Class Action Suit Seeks Billions in Damages Following Data Theft

An Air Force veteran of the first Iraq war and a military spouse and her two children have filed a class action lawsuit seeking $4.9 billion in damages from the US Defense Department following the theft of a computer tape containing personal and sensitive health information.

The lawsuit seeks $1,000 in damages for all 4.9 million TRICARE (Falls Church, VA, USA) beneficiaries whose records were on a computer tape stolen from a car in San Antonio (TX, USA). The suit charges that TRICARE--the federal health care program that serves active duty service members, national guard and reserve members, retirees, families, and survivors worldwide--flagrantly disregarded the privacy rights of the beneficiaries by failing to take the necessary precautions to protect their identity. The complaint stated that the data on the stolen computer tape was unprotected, easily copied, and unencrypted. TRICARE and US Defense Secretary Leon Panetta are named as the defendants.

The lawsuit also asked the court to direct TRICARE to provide free credit monitoring services to all 4.9 million beneficiaries whose personal information was on the stolen tape, and to reimburse those who had already purchased such services on their own. This could incur another hefty bill for TRICARE; when the US Veterans Affairs (VA, Washington, DC, USA) department discovers a loss, theft, or exposure of this kind, it routinely offers credit monitoring services and up to $1 million annually in identity theft protection, at a cost per veteran of $29.95 a year; this could cost TRICARE another $146.8 million per annum.

“TRICARE compounded its dereliction of duty by authorizing an untrained or improperly trained individual to take the highly confidential information off of government premises and to leave unencrypted information in an unguarded car in a public location, from which it was stolen by an unknown party or parties,” the suit alleged. “The intentional, willful, and reckless disregard of plaintiffs' privacy rights caused one of the largest unauthorized disclosures of Social Security numbers, medical records, and other private information in recent history.”

TRICARE has admitted that the stolen computer tape contained a wealth of patient information including clinical notes, laboratory tests, prescriptions, diagnoses, treatment information, and provider names and locations. However, they claimed, the risk of harm to patients is judged to be low since retrieving the data on the tapes would require knowledge of and access to specific hardware and software, and knowledge of the system and data structure.

Related Links:
TRICARE
US Veterans Affairs