Nearly 5 million patients impacted by stolen records
Backup computer tapes reported stolen from a car in San Antonio may be the largest loss of personal health information since HHS began requiring reports of large breaches in 2009. The records of about 4.9 million Military Health System patients were involved, according to a statement issued by Tricare Management Activity. The breach involved records spanning from 1992 through Sept. 7 and was reported to Tricare on Sept. 14 by its insurance carrier, Science Applications International Corp., better known as SAIC. The records, belonging to patients who received care or whose lab work was performed at San Antonio-area military treatment facilities, “may include Social Security numbers, addresses and phone numbers, and some personal health data such as clinical notes, laboratory tests and prescriptions,” Tricare said. SAIC spokesman Vernon Guidry confirmed the tapes were taken from an employee’s car while being transferred to a storage facility. Guidry said some of the personal information was encrypted. Tricare’s statement characterized risk of harm to individuals as low because “retrieving the data on the tapes would require knowledge of and access to specific hardware and software and knowledge of the system and data structure.” SAIC recently won an IT support services contract with Tricare lasting up to four years and valued at up to $53 million.