Staffing company Insight Global LLC agreed to pay $2.7 million related to allegations in a whistleblower lawsuit that it didn’t implement adequate cybersecurity measures during the Covid-19 pandemic, the US Department of Justice announced May 1.

The Atlanta-based company, which had a contract with the Pennsylvania Department of Health to provide staffing for Covid-19 contact tracing, did not adequately keep the personal health information of contract tracing subjects confidential and secure, according to the Department of Justice.

The whistleblower in this instance, Terralyn Williams Seilkop, will receive a $499,500 share of the settlement.

Seilkop, who lives in Florida, formerly worked as Insight Global’s business intelligence reporting manager on the project as an independent contractor, according to court records. Seilkop filed a lawsuit under the whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government when they believe that defendants submitted false claims for government funds and to receive a share of any recovery. In its press release, the department said allegations against Insight Global included:

• Personal health information was contained in the body of unencrypted emails.
• Insight Global staff used shared passwords to access personal health information and the information was stored in Google files that were not password protected. The files were potentially accessible to the public.
• Insight Global managers received complaints about security from their staff between November 2020 and January 2021. The company did not begin addressing the issues until April 2021.

When Insight Global took action in April 2021, it secured the information, investigated the cause and scope of the incident, strengthened internal controls and procedures and added more data-security resources, the department said. The company also issued a public notice regarding the scope of the potential exposure and offered free credit monitoring and identity protection services to those affected.

Insight Global cooperated with the investigation, according to the department.

“Insight Global took remedial action upon learning of the initial situation years ago, long before the Department of Justice opened its investigation,” the company said in a statement to SIA. “While we believe that remediation was thorough and appropriate independent of the DOJ inquiry, we cooperated with their investigation, and we are pleased to have resolved this matter.”

The company continued, “As one of the largest IT staffing companies in the United States, we certainly recognize how important data security is to our clients and their stakeholders, and we continue to make it a top priority. Since 2020, Insight Global has continued to strengthen its information security posture by reinforcing its compliance, data privacy, and risk functions, increasing its vendor due diligence, and implementing a host of additional controls and enhanced training programs.”

United States of America Ex Rel. Terralyn Williams Seilkop vs. Insight Global LLC, US District Court for the Middle District of Pennsylvania, 1:21-cv-01335