Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information

What GAO Found Service members can accrue a large volume of personnel and health records during their military careers. The custodians of these records are the Department of Defense (DOD) and the Department of Veterans Affairs. DOD and the military services developed policies and procedures to properly adhere to federal laws for safeguarding records and timely processing records requests. However, the risk of breaches and delays exists. For example, GAO covertly tested 26 requests for records from DOD; of the 18 processed requests, one was improperly released and did not redact personally identifiable information. Examples of Breaches of Military Records Among Record Custodians Personnel records. The military services have procedures intended to safeguard records, such as redacting personally identifiable information. However, of the thousands of requests received during fiscal years 2021 through 2025, the services reported 49 breaches. The Freedom of Information Act (FOIA) requires agencies to respond to requests within 20 business days, and Privacy Act requests are generally processed within 20 business days. According to military service officials, staffing limitations across the military services contribute to challenges with the proper and timely processing of records requests. For example, during the time of GAO’s review, the Navy had one employee processing FOIA requests, which officials stated contributed to an increased average processing time from 1.6 to 55.5 days. With a clearer understanding of the staffing levels needed to manage the volume and complexity of FOIA and Privacy Act requests, DOD and the services would be better prepared to improve response time, reduce the improper release of information, and minimize exposure to litigation costs. Health records. GAO found that the Defense Health Agency (DHA) relies on a complex record processing system to access service member health records, which leads to challenges in processing requests. Request processors identify health records among multiple data systems and review them to redact personally identifiable information. DHA officials stated that system issues and complex workflows challenged request processing. Multiple officials stated that the redaction process can be the most cumbersome part of fulfilling requests, particularly if the record is large or contains scanned documents. GAO previously reported that DOD determined the multiple legacy electronic health record systems that it implemented over the past 3 decades to manage patient health information required modernization, and that DOD sought to replace these legacy systems with a comprehensive electronic health record system. However, DOD has not assessed the current framework and systems for processing health records requests to identify opportunities to streamline them. Why GAO Did This Study Accessing military service records can be complex, due partly to the number of entities involved in creating, retrieving, and maintaining this information. FOIA entitles the public to request access to federal agency records, while the Privacy Act of 1974 governs how personally identifiable information is released. The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for safeguarding protected health information. House Report 118-125, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2024, includes a provision for GAO to review DOD’s release of service member records pursuant to FOIA or other requests. This report examines the extent to which DOD has established policies and procedures and has taken steps to address any challenges in the proper and timely release of service members’ personnel and health records. GAO reviewed relevant laws and DOD policies and processes governing the release of service member records. GAO also reviewed data on records requests and breaches; interviewed relevant officials; visited all four military services’ personnel centers and selected military medical treatment facilities; and conducted a covert test of internal controls to protect personnel records for 26 records requests.