Printer Friendly Page

VA'S INSPECTOR GENERAL REPORT BLASTS BIRMINGHAM

HOSPITAL FOR DATA LOSS -- The employee lied to

investigators and deleted files from his computer in an effort

to hide the magnitude of the problem. Data was not protected

by passwords or encryption, could be used to commit

Medicare billing fraud or identity theft, and the employee

should never have had it in the first place.

 

 

The complete VAOIG report is available here...
http://www.va.gov/oig/54/reports/
VAOIG-06-01319-156.pdf

AP story here... http://www.forbes.com/feeds/
ap/2007/06/29/ap3873128.html

Story below:

-------------------------

Report Criticizes VA Data Security

By BEN EVANS

An Alabama VA hospital that lost sensitive data on more than 1.5 million people in January repeatedly failed to follow privacy regulations leading up to the incident, according to an internal report.

The employee directly responsible for the data initially lied to investigators and deleted files from his computer in an effort to hide the magnitude of the problem, the VA's inspector general wrote.

The vast majority of the data, including Social Security numbers and private health information, was not protected by passwords or computer encryption.

It could be used to commit Medicare billing fraud or identity theft, the report said, and the employee should never have had it in the first place.

The report recommends "administrative action" against several employees, including the staffer, the managers of the program where he worked and the head of the Birmingham VA Medical Center.

The security breach occurred on Jan 22, when employees discovered an external computer hard drive missing from a satellite office that conducts specialty research on health care.

Because the employee responsible for the drive initially lied about how much information was on the drive, the VA initially reported publicly that fewer than 50,000 people were affected.

But investigators later determined that the drive contained information for more than 250,000 veterans and about 1.3 million health care providers across the country.

The criminal investigation into the theft remains open, and the inspector general reported finding no evidence of identity theft related to the information thus far.

The report marks the latest in a series of critical assessments of VA data-security practices.

The agency has come under scrutiny for more than a year over a series of lapses, including the theft last spring of data on 26.5 million veterans from an employee's home in Maryland.

In auditing the department's security procedures last year, federal investigators found weak management and lax rules.

VA officials could not immediately be reached for comment.

-------------------------

Larry Scott  --