3 weeks after hard drive disappeared from Ala. hospital, VA notifying 1.8 million

The Department of Veterans Affairs began notifying 1.8 million veterans and doctors Monday that their personal and business information could be on a portable hard drive that has been missing from an Alabama hospital for nearly three weeks.

The hard drive may have contained Social Security numbers and other personal information from about 535,000 individuals and billing information on 1.3 million doctors nationwide, the VA said. That's more than 37 times more people than authorities initially believed were affected.

An employee at the VA medical center in Birmingham reported the external hard drive missing on Jan. 22. The drive was used to back up information on the employee's office computer. It may have contained data from research projects, the department said.

U.S. Rep. Artur Davis questioned why it took the agency so long to begin sending out notification letters.

"I certainly understand that the VA wanted to get a handle on the facts. But it became very apparent very early on that they had a breach of security," said Davis, a Democrat from Birmingham.

Veterans Affairs officials said they were moving as quickly as they could. "We are providing information as we learn it from an investigation," said spokesman Matt Burns in Washington.

The VA first publicly revealed the equipment was missing 11 days after it was reported, saying then that personal information on as many as 48,000 veterans may have been stolen.

The VA said Monday it doesn't have any reason to believe anyone has misused data from the hard drive, which is also at the center of a criminal investigation. The agency offered a year of free credit monitoring to anyone whose information is compromised.

Davis said the department told him that the missing storage unit included the Social Security numbers and names of about 10,000 people, plus another 525,000 Social Security numbers. The information on doctors includes names and Medicare billing codes, he said.

Last year, a VA executive stepped down from his job and a data analyst was fired after the agency failed to immediately reveal the theft of a laptop computer and disks that contained personal information on 26.5 million veterans.