Data breach impacts 4.9 million military patients

Tricare, a healthcare program serving active duty service, National Guard and Reserve members, sent out a notification that an estimated 4.9 million military clinic and hospital patients were impacted by a data breach involving personally identifiable and protected health information.

Science Applications International (SAIC) reported the breach on Sept. 14. According to the breach notification, information was contained on backup tapes from an EHR used in the military health system to capture patient data from 1992 through Sept. 7, 2011.

The information may include social security numbers, addresses and phone numbers, and some personal health data such as clinical notes, laboratory tests and prescriptions. There is no financial data on the backup tapes.

“The risk of harm to patients is judged to be low despite the data elements involved since retrieving the data on the tapes would require knowledge of and access to specific hardware and software and knowledge of the system and data structure,” the notification stated. “Due to the large volume of individuals potentially impacted by this incident, we anticipate that individual notification will take at least four to six weeks; therefore, this notice is being posted in the interim.”

The incident is being investigated and additional information will be published as soon as it is available, the notice said.