GAO finds military records release gaps; the next test is fixing the workflow

A safeguard must work on the request itself

An October 16 Government Accountability Office report finds that military records protections can fail where identity checks, release authority and redaction meet. In a nongeneralizable covert test, GAO submitted 26 third-party personnel-record requests. One Army response improperly released personally identifiable information. That result establishes a demonstrated control failure in the test; it does not establish how often every military office releases protected records improperly. ^[2]

The distinction matters because service members’ personnel and health records pass through different custodians and request processes. GAO found that policies already exist, including checks on authorization and information that may be disclosed. Our analysis is that another policy statement alone would be weak evidence of correction: the stronger test is whether the office handling an actual request has the capacity and checks to apply those rules. ^[2]

Do not turn incident counts into a breach rate

The military personnel centers reported 49 potential or confirmed breaches during fiscal years 2021–2025, affecting more than 1,000 service members. These were self-reported incidents, and GAO warns that the count may understate incidents. The table also spans different mechanisms: Navy officials said 15 of their 17 incidents involved unsecured email rather than processing a records request. Dividing 49 by requests processed would therefore imply a precision and common denominator the record does not support. ^[2]

DOD’s response further limits how that total should be read. The department said more than 90 percent were low-risk administrative errors that caused no harm, and objected to combining them with incidents directly tied to records-release processing. GAO said it did not independently assess each incident’s risk. Neither the department’s risk characterization nor a claim that every incident caused serious harm is an independently established outcome here. ^[2]

Staffing history is not today’s headcount

The report links processing pressure to staffing and request complexity, but its examples carry dates. Navy data showed average FOIA processing time rising from 1.64 days in fiscal 2018 to 55.5 in fiscal 2024 and 77.4 by July 2025. At one stage a single federal employee handled requests. An assistant was hired in December 2025; by April 2026, officials described a backlog plan using two civilian employees and supplemental help. The one-person example is not a verified October staffing count. ^[2]

A response deadline also needs its legal meaning preserved. The FOIA text published by the Justice Department generally requires a determination within 20 working days, with provisions for extensions and other processing circumstances. That is not an unconditional promise to deliver every requested page in 20 days. Measuring performance should distinguish acknowledgment, determination and actual production, rather than treating any communication as completed access. ^[3]

Five recommendations create a follow-up checklist

GAO recommends workforce planning work for the Army, Navy, Marine Corps and Air Force, plus assessment of the framework and systems for processing health-record requests. The Army recommendation specifically asks whether its recent functional review adequately aligns with workforce analysis. DOD concurred, while raising concerns about the report’s data, scope and governance framing. GAO’s product page lists all five recommendations as open at retrieval; concurrence is not completed implementation. ^{[2] [1]}

For health records, GAO describes staff finding information across systems and manually reviewing material for redaction, with large files and scans complicating the work. It recommends assessing improvements, potentially including database consolidation or artificial intelligence. That recommendation does not establish that an AI system is accurate, deployed or a safe substitute for disclosure controls. A useful follow-up would show measured turnaround and redaction quality before and after any change. ^[2]

This review did not obtain individual service members’ records, independently reproduce GAO’s testing or verify current office headcounts. GAO itself could not independently determine the reliability of all service-supplied request data. The immediate accountability question is narrower and answerable: which office owns each recommended action, what dated evidence shows the process changed, and has GAO verified enough progress to close the recommendation? ^{[2] [1]}