535,000 on Lost VA Drive

Personal information on 535,000 people could be on a portable computer hard drive missing from the Birmingham Veterans Administration Medical Center, a Department of Veterans Affairs investigation says.
by William Thornton

The 535,000 number is more than 10 times the number of people originally said to be on the missing drive.

The hard drive also may have included data, not all of it sensitive, on about 1.3 million non-VA physicians, both living and dead, Secretary of Veterans Affairs Jim Nicholson said in a statement.  

Some but not all of the information was encrypted, VA officials said.

VA spokesman Matt Burns said the information on the hard drive was being used as part of a nationwide study and was therefore not confined to Alabama…

"It's standard research into how best care can be improved," Burns said.

VA officials expect this week to begin notifying people who may have been affected. There is no indication yet that any of the data has been misused. The VA is making arrangements to provide one year of free credit report monitoring to people if their personal information is compromised.

U.S. Rep. Artur Davis, D-Birmingham, learned of the investigation's latest findings Friday. Davis said Sunday the hard drive contained the Social Security numbers for more than 535,000 people. Data matching names and Social Security numbers of almost 10,000 people also are on the drive, and some Medicare billing record information and billing codes for 1.3 million doctors.

"If someone wanted to engage in financial fraud, this would be all they needed," Davis said.

When the VA announced the investigation on Feb. 2, its officials told Rep. Spencer Bachus, R-Vestavia Hills, that about 48,000 veterans' records may have been compromised, with about 20,000 of them not encrypted. VA officials told Bachus' office they revised the number of people potentially affected as new information came to light during the probe.  

Investigators believe most of the non-VA physicians' information was already available in the public domain before the hard drive disappeared, but some files might have had sensitive information. Portions may have been protected, but investigators are still trying to determine how much.

Bachus said he was still looking for answers as to why sensitive VA data was evidently not protected through encryption.

"It is a continuing source of astonishment and concern that despite numerous VA data breaches, VA records were being stored without encryption," he said. "Encryption of records is an established and routine practice. To have not taken that routine step is bewildering."  

Sen. Richard Shelby said he was "outraged" that the initial figure announced was much smaller and hoped "it was not meant to mislead the public.

"It is obvious that this incident is much deeper and broader than first announced," he said. "The records of our veterans should be protected at all costs, and the VA must take immediate measures to alleviate this problem and ensure it never happens again."

A Birmingham VA Medical Center employee reported the hard drive missing Jan. 22. The VA's Office of Inspector General was notified the next day, as was the FBI. Birmingham FBI spokesman Paul Daymond confirmed an investigation is proceeding, but declined further comment. The VA's Office of Information and Technology also sent a team to Birmingham to investigate.

Since the initial report in late January, the inspector general's office has seized an employee's work computer and begun analyzing its contents. The employee, who has not been identified, is on administrative leave, according to the VA.

VA officials said earlier the missing hard drive was used to back up information on the employee's office computer. It is possible some of the numbers believed missing could be duplicates, which would mean the number of people affected could be lower. Burns said investigators have not yet determined whether the hard drive was stolen or is missing. An administrative investigation is also ongoing into how the drive could have gone missing.

Still, Davis said the VA has been slow in notifying people who could potentially have been affected.

"In the private sector, if there is strong reason to believe there has been a compromise of data security, they immediately begin notifying potential victims. Most good companies would take that step," he said.

The VA has set up a call center to provide information. The number is 1-877-894-2600 and will be available from 7 a.m. to 9 p.m. every day for as long as needed. News Washington correspondent Mary Orndorff contributed to this story.

Go to original article

"Go to Original" links are provided as a convenience to our readers and allow for verification of authenticity. However, as originating pages are often updated by their originating host sites, the versions posted on VT may not match the versions our readers view when clicking the "Go to Original" links.

(In accordance with Title 17 U.S.C. Section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. VT has no affiliation whatsoever with the originator of this article nor is VT endorsed or sponsored by the originator.)