House panel leaders scold HHS Secretary Sylvia Burwell about stolen laptop
Employee was using personal machine to conduct audits; stolen laptop might have contained millions of records with personal health information.
Health and Human Services Secretary Sylvia Burwell
Health and Human Services Secretary Sylvia Burwell is in the hot seat over a laptop reported stolen from the federal Office of Child Support Enforcement in Olympia, Washington.
An agency employee was using a personal laptop to conduct audits, although using personal equipment is a violation of HHS policy.
The theft, which also included two hard drives, occurred on February 8, HHS officials did not report it to Congress until March 25, beyond the seven days permitted under the Federal Information Security Modernization Act.
The drives reportedly had between 2 million and 5 million individual profiles containing names, Social Security numbers, birthdates, addresses and phone numbers.
"It is unclear why the Department waited nearly two months later to provide Congress with notification under FISMA, Representatives Jason Chaffetz, of Utah, chairman of the House Committee on Oversight and Government Reform, and Elijah Cummings, the ranking minority member from Maryland, wrote in their letter to Burwell.
[Also: Republicans blast HHS after Healthcare.gov reports 316 security incidents with website]
The pair also asked Burwell to make HHS officials familiar with the situation available to brief the panel on April 11. They want to talk about whether HHS databases might have been accessed and when HHS decided to notify Congress.
Chaffetz complained in a statement to The Associated Press on Tuesday that HHS had not been forthcoming, and he likened the incident to the one that occurred at the government's Office of Personnel Management in 2015.
Sen. Ron Johnson of Wisconsin, the Republican chair of the Senate Government Affairs Panel, asked Burwell at a hearing on April 4, if the missing drives had ever been recovered. The were not recovered.
The lawmakers want to know how many individuals might have been impacted, the type of information that might have been compromised.
Twitter: @Bernie_HITN
