TriWest Healthcare Alliance warns nearly 12,000 Tricare beneficiaries of data breach

TriWest Healthcare Alliance has notified 11,844 beneficiaries of a data breach that may have compromised their protected health information.

In a letter dated July 2 and provided to Military Times, TriWest officials stated that on April 16, they discovered a security incident in which an unauthorized person gained limited access to TriWest information and downloaded it.

“We are unaware of any misuse of your information,” officials stated in the letter, though they noted that TriWest is offering free credit-monitoring services for those who wish to enroll.

Information Compromised

The unauthorized individual obtained health-related and other personal information, including:

• Names
• Department of Defense Benefits Numbers
• Beneficiaries’ ZIP codes

In fewer than five instances, the compromised data also included Social Security numbers, addresses, and dates of birth.

About TriWest and Tricare

TriWest is the managed care contractor for the Tricare West Region, covering approximately four million beneficiaries. The Tricare program serves:

• Active duty service members
• Retired personnel
• National Guard and Reserve members
• Their family members
• Survivors
• Certain former spouses

Eligibility is determined by the Defense Enrollment Eligibility Reporting System (DEERS).

Notification Timeline

The timing of notifications remains unclear, as at least one letter was dated July 2—approximately two and a half months after the incident occurred.

In an email response to Military Times, TriWest officials explained: “With regard to timing, as soon as the incident was discovered, TriWest took immediate action to prevent any further unauthorized activity and worked diligently with the government to notify affected individuals, consistent with applicable law and notification timelines.”

The company has hired a third-party forensic expert to review what information was accessed during the incident.

Steps for Beneficiaries

• Credit Monitoring: Beneficiaries who wish to use the free 24-month credit-monitoring service through Experian should enroll by the deadline provided in their notification letter, using the activation code and instructions included.
• Report Suspicious Activity: Contact the TriWest Healthcare Alliance Breach Response Line at 1-833-918-1296.
• Identity Theft: Beneficiaries who believe they are victims of identity theft should file a report with the Federal Trade Commission at identitytheft.gov.

Preventive Measures

TriWest officials stated the company has taken steps to prevent future incidents, including:

• Increasing security controls related to password resets
• Strengthening system access monitoring tools
• Providing additional employee education on identifying and mitigating various types of cyber attacks

Karen Jowers has covered military families, quality of life, and consumer issues for Military Times for more than 30 years. She is co-author of a chapter on media coverage of military families in the book "A Battle Plan for Supporting Military Families." She previously worked for newspapers in Guam, Norfolk, Jacksonville, Fla., and Athens, Ga.