Noteboom The Law Firm

VA Still Redefining Data Breach Security

April 5, 2011 - The Department of Veterans Affairs (VA) is constantly redefining its approach to security and security protocols. The problem is what they are fighting against is not always an outside threat. Rather, the data breaches the VA combats are due to "careless errors," which VA Chief Information Officer Roger Baker calls "stupid human tricks." These "stupid human tricks" force the VA to continually alter their annual training to address the consequences of these data breach errors. 

It is impossible to predict everything that will go wrong with any system, but especially with an organization as large as the VA. Unfortunately, the VA is forced to be mostly reactive to situations that arise. They can only attempt to prevent bad situations from reoccurring. Because of this, the VA has asked facility and privacy officers to scrutinize persistent problems resulting in data breaches at their respective facilities, and take note of what must be addressed or readjusted.

Although the VA saw a decline in data breaches in December and January, from January 31, 2011 to February 27, 2011 the number of data breaches grew. Specifically, the VA's February repot detailed 32 more incidents than occurred in January. Thankfully, none of these incidents registered at a high risk level.

The VA's latest report detailed the VA's loss of 50-75 Veteran ID cards, a list of 1,629 patient names, social security numbers, and appointment dates, which were taken from a VA vehicle, where they were left in violation of VA policy.