{"id":1624,"date":"2011-10-18T00:00:00","date_gmt":"2011-10-18T00:00:00","guid":{"rendered":"http:\/\/otava.test\/military-healthcare-contractors-hipaa-breach-followed-by-4-9-billion-lawsuit\/"},"modified":"2011-10-18T00:00:00","modified_gmt":"2011-10-18T00:00:00","slug":"military-healthcare-contractors-hipaa-breach-followed-by-4-9-billion-lawsuit","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/military-healthcare-contractors-hipaa-breach-followed-by-4-9-billion-lawsuit\/","title":{"rendered":"Military Healthcare Contractor\u2019s HIPAA Breach Followed by $4.9 Billion Lawsuit"},"content":{"rendered":"

If you\u2019ve been following the TRICARE HIPAA breach<\/a> of PHI reported at the end of September, you\u2019ll know that 4.9 million people were affected by the loss of data backup tapes under the Defense Department\u2019s military healthcare program. Now a $4.9 billion lawsuit seeking class action status for those affected individuals hangs over the offenders\u2019 heads, seeking $1,000 for each affected individual.<\/p>\n

The affected individuals that filed the lawsuit include a military spouse, her two children and an Air Force veteran. The suit specifically targets Secretary Leon Panetta for violating the Federal Administrative Procedures Act and the Federal Privacy Act of 1974. While the data breach is a clear HIPAA violation<\/a>, the Privacy Act of 1974<\/a> details the code of fair information practices that controls the storage, use, maintenance and dissemination of information by federal agencies, meaning the Department of Defense is also held liable for more than just a HIPAA fine.<\/p>\n

\"TRICARE
TRICARE HIPAA Breach & Lawsuit<\/figcaption><\/figure>\n

At the time the incident was reported, details had not yet been released as an investigation was underway. Now the data breach appears to be attributed to physical theft \u2013 the backup tapes with PHI records dating from 1992 to 2011 were stolen out of the back of a car of a SAIC employee (Science Applications International Corp. – TRICARE\u2019s contractor and business associate that provided offsite backup<\/a>, storage and data security for the military insurance carrier, and also reported the breach).<\/p>\n

Physical theft proves to be one of the most reoccurring causes of HIPAA breaches thus far, according to HHS data on HIPAA violations and as represented in an earlier blog post<\/a>. Another factor that may have contributed is the type of backup the military contractor chose \u2013 tape backup. Considered a more traditional disaster recovery method, tape backup is highly error-prone and time-consuming, and, apparently, at risk for physical theft and subsequent HIPAA breaches.<\/p>\n

One alternative is cloud disaster recovery<\/a>, which can improve accuracy and recovery time objectives (RTO), and can be secured with encryption, logging, vulnerability and penetration testing, etc. to ensure your data is safely backed up. Virtualization also eliminates the possibility of physical data theft, as exemplified by the SAIC loss of backup tapes.<\/p>\n

Among the 11 orders in the lawsuit, three include concerns around data security practices, systems and procedures:<\/p>\n