The VBA is giving out Social Security numbers

The Department of Veterans Affairs Office of the Inspector General was asked to investigate whether the Veterans Benefits Administration (VBA) had disclosed third-party information — such as Social Security numbers, names, dates and places of birth — when it responded to Privacy Act requests. The answer, unfortunately, was a big yes.

Veterans who request copies of their own claim files can have them under the Privacy Act. But that means that all information in the file also is given to them. Sometimes that means a third party, such as the doctor who treated them, or other service members … including the name and Social Security number of those people.

Before 2016, the VBA was required to redact — draw a thick black line through — any info that concerned a third party before sending the file out to the requester. But, they whined, it took time to do that and caused backlogs in getting the files out. Info from the files was copied onto CD and mailed to the requester, putting everything out where it could be stolen or go missing or be viewed later by anyone.

The VBA attorney decided it was just fine to release all that private third-party information if the VBA did it “on purpose” as part of releasing the requester's own information. Between May 2016 and May 2019, 379,000 files went out this way.

Here's an example from the OIG report: In 18 sample files it inspected, there were 1,027 third-party names and Social Security numbers. Doing the math, how many extra names were likely in those 379,000 files? I come up with 21 million.

Two factoids: 1) Last year there were 14 million cases of identity fraud. 2) The big coup for thieves is getting a Social Security number. It unlocks all doors.

To read the OIG report, go to www.va.gov/oig/pubs/VAOIG-19-05960-244.pdf.