The Veterans Benefits Administration purposely did not redact names, Social Security numbers and other personally identifiable information on third-party individuals in claims records, according to a VA Inspector General report cited by Nextgov.
"VBA officials made the decision to stop redacting information that was purposely included in claims files, despite the inherent risks of disclosing third-party [personally identifiable information] in service records," the report said. "The OIG contends that the [policy] could place VBA at legal risk of penalties for Privacy Act violations based on other more recent case law."
Veterans can request access to claims. The claims contain information on the individual veteran as well as sensitive data on third parties, such as spouses, dependents and former healthcare providers. Previously, the VBA redacted in information on third parties. The administration decided to stop redacting information on third parties in May 2016 to save time. Because of the change, more than 1,000 unredacted names and Social Security numbers were included in a sample of 30 claims requests.
"Based on the volume of third-party [personally identifiable information] the review team found … the OIG determined that the [agency] could have already released millions of third parties' names and Social Security numbers," the report said, according to Nextgov.
Since the report, officials have formally changed the policy. The inspector general recommended the agency update its website based on its current disclosure polices. Additionally, the report suggested the VBA increase its oversight on records management and improve reporting.
"VA is committed to providing veterans prompt access to their claim records increasing transparency and improving customer service," Secretary Robert Wilkie told Nextgov. "It's imperative that we protect files containing sensitive and personal information."