Hummm, embedded workers from the previous administration and their contractors?
Laptop stolen from VA contractor contains veterans' personal data
05/13/2010 A laptop belonging to a contractor working for the Veterans Affairs Department was stolen earlier this year and the personal data on hundreds of veterans stored on the computer was not encrypted, a violation of a VA information technology policy, said the top-ranking Republican on the House Veterans Affairs Committee.
Snip
The vendor, who Baker declined to identify because he said it would make it more difficult for contractors to report future data breaches if they knew their name would be made public, reported the theft to VA on April 23. Baker said the notice to Congress was 60 to 90 days quicker than how long it took the Bush administration to report security breaches.
Smip
After the 2006 theft, VA awarded a contract to install data encryption software on 300,000 employee computers. Later, the department issued rules that required all sensitive veteran information, including health care data, be encrypted. The rule included sections of the 2006 Veterans Benefits, Health Care and Information Technology Act, which requires VA employees and contractors to adhere to department security policies and procedures.
Snip
Despite the rules, a seven-month review of 22,729 VA contracts that Shinseki ordered in February 2009 found that 6,440, or 28 percent, did not include information security clauses as required. Since then VA has updated 5, 665 of the contracts with security clauses, while 197 still had not met the requirement as of November 2009. "Most troubling is the fact that 578 contractors refused to sign and modify the clause without any apparent VA action to enforce its IT security policies," Buyer wrote.
Snip
Baker said his first task in responding to the breach will be to find out how many of the 578 contracts are still in force. Then he will assess whether enforcing encryption requirements on the contracts would deprive a veteran of health care in, for example, a small nursing home tat finds it difficult to adhere to security requirements. Continued



No comments:
Post a Comment