VA Security Breach the Veteran's Affairs Department Essay

VA Security Breach

The Veteran's Affairs department has had several notable security breeches in recent years. In one 2006 incident, patient data was downloaded onto an unsecured laptop and stolen. Patient records at the VA were unencrypted at the time. "If data is properly encrypted there is no data breach. The device can be stolen but no data can be accessed" because the thief lacks the 'key' to decode the data (Johnson 369). But since the data was not encrypted, patient records could be easily downloaded onto an unsecured computer that was later removed by the thief.

However, simply encrypting data is not enough, since the person possessing the key can potentially steal the data. First and foremost, adequate screening of employees is essential -- individuals that have access to sensitive data such as Social Security numbers should have to pass the standards for at least minimum security clearance. Secondly, no non-approved computers should be allowed on the premises. Employees should have to work at approved computers with secure connections when handling sensitive information. If employees must work from laptops at home, they should have to log in to access encrypted data, and data access should be limited to only those employees who must access it as part of their work duties; it should not be generally accessible to all employees. The greater the number of employees that possess the information, the greater the risk of security breaches.

Workers must also be trained to be vigilant about potential breaches of security policy. A later 2010 breach of security was discovered by a nurse-scientist who reported suspicious activity. Employees may be hesitant to speak up unless they are actively encouraged by official policy and an organizational culture of openness.…