The state Health Department disclosed two weeks ago that employees of a contact tracing vendor ignored security rules and created unauthorized documents outside the state's secure computer systems.