Contact Tracing Breach Prompts Class Action Against Data Co, Department of Health

A class action lawsuit has been filed after the data of more than 72,000 Pennsylvania residents was exposed in a breach affecting information gathered for COVID-19 contact tracing purposes.  

Lead plaintiff, Lisa Chapman, lodged the class action naming the Pennsylvania Department of Health and the company handling the contact tracing data, Insight Global, Inc, in the state’s federal court Thursday. Chapman seeks to represent others across the nation who now face threats of identity theft and fraud due to the data breach announced in late April.  

The plaintiff says that she and other Class Members were contacted by Insight and/or the Department of Health after they were diagnosed with coronavirus or identified as having been in close proximity of someone who tested positive. Chapman says that she and others submitted information to the defendants in an effort to help slow the spread of the pandemic under the impression that the data, including health information they collected, would be properly safeguarded.  

Despite assurances that their data would be safe, Chapman says that Insight workers failed to protect the information. In fact, Insight workers allegedly made the protected health information of tens of thousands of people available to the public in unsecure spreadsheets, databases, and documents.  

“These documents were widely available to the public through a Google search and did not require a password, log in, or any kind of authentication in order to be viewed,” alleges the class action lawsuit.  

Chapman claims that the Department of Health and Insight Global were negligent when it came to the security of the highly sensitive information gathered as a part of the contact tracing effort in the state to stop the spread of COVID-19, including name, gender, phone number, sexual orientation, family size, and health data. 

Insight was aware that their employees were using and exchanging unsecured private health information as early as November of 2020, alleges the class action lawsuit. The Department of Health became aware of the security problem in February, says Chapman, but neither defendant took action to warn those exposed in the data breach until April 21, 2021.  

The class action lawsuit accuses the Department of Health and Insight Global of violating a health information protection law, the Health Insurance Information Portability and Accountability Act (HIPAA), as well as negligence.  

Chapman is seeking damages on behalf of a nationwide Class, as well as a Class of Pennsylvania residents whose information was exposed in the data breach. The plaintiff also wants a court order stopping the policies and procedures that allowed the breach to happen and forcing the Department of Health and Insight to pay for at least seven years of credit monitoring services for Class Members.  

Were you affected by the contact tracing data breach? Are you concerned about how public health departments handle your information? Tell us in the comment section below! 

The lead plaintiff is represented by Jonathan Shub and Kevin Laukaitis of Shub Law Firm, LLC, Scott B. Cooper of Schmidt Kramer, PC, James Haggerty of Haggerty, Goldberg, Schleifer & Kupersmith, PC, John P. Goodrich of Jack Goodrich & Associates, PC, and Phillip P. Diluncente and Kenneth Nolan of Phil Dilucente & Associates, LLC.  

The Contact Tracing Data Breach Class Action Lawsuit is Chapman v. Commonwealth of Pennsylvania Department of Health, et al., Case No. 1:21-cv-00824-YK in the U.S. District Court for the Middle District of Pennsylvania.  

Read About More Class Action Lawsuits & Class Action Settlements:

• Do You Qualify: Data Breach Lawsuit Claim Review
• CentralSquare Online Payment Tool Attracted Hackers ‘Like Flies to a Carcass,’ Class Action Alleges
• Do You Qualify: Credit and Debit Card Receipt Privacy Lawsuit Claim Review
• Google Assured COVID-19 Contact Tracing Users Anonymity, Class Action Alleges It Lied