Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information

What GAO Found Service members can accrue a large volume of personnel and health records during their military careers. The custodians of these records are the Department of Defense (DOD) and the Department of Veterans Affairs. DOD and the military services developed policies and procedures to properly adhere to federal laws for safeguarding records and timely processing records requests. However, the risk of breaches and delays exists. For example, GAO covertly tested 26 requests for records from DOD; of the 18 processed requests, one was improperly released and did not redact personally identifiable information. Examples of Breaches of Military Records Among Record Custodians Personnel records. The military services have procedures intended to safeguard records, such as redacting personally identifiable information. However, of the thousands of requests received during fiscal years 2021 through 2025, the services reported 49 breaches. The Freedom of Information Act (FOIA) requires agencies to respond to requests within 20 business days, and Privacy Act requests are generally processed within 20 business days. According to military service officials, staffing limitations across the military services contribute to challenges with the proper and timely processing of records requests. For example, during the time of GAO’s review, the Navy had one employee processing FOIA requests, which officials stated contributed to an increased average processing time from 1.6 to 55.5 days.