Printer Friendly Page
VA LIMITS USE OF PORTABLE DATA -- Device
restrictions
part of push to halt broader privacy breaches.
Background on VA buying secure thumb drives
here...
http://www.fcw.com/article102707-05-14-07-Web
Story here...
http://www.charlotte.
com/business/story/149046.html
Story below:
-------------------------
VA limits use of portable data
Device restrictions part of push to halt
broader privacy breaches
STELLA M. HOPKINS
shopkins@charlotteobserver.com
The VA, struggling with repeated privacy breaches, is imposing new
limits on the use of popular portable storage devices called thumb
drives starting today.
The drives, about the size of a thumb, can hold huge amounts of data and
are sometimes carried on lanyards or key chains. The VA now allows only
encrypted, agency-issued thumb drives, according to a June 1 memo
obtained by the Observer.
"Despite aggressive efforts to eliminate carelessness and disregard of
VA policy ... there have been several recent cases of lost or abandoned
thumb drives," wrote Robert Howard, an assistant secretary with the
Veterans Affairs Department. He added that the drives contained
sensitive personal and medical information, but he provided no
specifics. The VA couldn't say Tuesday how many losses had occurred.
For years, the VA's watchdog arm urged the huge agency to better
safeguard personal information entrusted to it by millions of veterans
and 235,000 employees, but problems persist.
Last year, the agency vowed action after the May theft of a laptop with
the records of 26 million veterans -- one of the largest U.S. privacy
breaches. Eight months later, in January, a VA employee lost a hard
drive with personal and billing information for 1.37 million doctors and
other health care providers. The VA didn't notify some caregivers until
last month that their Social Security numbers and other data were lost.
From July through February, the VA reported about 3,600 incidents to its
cyber-security group, Maureen Regan with the VA's Office of Inspector
General told Congress in February. The lapses included stolen and lost
laptops, unauthorized access and many cases of unencrypted e-mail
messages with sensitive information, said Regan, a lawyer.
VA Secretary James Nicholson warned agency leaders.
"It is now clear to me that there are still too many VA employees ...
who either still do not comprehend the seriousness of this issue, or who
consciously disregard its seriousness," he said in a Feb. 15 memo. "This
laxity is unacceptable, and will no longer be tolerated."
Data breaches often do not result in identity theft, but there's no way
to say which records will be tapped to drain bank accounts, obtain
credit cards, take loans or otherwise wreak havoc. And the opportunity
for loss is growing with the use of laptops and other portable devices.
In a memo last fall, Nicholson said he was especially worried about the
easily lost thumb drives.
VA spokesman Matt Smith said Tuesday that it was "aggressively
deploying" newly purchased encrypted thumb drives to employees this
week.
"We've been harping on thumb drives for a long time because they're just
so mobile," said Pam Dixon, head of the World Privacy Forum in San
Diego. "The more mobile, the more risk."
Response criticized
Dr. Paul Karmin, a former radiologist at the Salisbury veterans
hospital, said he received a letter May 16 from the VA advising that his
information was on the drive lost in January."I am highly concerned that
my Social Security number and other critical data has been compromised
by VA without my consent, and that they delayed letting me know about
it," said Karmin, who has said he was pushed out in 2003 after urging
changes to improve patient care. "I am being forced to protect my ID for
the rest of my life."
The VA got the records -- including Social Security numbers, dates of
birth and license numbers -- from the Centers for Medicare and Medicaid
Services for a research project. The VA said the list included doctors,
nurses, psychologists, social workers and chiropractors.
Their lost data poses a risk beyond personal ID theft because the data
could be used to falsely bill Medicare for health care.
Medicare spokesman Jeff Nelligan said the agency is reviewing its
policies for sharing information with outsiders.
Some of the National Association of Social Workers' 150,000 members are
among those who received letters dated May 9. The group called the
four-month gap "an inappropriate delay" and asked Nicholson to explain.
The VA said it worked with Medicare on the problem through March and
began notifying caregivers in April.
VA investigators criticized the agency last year for its sluggish
response to the May data loss, saying agency information security
officials "reacted with indifference and little sense of urgency or
responsibility."
More than 600,000 caregivers whose records were on the hard drive lost
in January and "whose Social Security numbers may be at risk" are being
offered free credit monitoring, said spokeswoman Karen Fedele. The VA
did not answer questions about how it identified those at risk.
Dr. Janet Munroe, formerly a radiologist at the veterans hospital in
Augusta, Ga., received a letter. Munroe, who in 2005 joined the Medical
College of Georgia, said, "You work for the federal government, and you
assume you are very secure."
What's the VA Doing?
The VA is consolidating its computer systems and other information
technology activities into one department in part to improve data
security. That creates a department of more than 5,500 full-time workers
with an expected budget next year of $1.9 billion. The reorganization is
scheduled to be complete next year.
To improve security, the agency spent about $5 million on encryption
after last year's biggest data loss. Yet the data in the big January
loss was not encrypted.
"This represents a failure ... that may be widespread throughout our
Department," VA Secretary James Nicholson said in a notice to agency
leaders.
The agency also says it has undertaken 24-7 monitoring of reported
incidents and onsite security and privacy inspections.
Stella Hopkins: 704-358-5173
-------------------------
Larry Scott --
