RENEE MONTAGNE, host:
The FBI and the Department of Veterans Affairs are trying to find out what happened to a computer hard drive that's been missing since last month. The files contained information on nearly two million patients and doctors. The portable hard drive disappeared from a VA medical center in Birmingham, Alabama. The VA says it's notifying those who may be affected. However, some people think it took the agency too long to disclose the incident.
Steve Chiotakis of member station WBHM in Birmingham reports.
STEVE CHIOTAKIS: It is happy hour at a paneled East Birmingham tavern - American Legion Post 171. And the aroma of beer, hotdogs and plumes of cigarette smoke permeate the noisy, windowless place.
(Soundbite of men tavern)
CHIOTAKIS: Conversations crisscross from seat to bar and all points in-between. Among the topics, what happened at the hospital many of these veterans use?
Mr. JERRY BROWN (Veteran): I think it is a concern to everybody, obviously.
CHIOTAKIS: Army veteran Jerry Brown served during the Vietnam era, and says he's been trying to keep up with all that's going on. But he says he knows from past experience the matter, however serious, will somehow be resolved.
Mr. BROWN: That's something that could cost a lot of people a lot of problems. But I'm confident the VA will handle it. We have a very good hospital here, and I think it will be handled.
CHIOTAKIS: Eddie Fenton(ph) is a bit more skeptical, saying that a possible breach could have national security implications.
Mr. EDDIE FENTON (Veteran): How many of those people had different security levels that their names could now be breached? So that would be more of a concern than a hacker trying to go and use that type of information for any personal gain.
CHIOTAKIS: Whatever the opinion, the debate seems to be shifting from the inaptitude of losing the drive in the first place to the fact that so many names are included, to - and most contentious now - why it took three weeks for the VA to say anything to those affected. Department of Veteran Affairs spokesman Matt Burns says investigators wanted to know exactly what happened before going public.
Mr. MATT BURNS (Department of Veteran Affairs): The inspector general and other investigators needed time and were in communication with the department. They felt they needed time to get on the ground and determine, A) was this is in fact missing; B) whether or not it was a criminal act involved; and they wanted to be able to gather facts before jumping to any conclusions about what may have been involved.
CHIOTAKIS: Birmingham Congressman Arturo Davis says the bottom line is that the information went missing, that yes, there should be a thorough investigation into what happened; but in the meantime, the people involved should have been notified.
Representative ARTURO DAVIS (Democrat, Alabama): Under either scenario, there's a risk of sensitive information being put in the wrong hands. So the obligation, in my opinion, should have been to notify the affected individuals, and to empower them, take steps to protect themselves.
CHIOTAKIS: To help with that, the VA is offering free credit monitoring for a year for those affected. One army vet, Jim Fronuff(ph), who maybe on the list, says the latest incident should be a wake-up call for government.
Mr. JIM FRONUFF (Veteran): They need to tighten up, get it together, and take care of the veterans. The millions that have died for this country, and now we expose them to things that we don't know what may be doing.
CHIOTAKIS: Just last week, VA secretary Jim Nicholson testified before the Senate Veterans Affairs Committee about the agency's budget, which includes more than $1.8 billion for technology and data protection.
Because of the theft of a laptop and hard drive last year, the agency was in the process of updating its security and encryption. But portions of the data on the Birmingham drive were not encrypted.
For NPR News, I'm Steve Chiotakis in Birmingham.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.