The provisions of the Privacy Act are consistent with and large based on a set of principles for protecting the privacy and security  of personal information, known as the Fair Information Practices,  which have been widely adopted as a standard benchmark for  evaluating the adequacy of privacy protections; they include such  principles as openness (keeping the public informed about privacy  policies and practices) and accountability (those controlling the  collection or use of personal information should be accountable for taking steps to ensure the implementation of these principles). The E-Government Act of 2002 strives to enhance protection for personal information in government information systems by  requiring that agencies conduct privacy impact assessments (PIA PIA is an analysis of how personal information is collected, st shared, and managed in a federal system. Physical security controls were inadequate. It is also developing strategic and tactical to complete a security incident response program to monitor  suspicious activity and cyber alerts, events, and incidents. ince our last report in 2002, VA’s IG and independent auditors have  S continued to report serious weaknesses with the department’s  information security controls. Agencies Can Take Steps to Reduce the Likelihood That Personal Data Will Be Compromised

In addition to establishing a robust information security program,  agencies can take other actions to help guard against the possibil that personal information they maintain is inadvertently  compromised. Consider using technological controls such as encryption wh data need to be stored on portable devices. Given these potential negative effects, care is clearly  needed in defining appropriate criteria for required breach  notifications. The office recommends that such notifications  include, among other things,  a general description of what happened;  the type of personal information that was involved;  what steps have been taken to prevent further unauthorized  acquisition of personal information;  the types of assistance to be p free contact telephone number for additional information and  assistance;  rovided to individuals, such as a toll- information on what individuals can do to protect th identity theft, including contact information for the three cred reporting agencies; and  it  information on where individuals can obtain additional information on protection against identity theft, such as the Federal Trade  Commission’s Identity Theft Web site (www.consumer.gov/idtheft). Given that people maybe adversely affected by a compromise of their personal  information, it is critical that they fully understand the nature of the  threat and the options they have to address it. In summary, the recent security breach at VA has highlighted the  importance of implementing effective information security  practices. Although VA has taken steps to mitigate  previously reported weaknesses, it has not implemented a  comprehensive, integrated information security program, which it  needs in order to effectively manage risks on an ongoing basis. Only through strong leadership,  sustained management commitment and effort, disciplined  processes, and consistent oversight can VA address its persistent,  long-standing control weaknesses. To reduce the likelihood of experiencing such breaches, agencies can take a number of actions that can help guard against the  possibility that databases of personally identifiable information are  inadvertently compromised: strategically, they should ensure that a  robust information security program is in place and that PIAs are  developed. More specific practical measures aimed at preventing  inadvertent data breaches include limiting the collection of pe information, limiting data retention, limiting access to personal  information and training personnel accordingly, and considering  using technological controls such as encryption when data need to  be stored on mobile devices. Nevertheless, data breaches can still occur at any time, and whe n  they do, notification to the individuals affected and/or the public h clear benefits, allowing people the opportunity to take steps to   dangers of identity theft. Major Management Challenges and Program Risks: Department of  Veterans Affairs.
Why GAO Did This Study

The recent information security breach at the Department of Veterans Affairs (VA), in which personal data on millions of veterans were compromised, has highlighted the importance of the department's security weaknesses, as well as the ability of federal agencies to protect personal information. Robust federal security programs are critically important to properly protect this information and the privacy of individuals. GAO was asked to testify on VA's information security program, ways that agencies can prevent improper disclosures of personal information, and issues concerning notifications of privacy breaches. In preparing this testimony, GAO drew on its previous reports and testimonies, as well as on expert opinion provided in congressional testimony and other sources.

What GAO Found

For many years, significant concerns have been raised about VA's information security--particularly its lack of a robust information security program, which is vital to avoiding the compromise of government information, including sensitive personal information. Both GAO and the department's inspector general have reported recurring weaknesses in such areas as access controls, physical security, and segregation of incompatible duties. The department has taken steps to address these weaknesses, but these have not been sufficient to establish a comprehensive information security program. For example, it is still developing plans to complete a security incident response program to monitor suspicious activity and cyber alerts, events, and incidents. Without an established and implemented security program, the department will continue to have major challenges in protecting its information and information systems from security breaches such as the one it recently experienced. In addition to establishing robust security programs, agencies can take a number of actions to help guard against the possibility that databases of personally identifiable information are inadvertently compromised. A key step is to develop a privacy impact assessment--an analysis of how personal information is collected, stored, shared, and managed--whenever information technology is used to process personal information. In addition, agencies can take more specific practical measures aimed at preventing data breaches, including limiting the collection of personal information, limiting the time that such data are retained, limiting access to personal information and training personnel accordingly, and considering the use of technological controls such as encryption when data need to be stored on portable devices. When data breaches do occur, notification of those affected and/or the public has clear benefits, allowing people the opportunity to protect themselves from identity theft. Although existing laws do not require agencies to notify the public of data breaches, such notification is consistent with agencies' responsibility to inform individuals about how their information is being accessed and used, and it promotes accountability for privacy protection. That said, care is needed in defining appropriate criteria for triggering notification. Notices should be coordinated with law enforcement to avoid impeding ongoing investigations, and in order to be effective, notices should be easy to understand. Because of the possible adverse impact of a compromise of personal information, it is critical that people fully understand the threat and their options for addressing it. Strong leadership, sustained management commitment and effort, disciplined processes, and consistent oversight will be needed for VA to address its persistent, long-standing control weaknesses.