GAO investigators obtained improperly disclosed military records during a covert test, while an audit found that staffing gaps and fragmented systems continue to complicate the Pentagon’s handling of sensitive personnel and medical information.
WASHINGTON, Oct. 21, 2026 — The Pentagon has developed an extensive collection of rules for protecting military personnel records, verifying the identities of requesters, and preventing the unauthorized disclosure of sensitive information. According to a new federal audit, following those rules has proven considerably more difficult.
A Government Accountability Office report released October 16 found that military records offices continue to struggle with staffing shortages, growing workloads, and cumbersome processing systems. The consequences include delayed responses to records requests and persistent risks that private information will be disclosed to unauthorized recipients.
In one particularly revealing test, GAO investigators posing as third-party requesters obtained Army personnel records despite submitting a request containing deliberately incomplete information. The Army not only approved a request that should have been rejected or returned for clarification, but also released personally identifiable information that should have been redacted.
The incident was one of 26 covert requests submitted by investigators to evaluate the military services’ safeguards. Of the 18 requests GAO classified as processed, one resulted in an improper disclosure.
The test was not designed to produce a statistically representative failure rate. It nevertheless demonstrated that procedures intended to prevent unauthorized releases do not always function as designed.
And that was hardly the only problem investigators discovered.
Thousands of Requests, Dozens of Breaches
Between fiscal years 2021 and 2025, military personnel centers reported 49 breaches involving the improper release of personally identifiable information, affecting more than 1,000 service members.
GAO found that 44 of those incidents were attributed to human error or failures to follow established policies. The reported breaches represented a small fraction of the hundreds of thousands of records requests processed during the period, but investigators cautioned that the totals could understate the problem because incidents are self-reported.
The information at risk can include Social Security numbers, home addresses, disciplinary records, and other sensitive material contained in a service member’s personnel file.
The potential consequences are not hypothetical.
GAO revisited an earlier Air Force incident in which the military records of 11 individuals, including two members of Congress and several congressional candidates, were released without proper authorization. Some of the improperly disclosed information concerned particularly sensitive matters, including sexual assault.
Following that incident, the Air Force added another reviewer to its records-release process.
The new audit indicates that procedural safeguards alone cannot eliminate the possibility of improper disclosure, particularly when personnel must manually review extensive records and redact sensitive information.
That finding raises a broader question: whether the military services have enough qualified personnel to administer the safeguards they have established.
The Navy’s One-Person FOIA Operation
Perhaps the clearest illustration of the Pentagon’s staffing problem came from the Navy.
During GAO’s review, Navy Personnel Command relied on a single federal civilian employee to process Freedom of Information Act requests. A senior official who previously assisted with the work had retired, and officials reported that there were no plans at the time to replace that employee.
The resulting workload contributed to substantial processing delays, according to Navy officials.
In fiscal year 2018, the Navy reported an average FOIA processing time of approximately 1.6 days. By fiscal year 2024, that figure had increased to 55.5 days. As of July 2025, average processing time had climbed to 77.4 days.
The Freedom of Information Act generally requires federal agencies to make determinations on requests within 20 working days, subject to statutory exceptions and extensions.
Navy officials also reported litigation associated with delayed responses.
The Navy hired an additional employee in December 2025. By April 2026, officials said a backlog reduction plan was in place, with two civilian employees receiving supplemental assistance from reservists and other internal resources.
Whether those measures have produced sustained improvements remains an open question.
The staffing problem was not confined to the Navy.
Army officials reported 16 unfilled positions within their personnel records servicing department in March 2025. The vacancies included positions responsible for processing Privacy Act requests. Officials warned that the staffing gaps increased workloads and could affect both the timeliness and accuracy of records processing.
The Army’s reported FOIA backlog increased from 14 requests in fiscal year 2023 to 68 in fiscal year 2024 and 96 by July 2025.
In March 2026, Army officials told GAO that they had reorganized records-processing responsibilities, centralized request tracking, standardized quality checks, and automated portions of workflow routing. They reported improvements in timeliness and accuracy despite hiring no additional FOIA processing personnel.
The Marine Corps presented another example of how a relatively small vacancy can disrupt an administrative operation.
In July 2025, Marine Corps officials reported no FOIA backlog, although they acknowledged an unfilled administrative position and increased workloads. By September 2026, officials reported a backlog of 75 FOIA requests, attributing the problem to their inability to fill a government administrative vacancy.
The Air Force, meanwhile, reported that three civilian attorneys had departed under the Defense Department’s Deferred Resignation Program, leaving one attorney responsible for processing nongovernmental requests requiring legal review.
Air Force officials said that additional review responsibilities increased processing times.
Its Privacy Act backlog had grown from 165 requests in fiscal year 2018 to 623 by July 2025.
Taken together, the findings describe records operations in which the departure or absence of a handful of employees can create significant administrative bottlenecks.
Workforce Reductions Complicate an Existing Problem
GAO found that staffing challenges had been aggravated by recent Defense Department civilian workforce reductions and hiring freezes, which limited the military services’ ability to fill vacant positions.
The distinction between longstanding staffing problems and more recent personnel reductions is important.
The Navy’s processing delays began increasing years before the latest workforce initiatives. Similarly, some Army and Air Force backlogs predated the personnel changes described in the report.
Consequently, the audit does not establish that recent workforce reductions caused the broader deterioration in records processing, nor does it demonstrate that those reductions caused the reported privacy breaches.
What it does establish is that the services were already struggling to maintain adequate records-processing capacity, and that more recent workforce restrictions have complicated their efforts to address those deficiencies.
GAO also found a significant planning problem.
Despite recurring complaints about inadequate staffing, the military services generally had not conducted workforce planning analyses to determine how many employees were needed to process their existing and projected workloads.
Without those assessments, officials lack a documented basis for determining whether current staffing levels are sufficient, how vacancies affect performance, or what additional resources would be necessary to meet statutory obligations.
GAO reported that FOIA and Privacy Act programs are frequently treated as lower staffing priorities within the department.
The practical result is an administrative system in which records-processing responsibilities remain mandatory even when the personnel assigned to perform them are insufficient.
The law, unfortunately for the staffing charts, does not suspend its requirements when somebody retires.
Acknowledgment Is Not the Same as Compliance
The audit also revealed how agencies attempt to manage requests when they cannot process them promptly.
Navy officials described sending acknowledgment letters to requesters before the expiration of the 20-working-day FOIA deadline, informing them that their requests had been received but had not yet been processed.
Officials believed the practice helped satisfy the intent of the statute.
An acknowledgment, however, is not the same as the determination generally required by FOIA. The law requires agencies to determine whether they will comply with a request and communicate the determination within the applicable statutory period, subject to authorized extensions.
Sending a letter confirming receipt may provide useful information to a requester, but it does not independently establish compliance with the statutory determination deadline.
The distinction is particularly relevant when an agency’s processing delays stretch from days into months.
A requester who receives a timely acknowledgment may know that the government has received the paperwork. That does not necessarily bring the requester any closer to receiving the records.
Military Medical Records Present Another Obstacle
The personnel-records problems represent only part of the Pentagon’s broader records-management challenge.
GAO also examined the Defense Health Agency’s procedures for responding to requests for military medical records.
Investigators found that employees must navigate multiple information systems, retrieve records from different sources, and manually examine documents for information requiring redaction.
The work can become particularly burdensome when medical histories extend across many years or include lengthy scanned documents.
Although the Defense Department completed the worldwide deployment of its modernized MHS GENESIS electronic health record system in 2024, GAO found that the infrastructure used to retrieve and process records requests remained complicated by multiple systems and workflows.
Modernizing the system used to maintain medical information, in other words, did not automatically modernize every administrative process required to release that information.
