IC Workforce & Organization — 2026-09-02

DoD IG Finds Pentagon Still Failing to Investigate Unauthorized Access to Senior Officials Health Records Despite Counterintelligence Risks

BLUFDHA is very unlikely to investigate the 1,103 unlisted users who accessed senior officials' health records within the next 12 months, leaving a known counterintelligence gap effectively unmanaged.

A DoD Inspector General audit published Monday found the Defense Health Agency has tightened access controls on electronic health records of senior officials since a 2021 IG review flagged unauthorized access by "snoopers," but still rarely investigates users whose access falls outside approved channels 12. Examining access to the records of 25 senior or publicly prominent DoD personnel, auditors found 2,600 users accessed those records, including 1,482 on DHA's whitelist and 15 on its watchlist 12. Of the 1,103 users who appeared on neither list, DHA investigated none 12; in one case, 334 users accessed a single senior official's records, 94 of them off both lists, with no follow-up inquiry 12. By contrast, DHA had investigated 9 of the 15 watchlisted users as of July 2025, confirming improper access by 8 of them and issuing accountability actions or retraining 1. The IG report, heavily redacted, found one DHA policy fails to meet department guidance and may violate HIPAA, and recommended DHA contact unlisted users and maintain a complete audit trail of related correspondence 1.

Analysis
DHA's failure to close the gap leaves counterintelligence risk in senior officials' medical records effectively unmanaged, since the agency has shown no capacity to act on what its own monitoring tools reveal. DHA is very unlikely to complete and report investigations into the 1,103 unlisted users within the next 12 months, absent congressional pressure or a HIPAA enforcement action forcing compliance. Moderate confidence reflects the audit's finding that one DHA policy already fails department guidance, paired with the agency's unbroken record of building monitoring infrastructure without following through on referrals. This should be read alongside the IDScan.net breach exposing 153 million identity documents, including the Defense Secretary's license: an adversary combining both datasets gains compound leverage over cleared personnel that neither DHA's audit-trail fixes nor the FBI's breach investigation addresses in isolation.

4 sources

Pentagon still failing to secure health records of top officials, audit finds - Military Times
Pentagon Still Failing to Secure Top Officials' Health Records, Damning Audit Finds - Common Defense
DoW OIG Flags Gaps in Defense Health Agency Controls Over Sensitive Health Data - OrangeSlices AI
Audit of the Defense Health Agency's Controls Over Protected Health Information of Well-Known Department of War Personnel (Report No. DOWIG-2026-115) - Department of War Office of Inspector General (DoW OIG)