Reporting the unauthorized exposure of Personally Identifiable Information (PII) to a foreign entity involves distinct pathways depending on whether you are the insurance contractor (corporate reporting) or an individual/whistleblower (public reporting).
- Mandatory Corporate Reporting (If you represent the insurer)
If the health insurance corporation holds a contract with the Department of Defense (such as a TRICARE managed care contractor or a vendor bound by DFARS 252.204-7012), the organization is legally mandated to report the incident immediately.
- Cyber Incident Reporting via DIBNet: The corporation must report the incident electronically within 72 hours of discovery via the DoD DIBNet Portal.
https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/
- This requires a DoD-approved Medium Assurance Certificate.
- Privacy Act / PII Breach Reporting: Simultaneously, the contractor must coordinate with their Contracting Officer's Representative (COR) and submit DD Form 2959 (Breach of Personally Identifiable Information Report) to the component’s privacy office. DoD guidelines generally require an initial alert to the federal team within 1 hour of discovery.
- Defense Health Agency (DHA): For healthcare data, the corporate privacy official should immediately contact the Defense Health Agency Privacy and Civil Liberties Office to manage Military Health System data breaches.
- Whistleblower and Public Reporting (If you are an employee or citizen)
If you are an individual exposing corporate wrongdoing or an illegal transfer of sensitive DoD data to a foreign nation, you should route the report through oversight and counterintelligence bodies:
- DoD Inspector General (OIG) Hotline: File an unclassified complaint regarding corporate mismanagement, systematic information loss, or regulatory violations via the DoD IG Hotlineor by calling 1-800-424-9098.
- Defense Counterintelligence and Security Agency (DCSA): Because a foreign entity is involved, this escalates the incident beyond a standard data breach into a potential national security concern. If you have security clearance or work within the defense industrial base, report the foreign contact or exploitation target immediately to your Facility Security Officer (FSO) or directly to the DCSA Reporting Channels.
https://www.dcsa.mil/Personnel-Vetting/Background-Investigations-for-Applicants/Report-a-Security-Change-Concern-or-Threat/
- Parallel Legal Requirements
Because the entity is a health insurance corporation, standard healthcare laws apply alongside defense regulations:
- HHS Office for Civil Rights (OCR): The breach must be reported to the Department of Health and Human Services through the HHS Breach Portal.
https://ocrportal.hhs.gov/ocr/breach/breach_frontpage.jsf?faces-redirect=true
- If the breach affects 500 or more individuals, it must be reported within 60 days.