GAO recommended that the Defense Health Agency assess its records-processing framework and identify opportunities to streamline the work.
That could include examining whether systems can be consolidated or whether additional technological capabilities could reduce the burden of manual processing.
The implications extend beyond administrative efficiency.
Military personnel and veterans may need their records for medical treatment, disability-related matters, employment, and other purposes. Delays can create difficulties for individuals who depend on the government to provide information already maintained in its custody.
At the same time, accelerating processing without adequate safeguards can increase the possibility that sensitive medical or personnel information will be released improperly.
The department must therefore address two obligations that cannot simply be traded against one another: protecting private information and providing lawful access to records.
The Cost of Getting It Wrong
The administrative consequences also carry financial implications.
GAO reported that the Defense Department spent nearly $500 million processing more than 266,000 FOIA requests during fiscal years 2020 through 2024. Approximately $21 million of the department’s FOIA-related expenditures during that period involved litigation.
Those figures do not establish that staffing shortages caused the litigation expenses. FOIA disputes can arise for numerous reasons, including disagreements over exemptions, searches, and the adequacy of agency responses.
Nevertheless, delayed processing can increase exposure to litigation, and GAO specifically identified that risk among the consequences of insufficient records-processing capacity.
The financial question is therefore not simply how much the Pentagon spends employing records-processing personnel.
It is also whether inadequate planning and persistent vacancies produce avoidable administrative costs, legal disputes, and additional work for an already strained system.
GAO concluded that better workforce planning would help the military services align staffing with actual workloads and reduce the risks associated with delayed responses and improper disclosures.
Five Recommendations, and an Unfinished Policy
GAO issued five recommendations intended to improve the Defense Department’s handling of personnel and health-record requests.
Among them were calls for workforce planning that accounts for current and projected records-processing workloads and an assessment of opportunities to streamline the Defense Health Agency’s systems.
The department generally concurred with the recommendations.
But the audit also highlighted an older, unfinished reform.
In 2022, GAO recommended that the Defense Department establish a time frame for defining how senior privacy officials would participate in decisions concerning the hiring, training, and professional development of privacy personnel.
As of October 2026, that policy had not been finalized.
Defense officials attributed the delay to administrative procedures and organizational realignments. The department now expects the policy to be completed by March 2027.
That timetable places the anticipated completion roughly five years after the original recommendation.
It also leaves an important question unanswered: whether the Pentagon can resolve its staffing and records-processing problems without first establishing a reliable process for determining the personnel and expertise those operations require.
A Records System Caught Between Access and Protection
The GAO investigation does not depict a military records system in which every request fails or every office disregards privacy safeguards.
Most requests are processed without a reported breach, and several military services have taken steps to improve their procedures. The Army reported gains from reorganizing existing personnel, while the Navy added staff and developed a backlog reduction plan.
Those developments matter because they demonstrate that the problems are not necessarily permanent or uniform across the department.
What remains unresolved is whether the Pentagon has established the staffing, oversight, and technical capacity needed to perform these functions reliably over time.
The central problem is not an absence of regulations. It is the gap between the obligations imposed by those regulations and the resources and systems available to fulfill them.
For service members, that gap can mean waiting longer for records they are entitled to obtain or discovering that information they expected the government to safeguard was improperly disclosed.
For the Defense Department, it presents a straightforward management challenge: determine what the work requires, provide the resources necessary to perform it, and measure whether the resulting system actually complies with the law.
Until then, the Pentagon risks maintaining a records bureaucracy that can be both too slow to release information and insufficiently reliable at keeping protected information private.
And for the people whose lives are documented in those records, neither outcome is particularly reassuring.
Source: U.S. Government Accountability Office, Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information, GAO-27-107784, October 16, 2026.
Editor’s note: This article distinguishes the documented effects of staffing shortages and workforce restrictions on records processing from the separate issue of privacy breaches. The GAO report does not establish that recent workforce reductions caused the reported unauthorized disclosures.
