A Veterans Affairs hospital in South Dakota has waited more than two months to notify 1,100 patients that files containing their Social Security numbers and other personal information were dumped in a trash bin.
The Rapid City Journal reports that the data breach at the VA Hot Springs hospital took place in May, but it wasn't until July 29 that anyone was notified. The paper said the breach was the most recent in a string of embarrassments that has engulfed the nation’s VA system over charges of doctored wait lists, poor care and wasteful spending.
The VA Black Hills Health Care System blamed the breach on an employee who mistakenly tossed the patient files in a Dumpster. The records were found two days later by another employee who fished them out of the trash and notified hospital security guards.
“The investigation found that during a regular office move, that the box of files were inadvertently throw in the receptacle, VA Black Hills spokeswoman Teresa Forbes told the paper, calling it “an unfortunate mistake.”
The VA alerted the 1,100 military veterans of the breach in letters mailed last Wednesday. The letter informed recipients they could request a free credit report to ensure their personal data was not being misused.
Forbes defended the lag in making the notification, saying that the VA was following procedures.
The files included names, Social Security numbers, phone numbers and addresses. They did not include medical histories.
The Journal said the VA is confident the information did not fall in to the hands of identify thieves.
That confidence did not satisfy one VA critic, Sen. John Thune (R-S.D.), who said the breach demonstrated “gross mismanagement.”
He also said it was “unfortunately illustrative of the continued decline of the Hot Springs VA and the indifference shown to it by the Veterans Administration.”
The Black Hills health care system serves some 19,000 veterans living in South Dakota and four other states.
The Associated Press contributed to this report.