After contact tracing data breach, Pa. sidesteps scrutiny on proposed $34M contract

Spotlight PA is an independent, nonpartisan newsroom powered by The Philadelphia Inquirer in partnership with PennLive/The Patriot-News, TribLIVE/Pittsburgh Tribune-Review, and WITF Public Media. Sign up for our free newsletters.

HARRISBURG — The Pennsylvania Department of Health is working to hire a new company under an even pricier contract to take over its contact tracing program after it fired the previous company in May for a massive data breach that was still unsecured in June and led to a federal lawsuit.

On June 23, the state’s Department of General Services approved the health department’s request for a year-long, $34 million contract with Boston-based Public Consulting Group, LLC through an emergency procurement — a system that allows state agencies to sidestep typical bidding practices to obtain supplies or services quickly in an emergency.

During the pandemic, the health department used the process to purchase everything from flu vaccines to supplies like pipette tips to conduct COVID-19 lab tests, as well as to enter into consulting contracts to advise on the coronavirus vaccine rollout.

It was also used last July to hire Insight Global, the Atlanta-based company recently fired by the health department for failing to secure personal information collected as staff contacted people potentially exposed to the virus. That contract was initially estimated to cost $25 million.

The contract with Public Consulting Group, LLC had not been finalized as of Thursday.

Sen. Kristin Phillips-Hill (R., York) criticized the department’s lack of transparency while pursuing the new hire and questioned why the department hadn’t first answered questions about the Insight Global breach.

“I firmly believe that rather than repeating the mistakes of the past — that being entering into an emergency contract with an out-of-state vendor — it would be prudent to pump the brakes, and I think the Department of Health needs to come clean with the people of Pennsylvania,” said Phillips-Hill, who is chair of the Senate Communications and Technology Committee.

The department selected Public Consulting Group, the emergency procurement request states, because of the company’s track record with contact tracing in neighboring states and because it is already registered in state procurement programs that speed up hiring.

In a statement, a health department spokesperson laid out the same argument used in the department’s emergency procurement request.

“To avoid a lapse in this critical public health service, it is imperative to bring on a new vendor immediately,” the spokesperson said. “The work performed under this contract will directly impact the case counts of COVID-19 in Pennsylvania.”

When asked whether using the standard contracting process could have helped prevent the problems the department had with Insight Global, a spokesperson said all health department contracts, “regardless of procurement process, contain strict information security and confidentiality provisions.”

“The department continues to work with any current and future vendors to ensure that all confidentiality and security protocols are strictly adhered to,” the statement said.

Public Consulting Group did not respond to a request for comment.

Pennsylvania, like many other states, had to scale up contact tracing quickly at the start of the pandemic. In June 2020, public health experts estimated the state needed between 2,000 and 4,000 contact tracers.

Though state and local health departments had some staff available to do that type of work — agencies nationwide routinely use contact tracing to contain small, localized outbreaks of diseases like Ebola, HIV, or mumps and measles — they didn’t have the resources to deal with COVID-19, which spread quickly and easily, said Chrysan Cronin, director and professor of public health at Muhlenberg College.

Last year, as the state was still reeling from the first four months of the pandemic and was bracing for an anticipated fall surge in cases, it made sense to contract the work out, Cronin said.

As Spotlight PA reported last spring, Pennsylvania had over several decades slashed the number of public health nurses it employed to conduct contact tracing until only a skeleton workforce was left. The state Department of Health employed just 131 people in the role as of April 2020, down from 177 nurses in 2012.

The department hired Insight Global in July to recruit and train 1,000 contact tracing staff.

“This project will bolster and diversify our public health workforce all while coordinating and mobilizing efforts in order to conquer any potential surge in COVID-19 cases,” former Health Secretary Rachel Levine said in a statement at the time.

But in late April this year, the health department and Insight Global acknowledged that the names, birth dates, counties of residence, and personal health details of as many as 72,000 people questioned during the contact tracing process had been exposed online. The information was stored in Google Drive documents used by Insight Global employees, but were visible to anyone with a link.

Phillips-Hill’s committee held a hearing May 11 to investigate the breach. Health department officials were scheduled to attend, but canceled after an Allegheny County woman affected by the breach filed a federal lawsuit. The suit alleges that both the health department and Insight Global knew about the security lapse for months but did nothing to stop it.

Then in June, despite promises that all the data had been secured, Spotlight PA reported that a Google document identifying 66 people — many of them minors — was still online. Two days later, a lawyer for Insight Global called on current and former employees to help it locate and secure documents.

Phillips-Hill on Monday questioned how Public Consulting Group would collect and secure data. She also wanted to know how the health department justified a year-long contract as COVID-19 cases continue to dwindle.

When asked in June what the department is learning about the spread of COVID-19 from contact tracing, officials said the program is “less about gathering data than it is about slowing the spread of a virus by asking residents who have been exposed to isolate or quarantine themselves from others based on their level of exposure.”

They estimated that for each person contacted, two to 10 additional cases are prevented, but didn’t provide data to back that up.

According to the Contact Tracing Workforce Estimator built by the George Washington Institute for Health Workforce Equity — which considers factors like 14-day case counts — Pennsylvania still needs 1,954 contact tracers.

About 1,200 contact tracers, some employed by Insight Global, were working statewide through mid-June, a state health department report issued June 16 said.

The contract with Insight Global ended June 18. Health department officials said that case investigations would be handled by 140 community health nurses and 50 National Guard members through mid-July as the state transitions to a new contact tracing program.

The future of the program

Health department officials declined to answer Spotlight PA’s questions about how many people will be hired under the new contact tracing vendor, and what factors related to the future of the pandemic were considered when the department made the emergency procurement request.

Even as the state relaxes mitigation protocols like masking requirements — which were lifted statewide June 28 — there are no plans to sunset the contact tracing program as long as COVID-19 cases are reported in Pennsylvania, health officials told Spotlight PA in June.

As of Thursday, only one of Pennsylvania’s 67 counties had seen a rise in cases over the past two weeks, state data compiled by Spotlight PA show. There have been a total of 1.2 million COVID-19 cases in the state since March 2020.

Cronin, the Muhlenberg public health professor, questioned whether Pennsylvania had enough data to determine whether the contact tracing program in its current form was still necessary.

“That’s a lot of money when you’re not sure you’ve made a difference,” Cronin said of the cost estimate for the new contract.

Keeping a contact tracing program in place could help manage spikes in COVID-19 cases as mitigation measures lift, said Catherine Haggerty, an epidemiologist at the University of Pittsburgh Graduate School of Public Health.

It could also help to monitor outbreaks in vulnerable groups and those who are not eligible to be vaccinated, like children under 12.

“Vaccination rates, although they’re on the rise and things are looking encouraging, they’re certainly not 100%,” Haggerty said. “Containment efforts that include quarantine of close contacts, isolation of cases continue to be critically important. This isn’t the time to let down our guard.”

Pennsylvania isn’t the only state that will continue contact tracing, even as cases decline and vaccination rates rise, according to a nationwide survey of state health departments conducted by Johns Hopkins Center for Health Security and NPR in May.

Of the 36 states that responded, 29 reported that contact tracing would continue at existing levels and receive similar resources, survey results showed, while only four states — Arizona, California, Maine, and Oregon — reported that they planned to hire more contact tracers.

Six others reported that contact tracing would “continue, but will be deprioritized.”

WHILE YOU’RE HERE… If you learned something from this story, pay it forward and become a member of Spotlight PA so someone else can in the future at spotlightpa.org/donate. Spotlight PA is funded by foundations and readers like you who are committed to accountability journalism that gets results.