This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.

Northwest Network (VISN 20)

VISN 20 Portland, OR

Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on February 1, 2011. Also cited in 208 other reports.


Report ID: SPE000000057740, U.S. Department of Veterans Affairs

Reported Entity: VISN 20 Portland, OR

Issue:

A box of 50 to 75 Veterans Identification Cards (VIC) was discovered missing from the Enrollment Office. These cards were being held for homeless Veterans or Veterans whose cards were returned to the facility due to bad mailing addresses. The information lost includes the Veterans' full names and photograph, plus the full social security number, and date of birth contained in the barcode on the ID. Many of the cards were still in the envelopes that they had been originally mailed in so some Veterans' previous mailing address may have been disclosed as well. There is not a log of which cards were in the box so the identities of the Veterans involved are unknown. The cards were kept in an unlocked middle drawer behind the receptionist desk. The office is always locked after hours and on weekends. A complete search of the office has been made and VA Police have been notified. Update: 02/07/11: The Privacy Officer (PO) explained the only way to attempt to produce a list would be to request a list of recently printed cards from Austin. He would then sort out the homeless and incarcerated Veterans whose mailing address would have been our facility address. Without a way to contact these Veterans, the PO cannot tell which of them had actually picked up their new card. The remainder of the list would then likely need to be called to find out who had not received their new card in the mail. 02/23/11: When a new card is needed, the local VA Enrollment Office takes a new picture and enters the information into the VIC system that interfaces with VistA at the local facility and automatically transmits the necessary data to the national vendor who prints and mails the cards. The office supervisor discovered that he still has the ability to run a report of all cards requested during a date range. The PO will ask him for a report to determine how many cards were printed. 02/24/11: Since these are homeless Veterans or Veterans who recently moved, VA cannot mail notification or provide credit protection services by mail. A notice will be posted throughout the medical center and on the VA website regarding this incident. Veterans can check to see if their VIC card was among the ones that went missing and if so, instructions will be provided on how to obtain credit protection services. 03/10/11: The PO clarified with the VA supervisor the office staff destroy the cards that are over a month old. This would mean that any of those missing would have been received in the office between Jan. 1 and Jan 27. He ran a report to show the number of cards printed by the vendor during that time period. The report showed 641. He also located a link that listed those cards in that total. The VA is now able to see the names of the Veterans whose cards could have been included and the address they were initially sent to. There are 621 that show they were mailed. The other 40 indicate cancelled or other status. But there are still some Veteran that have no address and there for they cannot be contacted to give them notification, therefore substitute notice is still needed. 03/14/11: Office of Public and Intergovernmental Affairs (OPIA) made corrections to the substitute notice and is moving the documents through formal concurrence as of last Friday (03/11/11), getting signoffs from the VA leadership of VHA, OI&T, OGC, Congressional and Legislative Affairs (OCLA) and eventually StratComm. 03/14/11: On 03/14/11 at approximately 1030, Office of Information and Technology (OI&T) have the document for review and concurrence. 03/18/11: VA leadership approved press release today 3/18/11. The site is going to release it late Sunday evening for local media to have Monday a.m. This will also allow the site time for verifying and contact Veterans whose have working phoes. 03/21/11: The press release was released March 20th, and so far twelve (12) Veterans have been identified that have not received there ID cards, therefore at this time 12 Veterans will receive a letter offering credit protection services. As more are determined more promocodes will be given.

Outcome:

Staff will maintain an electronic list of all cards printed and picked up from this point forward. The box of cards is now kept in a locked drawer in a locked office. 4 CM letters mailed on or will be delivered to inpatient Veterans 4/4/2011.

Do you believe your privacy has been violated? Here’s what you can do: