TriWest Healthcare: Nearly 12,000 Tricare West beneficiaries notified of data breach

TriWest Healthcare Alliance officials have notified 11,844 beneficiaries of a data breach that may have compromised their protected health information.

Incident Details

In a letter dated July 2 and provided to Military Times, TriWest officials stated that a security incident was discovered on April 16, in which an unauthorized person gained limited access to TriWest information and downloaded it.

“We are unaware of any misuse of your information,” officials wrote in the letter, though they noted that TriWest is offering free credit-monitoring services for those who wish to enroll.

Information Compromised

The unauthorized individual obtained health-related and other personal information, including:

• Names
• Department of Defense Benefits Numbers
• Beneficiaries’ ZIP codes

In fewer than five instances, the compromised data also included Social Security numbers, addresses, and dates of birth.

About TriWest and Tricare

TriWest is the managed care contractor for the Tricare West Region, covering approximately four million beneficiaries. Eligible individuals include:

• Active duty service members
• Retired personnel
• National Guard and Reserve members
• Their family members
• Survivors
• Certain former spouses

Eligibility is determined by the Defense Enrollment Eligibility Reporting System (DEERS).

Notification and Response

TriWest is notifying each beneficiary about the specific information involved in their case. The timing of notifications has raised questions, as at least one letter was dated July 2—roughly two and a half months after the incident occurred.

In an email response to Military Times, TriWest officials explained: “With regard to timing, as soon as the incident was discovered, TriWest took immediate action to prevent any further unauthorized activity and worked diligently with the government to notify affected individuals, consistent with applicable law and notification timelines.”

The company has also hired a third-party forensic expert to review what information was accessed during the incident.

Steps for Beneficiaries

• Credit monitoring: Beneficiaries can enroll in a free 24-month credit-monitoring service through Experian. Enrollment must be completed by the deadline provided in the notification letter, using the activation code and instructions included.
• Report suspicious activity: Contact the TriWest Healthcare Alliance Breach Response Line at 1-833-918-1296.
• Identity theft: Beneficiaries who believe they are victims of identity theft should file a report with the Federal Trade Commission at identitytheft.gov.

Preventive Measures

TriWest officials stated that the company has taken steps to prevent future incidents, including:

• Increasing security controls related to password resets
• Strengthening system access monitoring tools
• Providing additional employee education on identifying and mitigating various types of cyber attacks

Karen Jowers has covered military families, quality of life, and consumer issues for Military Times for more than 30 years. She is co-author of a chapter on media coverage of military families in the book "A Battle Plan for Supporting Military Families." She previously worked for newspapers in Guam, Norfolk, Jacksonville, Fla., and Athens, Ga.