TriWest Healthcare Alliance: Nearly 12,000 Tricare beneficiaries notified of data breach

TriWest Healthcare Alliance has notified 11,844 beneficiaries of a data breach that may have compromised their protected health information.

Incident Details

In a letter dated July 2 and provided to Military Times, TriWest officials stated that a security incident was discovered on April 16, in which an unauthorized person gained limited access to TriWest information and downloaded it.

"We are unaware of any misuse of your information," officials stated in the letter.

Despite this, TriWest is offering free credit-monitoring services to affected individuals.

Compromised Information

The unauthorized party obtained health-related and other personal data, including:

• Names
• Department of Defense Benefits Numbers
• Beneficiaries' ZIP codes

In fewer than five instances, the breach also included:

• Social Security numbers
• Addresses
• Dates of birth

About TriWest and Tricare

TriWest is the managed care contractor for the Tricare West Region, covering approximately four million beneficiaries. Eligible individuals include:

• Active duty, retired, National Guard, and Reserve members
• Their family members
• Survivors and certain former spouses

Eligibility is determined by the Defense Enrollment Eligibility Reporting System (DEERS).

Notification Timeline

The timing of notifications remains unclear. At least one letter was dated July 2—roughly two and a half months after the incident.

In an email to Military Times, TriWest officials explained:

"With regard to timing, as soon as the incident was discovered, TriWest took immediate action to prevent any further unauthorized activity and worked diligently with the government to notify affected individuals, consistent with applicable law and notification timelines."

The company has also hired a third-party forensic expert to review what information was accessed.

Steps for Beneficiaries

• Credit Monitoring: Free 24-month service through Experian is available. Beneficiaries must enroll by the deadline provided in their notification letter, using the activation code and instructions included.
• Report Suspicious Activity: Contact the TriWest Healthcare Alliance Breach Response Line at 1-833-918-1296.
• Identity Theft: Beneficiaries who believe they are victims of identity theft should file a report with the Federal Trade Commission at identitytheft.gov.

Preventive Measures

TriWest has implemented additional security measures, including:

• Increased security controls related to password resets
• Strengthened system access monitoring tools
• Additional employee education on identifying and mitigating various types of cyber attacks

About the Author: Karen Jowers has covered military families, quality of life, and consumer issues for Military Times for more than 30 years. She is co-author of a chapter on media coverage of military families in the book "A Battle Plan for Supporting Military Families." She previously worked for newspapers in Guam, Norfolk, Jacksonville, Fla., and Athens, Ga.