SSA teleworkers may be putting personal data at risk, IG says

While teleworking is improving morale at the Social Security Administration, it also may be exposing individuals' personal information to unauthorized disclosure via employees’ computers, according to a new report from the SSA Office of Inspector General.

Under a union agreement, the SSA’s Flexiplace program allows nearly 30 percent of the workforce at the Office of Disability Adjudication and Review to work at home at least one day a week. Those 2,037 teleworkers screen and analyze cases, develop evidence and prepare decisions for individuals applying for or receiving disability benefits.

To perform their duties, the teleworkers take home case files on compact discs and laptop computers. Those files generally contain personally identifiable information that include claimants’ Social Security numbers, names, addresses, and earnings and medical histories.

While SSA managers have put some measures in place to safeguard the personal information, those measures may be inadequate and not be fully implemented, states the June 9 report from SSA Inspector General Patrick O’Carroll Jr.

“We [have] determined [that] Office of Disability Adjudication and Review practices may have exposed claimant data to unauthorized disclosure,” O’Carroll wrote.

For example, managers did not always effectively track the removal and return of personal information and allowed employees to remove personal data stored on unencrypted CDs. In addition, employees did not always follow the rules to lock down the personal data whenever traveling to or working at an alternative location, the report noted.

Overall, the telework program has risks, O’Carroll said. “The SSA has limited ability to control or detect how employees transport, store, or use personally identifiable information when they work [under the] Flexiplace" program, he wrote. "As such, the agency is at risk for unauthorized disclosure or intentional misuse of claimant personally identifiable information and must weigh risks against costs and benefits before implementing additional controls.”

But on the plus side, the teleworking program has improved worker motivation, the IG added. Flexiplace “has had a positive impact on their morale or helped them work more effectively at home because of fewer interruptions,” O’Carroll wrote.

To improve security, the inspector general made four recommendations:

  • Require that employees store personally identifiable information on encrypted and password-protected laptops.
  • Re-emphasize that employees must comply with policies.
  • Consider additional procedures to track removal and return of personally identifiable information.
  • Improve monitoring of employee compliance, and discipline employees who do not comply.

SSA managers generally agreed with the recommendations made in the report.

 

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.