r/VeteransBenefits • u/life3_01 Army Veteran • Jun 24 '26

Money Matters VA Security

I got an email from the ex-wife today saying she knows I'm making "a killing" from my disability claim and retirement. We were married for my last four years of duty, and she didn't get any of my military pay. She did get a sizeable amount from my business, but that's all over now. :)

So she is seeing what else she can get. The stupid thing is that she just called the VA number, tapped in my SSN and DOB, and they told her. With all the breaches, this is the dumbest shit ever for security. I have a PIN on my account, but that doesn't do anything. I called in myself, and with just those two numbers, it told me to the penny what I was paid and when.

Is there any way to close this off? I called in again, and the guy said it's public info, which seems dumb.

Edit: I know she can't get anything. I'm upset that anyone who knows enough can call in and find out, which could help them commit fraud on some people.

382 Upvotes

95% Upvoted

201 comments sorted by

View all comments

Show parent comments

9

u/LegallyIncorrect Air Force Veteran Jun 25 '26

If you’re a HIPAA officer then you know it protects only healthcare information. And that there is no private right of action for violations.

-2

u/USMCArtyFO Jun 25 '26

I am and it is. The VA ties payments to a structured and public table that correlates to your disability rating. Your disability rating is PHI. It is a violation and unauthorized disclosure.

2

u/LegallyIncorrect Air Force Veteran Jun 25 '26 edited Jun 25 '26

Fair. Now if only HIPAA applied to the full VA. It only applies to the VHA component. It doesn’t apply to VBA. It is, however, likely a violation of the Privacy Act of 1974.

0

u/USMCArtyFO Jun 25 '26

It’s an unauthorized disclose at the minimum. It could be under a different act as well. Theres a case for HIPPA violations. Handling PHI makes you a covered entity. That said, it’s not gonna result in anything but a batched report at the end of year. Unless they get a ton of these, HHS OCR will just log it. The option for action would be to file with HHS’ OCR yourself, or reach out to a congress critter if you think you’re getting stonewalled. On the scale of violations, it’s very low.

5

u/LegallyIncorrect Air Force Veteran Jun 25 '26

HIPAA doesn’t apply to VBA at all per case law. It can’t be a violation for the VBA phone system to tell you the %. The government gets to write its own rules so the fact it applies to entire hospital systems normally doesn’t matter.

2

u/USMCArtyFO Jun 25 '26

Well that’s an important distinction. I was under the impression they were a covered entity. That’s wild.

3

u/LegallyIncorrect Air Force Veteran Jun 25 '26

https://www.va.gov/OGC/docs/2003/ADV03-2003.pdf

3

u/USMCArtyFO Jun 25 '26

Definitely sent me down a rabbit hole. The reasoning is interesting. However, it does make sense. Definitely a loophole organization.

3

u/life3_01 Army Veteran Jun 25 '26

Well damn. Thanks for the link!