Printer Friendly Page
UPDATE: VA'S MISSING DATA IS FROM NATIONWIDE
RESEARCH AND NOT CONFINED TO ALABAMA --
VA calls it standard research on
improvement of healthcare.
Background on latest VA data theft
here...
http://www.vawatchdog.org/07/nf07/nfFEB07/nf021107-1.htm
Is there still more that the VA hasn't
told us?
Story here...
http://www.al.com/news/
birminghamnews/index.ssf?/base/
news/1171275485290720.xml&coll=2
Story below:
---------------
535,000 on lost VA drive
WILLIAM THORNTON
News staff writer
Personal information on 535,000 people could be on a portable computer
hard drive missing from the Birmingham Veterans Administration Medical
Center, a Department of Veterans Affairs investigation says.
The 535,000 number is more than 10 times the number of people originally
said to be on the missing drive.
The hard drive also may have included data, not all of it sensitive, on
about 1.3 million non-VA physicians, both living and dead, Secretary of
Veterans Affairs Jim Nicholson said in a statement.
Some but not all of the information was encrypted, VA officials said.
VA spokesman Matt Burns said the information on the hard drive was being
used as part of a nationwide study and was therefore not confined to
Alabama.
"It's standard research into how best care can be improved," Burns said.
VA officials expect this week to begin notifying people who may have
been affected. There is no indication yet that any of the data has been
misused. The VA is making arrangements to provide one year of free
credit report monitoring to people if their personal information is
compromised.
U.S. Rep. Artur Davis, D-Birmingham, learned of the investigation's
latest findings Friday. Davis said Sunday the hard drive contained the
Social Security numbers for more than 535,000 people. Data matching
names and Social Security numbers of almost 10,000 people also are on
the drive, and some Medicare billing record information and billing
codes for 1.3 million doctors.
"If someone wanted to engage in financial fraud, this would be all they
needed," Davis said.
When the VA announced the investigation on Feb. 2, its officials told
Rep. Spencer Bachus, R-Vestavia Hills, that about 48,000 veterans'
records may have been compromised, with about 20,000 of them not
encrypted. VA officials told Bachus' office they revised the number of
people potentially affected as new information came to light during the
probe.
Investigators believe most of the non-VA physicians' information was
already available in the public domain before the hard drive
disappeared, but some files might have had sensitive information.
Portions may have been protected, but investigators are still trying to
determine how much.
Bachus said he was still looking for answers as to why sensitive VA data
was evidently not protected through encryption.
"It is a continuing source of astonishment and concern that despite
numerous VA data breaches, VA records were being stored without
encryption," he said. "Encryption of records is an established and
routine practice. To have not taken that routine step is bewildering."
Sen. Richard Shelby said he was "outraged" that the initial figure
announced was much smaller and hoped "it was not meant to mislead the
public.
"It is obvious that this incident is much deeper and broader than first
announced," he said. "The records of our veterans should be protected at
all costs, and the VA must take immediate measures to alleviate this
problem and ensure it never happens again."
A Birmingham VA Medical Center employee reported the hard drive missing
Jan. 22. The VA's Office of Inspector General was notified the next day,
as was the FBI. Birmingham FBI spokesman Paul Daymond confirmed an
investigation is proceeding, but declined further comment. The VA's
Office of Information and Technology also sent a team to Birmingham to
investigate.
Since the initial report in late January, the inspector general's office
has seized an employee's work computer and begun analyzing its contents.
The employee, who has not been identified, is on administrative leave,
according to the VA.
VA officials said earlier the missing hard drive was used to back up
information on the employee's office computer. It is possible some of
the numbers believed missing could be duplicates, which would mean the
number of people affected could be lower. Burns said investigators have
not yet determined whether the hard drive was stolen or is missing. An
administrative investigation is also ongoing into how the drive could
have gone missing.
Still, Davis said the VA has been slow in notifying people who could
potentially have been affected.
"In the private sector, if there is strong reason to believe there has
been a compromise of data security, they immediately begin notifying
potential victims. Most good companies would take that step," he said.
The VA has set up a call center to provide information. The number is
1-877-894-2600 and will be available from 7 a.m. to 9 p.m. every day for
as long as needed. News Washington correspondent Mary Orndorff
contributed to this story.
E-mail: wthornton@bhamnews.com
---------------
Larry Scott --
