Why It Matters
The military services reported almost 50 improper releases of service member records affecting more than 1,000 service members from fiscal years 2021 through 2025, according to a new GAO report, which also found delays in processing records requests amid staffing challenges.
Across fiscal years 2021 through 2025, the military services reported 49 breaches of personnel records, and a covert GAO test of 26 records requests found that one of the 18 processed requests was released without redacting personally identifiable information.
The Big Picture
Service members generate substantial volumes of personnel and health records throughout their careers, and federal law sets strict standards for how those records are handled, creating a compliance framework that spans multiple statutes and agencies.
The Freedom of Information Act (FOIA) requires agencies to respond to records requests within 20 business days, the Privacy Act of 1974 governs how personally identifiable information is released, and the Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for safeguarding protected health information.
During the U.S. Government Accountability Office's (GAO) review, the Navy had one employee processing FOIA requests, and military service officials said staffing limitations across the services contribute to challenges in processing records requests properly and on time. Navy officials said having one employee processing FOIA requests during GAO's review contributed to an increase in average processing time from 1.6 days to 55.5 days, a roughly 35-fold rise.
Health records run through a complex processing system: DHA must locate records across multiple data systems and then review and redact them, a process officials described as especially cumbersome for large files or scanned documents, and DOD has not assessed its current framework and systems for processing health-record requests to identify opportunities to streamline them.
GAO previously reported that DOD determined the multiple legacy electronic health record systems it implemented over the past three decades required modernization, and that DOD sought to replace them with a comprehensive electronic health record system.
The review was mandated by House Report 118-125, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2024, which included a provision directing GAO to examine DOD's release of service-member records under FOIA and other requests.
The Bottom Line
The Department of Defense received all five recommendations GAO issued, and all five remain open, with no actions yet taken or planned that satisfy their intent.
DOD generally concurred with the five recommendations, which call on:
- The Secretary of Defense to ensure the Navy, Marine Corps, and Air Force conduct workforce planning analyses so staffing aligns with current and projected personnel-record request needs,
- To ensure the Army's recent functional review aligns with such an analysis; and
- To ensure the Assistant Secretary of Defense for Health Affairs, coordinating with the DHA Director, includes an assessment of the health-record request framework in the agency's "health informatics" study to identify opportunities for improvement, such as consolidating databases or using artificial intelligence.
GAO said a clearer understanding of the staffing levels needed for FOIA and Privacy Act requests would better prepare DOD and the services to improve response times, reduce improper releases of information, and minimize litigation exposure, and all five of its recommendations are listed as open, with GAO saying it will report updates once it confirms the agencies' actions.
A linked invitation to track related legislative activity on Legis1
Access the Legis1 platform for comprehensive political news, data, and insights.
Spot something wrong? Report an issue with this article
