Someday Companies Will Take Security and Privacy Seriously

But today, is not that day. Pennsylvania to cut ties with contact-tracing vendor after data compromise

This isn't a screw-up. This is a crime. (Probably not acutally, though it should be.)

Employees at Insight Global, a staffing agency the state hired last year to hire and train nearly 1,000 contact tracers, “disregarded security protocols established in the contract and created unauthorized documents” including the phone numbers, emails, genders, ages, sexual orientations, COVID-19 diagnoses and exposure statuses of state residents, health department spokesperson Barry Ciccocioppo told the Associated Press. [my emphasis. Z-Deb]

Contact tracing was always going to be a problem. But when the contractors can't be bothered to abide by the rules of the contract, you know it is a giant problem.

It isn't clear to me if any of that violates the Health Care privacy rules. Do you think any state should hire Insight Global for anything that contains "sensitive" information? I don't believe they should.