Senate to hold Thursday hearing on VA data theft

Posted by Frank James at 11:29 am CDT

Sen. Larry Craig (R-Idaho,) chair of the Senate Veterans Affairs Committee, said yesterday evening that his committee will hold hearings Thursday on the theft of a computer disk containing sensitive personal information of more than 26 million veterans.

In a short Senate speech, Craig made the critical point that many federal agencies possess personal data on millions of Americans. So while it’s the Veterans Affairs Department in the news today, it could just as easily be another agency tomorrow.

“Frankly, this problem is not likely limited to VA,” Craig said. “Many Federal agencies keep records on citizens that contain sensitive information. It is not just IRS or HHS.

“There is information maintained by the Department of Education, that comes from the free application for Federal student loans or the Department of Agriculture, which provides crop assistance plans and crop insurance and a variety of other kinds of things,” Craig said.

“All of these agencies have names and addresses and Social Security numbers,” he said. “They must be secure. At the same time, we need employees who can use that information for legitimate purposes to serve our constituencies in a timely fashion.

“All of this will require thoughtful balancing on the part of this Congress,” Craig said. “We have to balance every doctor's need to see a veteran's medical records with the legitimate concern that one too many nurses on the floor have access to those records for no reason.”

Actually, the issue of whether nurses without a need to know can access the medical records of particular patients is covered under the Heath Information Portability and Accountability Act signed into law by President Bill Clinton.

The law says no, only a patient’s health-care providers should access those files. Is Craig saying he believes HIPAA is inadequate?

If there’s an upside to the case of the notorious missing VA disk, it’s that lawmakers and agency officials are once again awakened to the serious danger problems that can arise with lax data security practices.

It’s a danger the Government Accountability Office has warned of in years of reports about the information-security weaknesses at federal agencies. But it’s also a risk that has never seemed a top priority to the nation’s top policymakers.

Meanwhile, Sen. John Kerry (D-Mass.) introduced his legislation to require the VA to provide free credit reports for three years to all veterans "affected" by the stolen personal data disk. This would be above and beyond the annual free credit reports individuals are entitled to under the Fair Credit Reporting Act.

Kerry would also offer veterans free credit monitoring for one year. I asked a Kerry spokesperson if they had a pricetag for this legislation and she said it had not been scored yet by the Congressional Budget Officer.

Here's Kerry's press release. Note the headline says "John Kerry fights" etc. I'm not sure that introducing a bill in the Senate would constitute "fighting" for most people. But I just report. I'll let readers of The Swamp decide.

FOR IMMEDIATE RELEASE: May 23, 2006

“I’m deeply concerned that this theft happened May 3 and 26 million veterans are only finding out about it now. This stolen data is personal and private and there are grave implications if this information has gotten into the wrong hands,” said Kerry. “We need to protect these veterans and their spouses immediately, and offering this free credit monitoring will help make sure they don’t become the victims of identify theft. It’s the very least we can do.”