The Dept. of Veterans Affairs has issued its monthly report to Congress on data incidents for the month of November. As in past reports, there are a number of mis-mailed or mishandled prescriptions. Other incidents reported during this period included:
The St. Paul Veterans Service Center was informed of a Privacy Act violation by a federal fiduciary. The fiduciary inappropriately shared 58 VA guardianship files with another federal fiduciary who was not authorized to view or receive the Veterans’ claims related material. The information disclosed included the full names and SSNs of the Veterans. Fifty-seven (57) veterans were sent notification letters and offers of credit protection services. Additional training was provided to the fiduciary.
On November 21, the Acting Surgery Service Chief in Tampa, Florida reported to the weekend Administrative Officer that a digital camera used by the service could not be located. It contained 55 Veterans’ PII and PHI. The Veterans had given permission for the photographs. The camera was not located as of 10 days later. A review by the Privacy Officer determined that there might be 55 patients’ images, full names, full SSNs and dates of birth on the missing camera. The veterans were notified and offered credit protection services. An investigation of the incident revealed that the before-after images of plastic surgery clinic patients were normally downloaded from the camera within 24 hours, but because the employee had recently changed jobs and no one else knew how to download the images, images from three weeks had remained on the camera.
In what appears to me to be the most serious breach, employees of Orthopedics Department at Chicago HCS had been maintaining a calendar of patients on Yahoo.com. Patient identifiers were used and the information stored included full names, dates of surgery, types of surgery and last 4 digits of the veterans’ SSN. This information was stored on Yahoo.com and had been stored on the site since July 2007. Investigation revealed that four residents were sharing the same user account and password to access the data and that the password to the Yahoo calendar had not been changed during the three (3) years of use by rotating residents. The VA blocked access to the calendar the next morning, and on November 29, the information was deleted from the web page. The number of unique patients’ information that was on the Yahoo calendar was 878. The 878 patients were sent a letter of notification.