Pentagon still failing to secure health records of top officials, audit finds

The Department of Defense is still failing to safeguard the electronic health records of top government officials, according to a new watchdog report.

In 2021, a DoD Inspector General audit found that snoopers were able to access the protected health information, or PHI, of “well-known DOD personnel.” Meanwhile, the Department of Veterans Affairs found that VA staff — often out of simple curiosity — had improperly accessed records of then-vice presidential candidates J.D. Vance and Tim Walz.

The Defense Health Agency has since tightened access to health records of well-known personnel, according to a follow-up DOD IG audit published Monday. But what DHA isn’t doing is investigating access by people who are not on a designated list of approved users.

The DHA “rarely investigated users who accessed the EHRs [electronic health records] of well‑known individuals to determine whether the access was improper,” said the IG report, which was heavily redacted.

DHA maintains a whitelist of authorized medical providers who can access health records, as well as a watchlist of users who are suspected of unauthorized access. Individuals on the watchlist are supposed to be referred to DHA’s Privacy and Civil Liberties Office, or to “the military medical treatment facility chain of command, for breach reporting, investigation, mitigation, containment, and sanctions if applicable,” the report noted.

DHA is also supposed to review weekly logs to determine whether access was justified.

Yet, DHA neither investigated users who were not on the approved list, nor those on the watchlist. Auditors examined the cases of 25 DoD personnel who were either senior officials or whose names had appeared in the media after a highly publicized event.

“Of the 2,600 users who accessed the PHI of those 25 well‑known individuals, 1,482 of the users were on the DHA’s Whitelist, and 15 were on the DHA’s Watchlist,” IG investigators found. “Of the 1,103 users (42 percent) who were not on the DHA’s Whitelist or Watchlist, the DHA did not investigate any of the users.”

In the case of one senior DOD official, 334 users accessed that person’s health records. Of that number, 94 were neither on the whitelist nor watchlist. There were no follow-up investigations.

One DHA policy — redacted in the report — isn’t meeting DoD guidelines, and it may also violate the Health Insurance Portability and Accountability Act, or HIPAA, the audit said. In addition, it “may not support the Executive Order and National Counterintelligence Strategy that warned that access to sensitive information of well‑known individuals could threaten national security.”

“Without proper monitoring and inquiry, users who improperly access these EHRs would not be held accountable as required by DHA guidance.”

The IG recommended that DHA contact any user not on the approved whitelist who accessed the health records of well-known individuals. The agency should also maintain a complete audit trail of all correspondence between DHA and the user.

If the Defense Health Agency lacks the resources or authorities to complete these inquiries, it should coordinate with the appropriate DoD or other federal components for assistance, the report suggested.