Noteboom The Law Firm

Violated VA Security Policies Result in Stolen Laptop

May 20, 2010 - A contractor's laptop was stolen earlier this year. This particular contractor, however, worked for the Department of Veterans Affairs (VA). What makes the situation worse is that in direct violation of the VA and Department of Defenses security policies, none of the data on the computer was encrypted. The data on the computer, unfortunately, was the personally identifiable data of hundreds of veterans.

This is all too familiar of a scene. A very similar laptop left happened to the VA in 2006 and that resulted in the VA and the DoD ordering every contractor working with the VA to encrypt their VA information. The contractor from which this laptop was stolen promised the VA the information on their laptop was encrypted. It was not. The contractor held 69 contracts with the VA spanning over 50% of the VA's regional medical networks. Of those 69 contracts, 25 were missing the clause requiring encrypted data.

Following the theft, Representative Steve Buyer (R-Ind.) looked into contractor compliance with VA and DoD security policies. Buyer discovered 578 contractors declined to sign the clauses contained in their contracts requiring them to encrypt veterans' personally identifiable data. Rep. Buyer believes this situation is reflective of the VA's failure to protect veterans in the way they should.

VA Secretary Eric Shinseki ordered a 7 month investigation into 22,729 contracts with the VA. 28% of those contracts failed to include the required security clauses. Possibly most disturbing is there is apparently no VA enforcement behind its IT security policies.

Veterans come to VA for health care and mental health treatment, among many other things. There is a trust that develops between patients and their doctors in a course of treatment and there is no reason those veterans should worry about their personal and medical information being stolen.