What can the DoD and VA do to secure the vulnerability of medical records?

In order to maintain a sustainable, reliable and available database, every organization must attain not only people with information security skills but also people with sense of Cybersecurity awareness. In addition, every organization must commit to training their data custodians and retain only those personnel that have sense of duty of protecting the databases that is in their custody.

The DoD uses a system called AHLTA to store and document electronic medical records. This system is by no means brand new, its been around since at least 2005 when I came into the military. Most healthcare providers working in an AMEDD facilities (doctors, nurses, medics, etc.) have access to this system. With only a first and last name, and maybe a last 4 of SSN for more common names, you can pull up the records of anyone in the system. While pulling up a record does leave a trail, it won't automatically send up a red flag unless you try to access privileged portions of the record. These portions, mainly behavioral health notes and some sensitive test like HIV, can be opened by anyone with access, but will be flagged for an audit of the reasons as to why it was accessed. Access to this system is necessary for a modern clinic to function, and a heavy focus is placed on HIPPA in both training and execution of daily activities to avoid unauthorized disclosures of PHI. Are there dirtbag Soldiers out there that will do it anyways, of course, and this is true for many other areas of the military as well; these Soldiers when caught are often made examples of to deter others, and renew confidence in healthcare provider's dedication to privacy.