VA Long Beach Healthcare System

Report ID: PSETS0000103824, U.S. Department of Veterans Affairs

Reported Entity: LONG BEACH HCS - 600

Issue:

During the processing of a search warrant by officers, a log book containing more than 1000 Veterans' information was discovered. The information contained in the log included Veterans' full name, full SSN and date of birth.

Outcome:

05/08/14: The search warrant was served on a VA employee at his residence for an unrelated issue. The Privacy Officer (PO) said that, according to the employee, he saw someone at the facility throwing away a file cabinet and asked if he could have it. The person gave the file cabinet to the employee. The log book was still inside the file cabinet at the time. The data entries in the log book are from 2005-2006 and 2010. 05/12/14: In addition to the warrant, a search of his residence revealed that the employee had in his possession VA government property (wheelchair) and a file cabinet that contained a substantial amount of patient information including patient names and SSN's in the form of a green log book (2005 timeframe) without the hard cover and Community Living Center (CLC) Schedule sheets from 2010 (approximately 200 pages total). Patient information was confiscated by VA Police and OIG personnel. Further investigation shows that these are Gains/Losses logs for a ward and not an individual's logbook. It is now in the possession of the VA Police. The documents recovered by VA/OIG Police included: 1. Gains/Losses log from February 2005 to December 2006. Information contained in the log: Name, Full SSN, Date, Attending, PR actioner, Case Manager 2. Daily Assignment Sheets from 06/13/10 to 06/22/10. Information contained on the sheet: Patient Name, ID last 4 SSN, Age, Admission Date, Days, Ward, Room & Bed number, Primary Physician The employee was a Program Support Clerk who had been with the VA since December 2012. He had a background investigation completed on 12/31/12. His Personal Identity Verification (PIV) badge has been disabled. 05/19/14: As of 05/19/14, the PO is creating a spreadsheet regarding this incident; the spreadsheet will include each Veteran' name and SSN. This will require time to create due to the large volume. Once the spreadsheet is complete, the PO will be able to provide the total number of Veterans affected. The PO will compose the notification letter; Public Affairs will compose the press release. Once the actions are complete PO will forward to the Incident Resolution Team (IRT) for review and approval. After approval from IRT, and once the PO receives the promo codes. the notification letter will be completed and sent to the Veterans. Public Affairs will notify the local media, do the press release, and post this incident to VHA Long Beach website. 05/23/14: PO/FOIA still in the process of getting an accurate count of personnel affected. 06/02/14: The logbook and assignment sheets contained entries on 586 Veterans with the full name and full SSN who will receive letters offering credit protection services. There were also additional entries on 43 Veterans with full name and last four digits of the SSN who will receive HIPAA letters of notification. 06/03/14: The letters have been approved by local leadership. The PO is waiting on the local leadership to approve the press release. 06/09/14: The letters and the press release were approved by the Director of Incident Resolution Service. The promotional codes were sent to the PO. 07/01/14: Letters were mailed on 06/30/14. The final numbers were: 332 credit monitoring letters. 218 next-of-kin notification letters, and 42 HIPAA notification letters. 07/03/14: The press release was sent today to the following outlets: OC Register Press Telegram Long Beach City TV Ch. 8 Long Beach Union (Cal State LB) Viking News (LB Comm College) KPCC - SoCal Public Radio Long Beach Beachcomber Gazette Newspaper Long Beach Long Beach Post KOCE-TV - PBS SoCal