In the past year, the Department of the Navy (DON) has experienced five personally identifiable information (PII) breaches involving the urinalysis drug testing program. As a result, the Office of the DON Chief Information Officer (CIO) issued naval message 151450Z MAR 17 DON CIO WASHINGTON DC, New Department of the Navy Social Security Number (SSN) Reduction Plan, which states that, effective April 1, 2017, the Navy and Marine Corps will not use a Social Security number in urinalysis or drug testing processes.
There are exceptions to this policy. Reserve Officer Training Corps (ROTC) students and new entrants not in an active or Reserve status are required to participate in the Department of Defense drug testing program. But because these two groups have not yet been given a DoD ID number, they are still required to use a SSN.
On average, one drug testing related PII breach is received by the DON privacy team each month. Prior to April 1, 2017, the drug testing program used a SSN as the unique identifier for the drug testing process, on urinalysis rosters, specimen collection containers, and other drug testing related reports. Most breaches involved emailing rosters containing multiple entries of names and SSNs. These were sent either unencrypted or to recipients without a need to know.
The department takes safeguarding our employees’ personal information seriously. The removal of Social Security numbers from the DoD drug testing program now joins other existing SSN reduction efforts, such as the DON policy prohibiting faxing documents containing PII and prohibiting the inclusion of SSNs on rosters; the continuing review of forms and IT systems to eliminate the collection of SSNs where possible; removal of SSNs from visitor access logs; and other ongoing initiatives to remove a SSN from military identification methods or “dog” tags and from miscellaneous business processes.
These examples demonstrate how the DON is protecting your PII in a continuing effort to reduce the risk of harm from disclosure, which can result in identity theft, embarrassment, blackmail or physical harm.