Data from Labor employees seeking disability accommodations impacted by 'internal incident'

The Labor Department is informing employees who requested reasonable accommodations for a disability or medical condition that some of their personal health information was improperly shared outside of the department’s network. 

In a notice sent last week, Naomi Berry-Perez, director of the department’s Civil Rights Center, told employees seeking reasonable accommodations about an “incident that may have affected the privacy of some of your information.” 

According to the notice, shared with Government Executive by impacted individuals, DOL learned in an “internal incident report” on July 22 that a single email containing a spreadsheet of personally identifiable information related to employees' RA requests was sent to “one individual's personal email address outside of the DOL domain.” 

“The individual had authorized access to the information in the performance of their DOL duties. However, the individual did not have the authority to send the information to a personal email address,” Berry-Perez wrote.

She told employees that, following an initial investigation, the department ”discovered that more than one email" containing PII or protected health information (PHI) was sent to the same personal email address outside of the DOL domain. 

“DOL is currently assessing the scope and impact of these related incidents. DOL is engaging in remediation activities to recover and destroy all the information involved,” Berry-Perez wrote. The department, she added, is also “reviewing and considering current and new measures that may be necessary to safeguard your information.” 

It’s not entirely clear how many DOL employees received these notices or are impacted by the incident. Labor Department employees recently told Government Executive that the department is facing a backlog of hundreds of RA requests. Several reported waiting months or, in some cases, a year or longer for the department to process their requests. 

“We have been contacted by about 80 people in an hour,” a union official employee said about the notification letters. "Essentially everyone who has applied for an RA.” 

The Labor Department did not immediately respond to a request for comment. 

“If DOL determines that additional categories of PII/PHI left the DOL domain, verifies additional incidents where your information has been disclosed, or identifies additional recommended steps that may safeguard your information, additional notifications will be provided,” Berry-Perez wrote. 

She told employees that the department “has identified all of the information that was involved in the incident,” which includes employees’ first and last names, duty location, work email address, job title, supervisor name and email address, pay grade and series. 

The spreadsheet sent to a personal email address also included applicants' PHI, which in this case included “categories of functional limitations that are the basis for the reasonable accommodation request.” Functional limitations listed on the spreadsheet included whether employees had any of the following conditions:

• Dexterity/mobility issues  

• Low vision/blindness

• Physical disability

• Deafness/hard of hearing

• Mental health

• Cognitive learning disability

• Chronic health condition

• Pregnancy 

“No Social Security Numbers (SSNs), dates of birth (DOBs), more specific medical diagnoses beyond the above-listed functional limitations, medical documents, or additional financial information were included in this spreadsheet,” Berry-Perez wrote. 

Faced with a backlog of reasonable accommodation requests, the department is looking to roll out artificial intelligence tools to triage the workload. Experts warned that processing confidential medical records through AI tools could create privacy issues.