DoD sued over stolen Tricare tapes.

• Position: DATA SECURITY

Four military families, along with 4.9 million Tricare beneficiaries, have filed a $4.9 billion class action lawsuit against the U.S. Department of Defense (DoD) after learning that their sensitive personal information was contained on tapes that were stolen from a car in San Antonio, Texas.

According to The Army Times, the suit alleges that U.S. government healthcare provider Tricare "intentionally, willfully, and recklessly violated" the privacy rights of the plaintiffs by failing to protect their personal information, including treatment information, diagnoses, and lab results.

In September 2011, backup tapes containing the health records of millions of active and retired military veterans and their families went missing from the car of an employee of the defense contractor responsible for taking them from one federal facility to another where they were supposed to be secured.

The data on the tapes, which were backups for the military electronic health record system, also may have included Social Security numbers, addresses, and phone numbers, Tricare admitted.

The tapes contained information for patients in 10 states who were treated at military facilities in San Antonio from 1992 to Sept. 7, 2011, and those patients who filled prescriptions or had lab tests processed at San Antonio-area military health facilities during the same period, The Army Times reported.

The suit seeks $1,000 in damages for each of the 4.9 million Tricare beneficiaries whose information was stolen. It states that the data can be retrieved easily with knowledge of an individual's name or an identifying symbol or number, such as a phone number, The Army Times reported.

Both Tricare and Science Applications International Corp. (SAIC), the contractor involved, have said there is not much chance the data will be used for criminal intent because the thief would need an in-depth understanding of SAIC's hardware and software, as well as knowledge of data interpretation, in order to access the data. There has been no evidence to date that the information on the missing tapes has been used for nefarious purposes.

While it has not said what kind of encryption was used, SAIC has admitted that the stolen tapes were not encrypted in...