One release failure in a deliberately small test
The Government Accountability Office covertly submitted 26 requests for Defense Department personnel records. Eighteen were processed. One of those 18 improperly disclosed personally identifiable information without redaction.
That produces two descriptive rates: 30.8% of the requests were not processed during the test period, and 5.6% of the processed requests produced an improper release. GAO designed the test to identify weaknesses, not to estimate a department-wide error rate, so neither percentage should be generalized to all requests.
| Outcome | Count | Share |
|---|---|---|
| Requests submitted | 26 | 100% |
| Processed | 18 | 69.2% |
| Not processed | 8 | 30.8% |
| Improper release among processed | 1 | 5.6% |
The services reported a broader breach history
Separate from the covert test, the military services reported 49 breaches from fiscal years 2021 through 2025 affecting more than 1,000 service members. The report does not say that every breach had the same cause or exposed the same type of information.
GAO also found that staffing constraints slowed responses. During the review, Navy officials said one employee was processing Freedom of Information Act requests and average time rose from 1.6 days to 55.5 days—a 34.7-fold increase.
Health-record complexity adds another layer
The Defense Health Agency uses multiple systems and workflows to locate, review and redact health records. Officials described scanned documents and large files as especially cumbersome. GAO said the agency had not assessed the current framework to identify streamlining opportunities.
Timeliness and privacy are related accountability problems: a rushed or understaffed process can increase disclosure risk, while excessive delay can deny service members and the public lawful access.
Method, response and limits
This newsroom separated GAO's nongeneralizable test from the services' administrative breach reports and calculated only the test's observed fractions and the Navy timing ratio. GAO visited all four service personnel centers and selected medical facilities, reviewed policies and data, and made recommendations on staffing, controls and health-record processing.
The record establishes vulnerabilities and actual reported breaches, not that every record office is unsafe or that the one covert failure represents a national rate. DOD's implementation status should be judged against GAO's open recommendations and later agency evidence.