VA faces criticism over lapses in data security, leaving millions of veterans’ records at risk

A recent report from the Department of Veterans Affairs (VA) Office of Inspector General (OIG) has revealed troubling security gaps at the Health Eligibility Center in Atlanta, which manages healthcare benefits for veterans. This center, responsible for overseeing access to healthcare services, was found to have left the sensitive information of over three million veterans unprotected.

The report showed that outdated software, a lack of encryption, and unauthorized software usage created vulnerabilities that put veterans’ private data, including Social Security numbers and medical histories, at serious risk. The report’s findings are a wake-up call, underscoring the need for stronger security protocols within the VA.

Encryption standards ignored

Sensitive data encryption, a standard cybersecurity measure, was notably absent at the center, exposing veterans’ personal details to potential misuse. Encryption is designed to convert readable data into an encoded format, which can only be accessed using a unique decryption key. Without encryption, files are exposed to anyone who gains access, leaving the information susceptible to unauthorized use.

The lack of this essential protection is especially concerning, given that government standards, such as those from the National Institute of Standards and Technology (NIST), require encryption to guard sensitive information. Ignoring this protocol has left millions of veterans’ private records vulnerable to cyberattacks, unauthorized access, and misuse.

The findings highlighted additional risks stemming from the large number of individuals accessing the VA’s digital infrastructure. The VA has nearly 400,000 employees and more than 100,000 contractors, each with varying degrees of access to VA systems. A security lapse in a system used by so many people further raises the likelihood of a data breach.

Addressing software vulnerabilities

With thousands of users accessing the system daily, it becomes crucial for the VA to establish stringent controls to prevent unauthorized access. Limiting access to personnel essential to each system and implementing regular audits of user activity could help safeguard veteran data.

In addition to encryption issues, the OIG discovered that over a hundred devices at the center were running unauthorized software, leaving systems without essential updates and security patches. Unauthorized software often lacks the necessary protections to counteract cyber threats, making it easier for hackers to exploit weaknesses.

Such oversight in software management demonstrates a need for thorough internal audits to ensure compliance with security standards and prevent unlicensed applications from jeopardizing data integrity.

Proactive security measures

The report outlined five recommendations to address the security weaknesses, with a key focus on implementing a comprehensive vulnerability management program, ensuring data encryption for all systems storing veteran information, and enhancing security training for personnel.

Improved vulnerability management would allow the VA to promptly identify, assess, and address system vulnerabilities, reducing the risk of security breaches. This multi-faceted approach is essential for creating a safer environment for veteran data and for preventing similar issues across other VA facilities.

These findings highlight concerns that go beyond the Health Eligibility Center itself. Inspectors suggested that other Veterans Affairs facilities review these results and consider implementing the recommended changes to prevent similar security lapses.

Addressing the issues uncovered in this report can provide a framework for improvements across the VA, ultimately protecting millions of records. Proactive measures, such as encrypting files, reducing unauthorized software usage, and implementing regular security reviews, could prevent a broader crisis and reinforce veterans’ trust in the VA’s handling of their sensitive information.

Investment in cybersecurity

The Health Eligibility Center, which receives $54 million in annual funding, has faced criticism for not allocating resources effectively to ensure up-to-date, compliant software. The use of older systems complicates the implementation of modern security measures, such as real-time monitoring and automated alerts for suspicious activity.

A report issued Wednesday by the VA Office of Inspector General cited security lapses at the Health Eligibility Center that have led to weaknesses in the computer system and made records vulnerable to unauthorized access, modification and destruction.https://t.co/tcHEHGMVMf

— Stars and Stripes (@starsandstripes) November 14, 2024

Advanced cybersecurity technology would enable faster responses to potential breaches and improve data protection. With so many veterans relying on this center for healthcare access, modernizing its technology infrastructure is essential for safeguarding personal records and maintaining public confidence.

For years, the VA has been encouraged to enhance its data security, particularly for electronic health records (EHRs), which store comprehensive medical information about veterans. If EHR data falls into the wrong hands, veterans could face risks of identity theft, discrimination, or targeted scams.

Strengthening access controls

As data breaches become more common, the VA must treat data protection as a priority, especially since veterans trust the agency with highly personal details. Establishing robust security protocols for EHRs and ensuring that healthcare centers are vigilant in their data management can help preserve this trust.

Beyond technological upgrades, the report emphasized the importance of personnel management in reducing security risks. By carefully monitoring who has access to sensitive systems and implementing restrictions based on role necessity, the VA can limit potential exposure to internal threats.

Misuse of data by employees or contractors, whether intentional or accidental, is a preventable risk if appropriate access controls are enforced. Regular audits and inventory checks of personnel with access to sensitive data would help reduce unauthorized use and improve accountability across the organization.

A few years back, Dr. Steven Waldren, chief medical informatics officer for the American Academy of Family Physicians, observed that these issues align with what healthcare organizations face industry-wide. Outdated systems and weak security practices put not only data at risk but also entire organizations.

According to Waldren, failing to modernize these practices is costly, as security breaches can have far-reaching consequences. The VA’s situation highlights a broader need for the healthcare sector to adopt stronger cybersecurity measures to keep up with evolving threats.

Adopting layered security

To mitigate future risks, the VA must adopt a layered approach to security, incorporating technology upgrades, improved personnel policies, and enhanced monitoring. Inspectors recommend that the department must implement modern software that can detect suspicious activity in real time, alerting security personnel when unauthorized access is attempted.

These upgrades would enable quicker responses and better data protection. Equally important is staff training on security best practices, ensuring that everyone within the VA understands their role in protecting sensitive information.

While these improvements come at a cost, they are essential for preventing the potentially significant financial and reputational losses of a data breach. Implementing robust cybersecurity measures reinforces veterans’ trust in the VA and protects their personal information from misuse. Ensuring data privacy is not just about meeting compliance standards; it reflects a commitment to respecting and safeguarding veterans’ personal information as they access critical services.

Protecting veterans’ privacy

The VA has announced that it is reviewing the OIG’s recommendations and committed to strengthening its security framework. Planned actions include refining vulnerability assessments, ensuring encryption on all systems containing veterans’ data, and better controlling access to sensitive information. By following these steps, the VA aims to rebuild confidence in its cybersecurity measures and reassure veterans that their personal information is safe and secure.

Protecting veterans’ data is more than a responsibility—it’s a necessity. Veterans deserve a healthcare system that values their privacy and protects their personal information with the highest security standards. As the VA takes these corrective actions, it sets an example for the healthcare industry, demonstrating that data protection is critical to building a trusted and resilient service for those who have served the country.