VA Released Millions of People's Personal Data Despite Known Risks

VA Released Millions of People's Personal Data Despite Known Risks

The Veterans Affairs Department knowingly disclosed sensitive information on millions of veterans’ doctors, spouses and dependents despite warnings that the practice “could cause those individuals significant harm,” an internal watchdog found.


For more than three years, the Veterans Benefits Administration intentionally stopped redacting names, Social Security numbers and other personally identifiable information on third-party individuals in claims records provided to veterans, according to the VA Inspector General. The practice not only left countless people vulnerable to identity theft but it also potentially broke the law, auditors found. 


“VBA officials made the decision to stop redacting information that was purposely included in claims files, despite the inherent risks of disclosing third-party [personally identifiable information] in service records,” they said in a report published last week. “The OIG contends that the [policy] could place VBA at legal risk of penalties for Privacy Act violations based on other more recent case law.”


Under the Privacy Act of 1974, vets can request access to the claims they file with the VBA. In addition to information on the individual veteran, those documents often contain sensitive data on dozens of unrelated “third parties,” like spouses, dependents, previous healthcare providers and other service members. Historically, VBA redacted information on extraneous individuals from claims documents before handing them over to veterans, but officials did away with the practice in May 2016 as a way to reduce the amount of time it took to process claims.


Under the new policy, auditors said the agency likely exposed a staggering amount of personal data. During the audit, the IG found more than 1,000 unredacted names and Social Security numbers included in a sample of 30 claims requests. In the three years since officials sto ..

Support the originator by clicking the read the rest link below.