased to have resolved this matter,” Insight Global said in a written statement.

Insight Global leases most of the 346,000 square-foot Twelve24 building near Perimeter Mall, a 16-story office tower that opened in spring 2020.

COURTESY The new Twelve24 building towers over nearby Perimeter Mall, which is mostly leased by Insight Global. The firm is to pay a $2.7 million settlement for a data breach of private medical data.