In a report delivered to Congress on Monday, the Air Force blamed Airman 1st Class Jack D. Teixeira’s superiors for failing to restrict his access to classified systems and facilities and to alert appropriate authorities during the time that he was alleged to have been illegally sharing government secrets.

The Air Force completed its investigation in August, but notified Congress and disclosed the findings Monday after being informed that The Washington Post was publishing a multipart investigation into the Discord leaks. The first article in the series published Monday morning; a “Frontline”/Post documentary will premiere Tuesday.

The office of the Air Force inspector general found that while Teixeira is believed to have worked alone to smuggle classified documents from his workplace at Otis Air National Guard Base in Massachusetts — and post photographs of them online — other members in his unit “had information about as many as four separate instances of his questionable activity.”

“After interviewing higher levels of the supervisory chain, it appears knowledge of these security incidents was not fully disclosed above the squadron level,” said an eight-page summary of the investigation. It added that “three individuals in the unit who understood their duty to report specific information regarding A1C Teixeira’s intelligence-seeking and insider threat indicators to security officials, intentionally failed to do so.” Some feared that security officials might “overreact,” the summary added.

The lack of action, investigators found, allowed Teixeira to share hundreds of classified pages that he posted on several online servers on the gaming chat platform Discord. It marked one of the Pentagon’s most embarrassing leaks in years, prompting outcry from allies and partners, frustration from senior defense officials, and felony charges for Teixeira, who was arrested in an FBI raid at his family’s home in Dighton, Mass., in April. Teixeira has pleaded not guilty to several related charges.

Air Force officials said in a statement that the 15 who were disciplined range in rank from staff sergeant to colonel. Air National Guard leaders began the disciplinary process Sept. 7, removing some personnel from their positions and filing administrative action known as nonjudicial punishment against others, the service said.

Ann Stefanek, an Air Force spokeswoman, said that once the report was completed, it was provided to both active-duty leaders and the Massachusetts Air National Guard, with all disciplinary actions completed by Dec. 2. National Guard members are in uniform less frequently, she noted, complicating how quickly disciplinary actions occur.

Air Force Secretary Frank Kendall said in the service’s statement released Monday that every airman is entrusted with safeguarding classified information, and that the service will “hold responsible individuals accountable” when there is a “breach of that sacred trust.”

“Our national security demands leaders at every level protect critical assets, ensuring they do not fall into the hands of those who would do the United States or our allies and partners harm,” he said.

Senior Air Force officials kept Defense Secretary Lloyd Austin apprised of the investigation as it was carried out, said Maj. Gen. Patrick Ryder, a Pentagon spokesman. Ryder, asked whether Austin had a reaction to the findings, said the secretary is “confident the Air Force is taking necessary steps to look into this.”

Among those punished, Air Force officials said, is Col. Sean Riley, who was commander of the 102nd Intelligence Wing, a Massachusetts Air National Guard unit to which Teixeira reported. Col. Enrique Dovalo, the former commander of the subordinate 102nd Intelligence, Surveillance and Reconnaissance Group, also was cited “for concerns with unit culture and compliance with policies and standards,” according to Air Force officials.

Riley was relieved of command; the Air Force did not publicly disclose the nature of Dovalo’s punishment. Neither officer responded Monday to requests for comment, and the Massachusetts Air National Guard said in an email that they would not be granting interviews at this time.

Riley was removed from his command position on Nov. 1, a detail not disclosed until Monday. Dovalo already had moved on to another role, said a defense official familiar with the issue, speaking on the condition of anonymity to address personnel matters. The majority of the disciplinary decisions were made within the Massachusetts Air National Guard, the official said.

Riley suspended lower-ranking personnel in April from their positions in the smaller 102nd Intelligence Support Squadron and the detachment of National Guard members to which Teixeira reported most directly. They now have been “permanently removed” from those jobs, Air Force officials said Monday.

In June, Riley referenced the investigation in a brief video message to personnel under his command, saying that, like the New England Patriots, they needed to make needed adjustments and improvements while also preparing for the future.

“Based on the inspector general review at the end of April, we know we need to Boost some of our internal processes and procedures,” he said. “We have already started to implement the corrective actions that are required, and while we need to focus on quickly this important task, we can’t lose sight of what’s ahead for the 102nd.”

The investigation was launched in April after the documents that Teixeira allegedly posted online on a closed Discord server migrated to other social media networks, including Twitter, later renamed X, and then spread virally. Officials for the Air Force said at the time that it had temporarily reassigned the mission of the 102nd Intelligence Wing — which typically scrutinizes drone feeds, satellite photography and other imagery to inform U.S. military operations — to other parts of the Air Force. That remained the case Monday, and it is not clear whether service officials intend to reinstate that intelligence mission at Otis.

Investigators found that another direct contributing factor to the leak was an effort by commanders at Otis to share unnecessary U.S. military intelligence with relatively inexperienced airmen like Teixeira, who enlisted in 2019 while in high school and turns 22 this month.

“This ‘know your why’ effort was improper in that it provided higher level classified information than was necessary to understand the unit’s mission and created ambiguity” for Teixeira’s colleagues to question his need to know classified information, the summary report said.

Dovalo, one of the officers disciplined, had touted that effort in a video posted by the 102nd Intelligence Wing to Facebook in October 2021. He and other commanders with the 102nd, he said, would be “rolling out classified threat briefings for all cleared wing members, so you can better understand the depth and breadth of the global security environment for which we must be prepared.”

The investigation found several other “indirect contributing factors,” as well. They include a lack of supervision on overnight shift operations, during which Teixeira carried out his job on a three-member team. When there were no nighttime intelligence missions, the summary said, Teixeira and his colleagues “were the only personnel” in a facility handling information labeled top-secret, sensitive compartmented information, or “TS-SCI.”

“Their primary role was to ensure the Heating, Ventilation and Air Condition (HVAC) system was operating properly and answer the phones,” the Air Force found. “At times, members were required to perform preventative maintenance inspections and other tasks, which required individuals to be on their own for hours, unsupervised in other parts of the facility.”

The unit also did not require permission controls to monitor print jobs and placed no rules on print products, the Air Force found. Any night-shift member, it added, had “ample opportunity” to access classified networks like the Joint Worldwide Intelligence Communication System (JWICS), a clearinghouse of classified documents, “and print a high volume of products without supervision or detection.”

Those protocols might have troubled Teixeira’s commanders had they known about his past, which included a high school suspension for making threatening remarks about molotov cocktails and weapons, according to a police report obtained by The Post and court documents filed in his case. But details reviewed during background checks are “not routinely shared with a member’s unit,” the Air Force investigation noted.

“While information in A1C Teixeira’s background check did not ultimately preclude him from receiving his clearance, there were indications that A1C Teixeira could have been subject to enhanced monitoring,” the investigation found. “In addition, had the unit been made aware of potential security concerns identified during the clearance adjudication process, they may have acted more quickly after identifying additional insider threat indicators.”

The Air Force also cited a disconnect between the members of the 102nd at Otis and leaders with the 201st Mission Support Squadron, an active-duty unit at Joint Base Andrews in Maryland to which Teixeira and other personnel were assigned administratively while working in full-time roles. While National Guard leaders can discipline their own people, they must coordinate with an active-duty unit when a member is on active-duty orders, investigators noted.

“According to some witnesses, this coordination process took additional time to accomplish disciplinary actions and it was believed this affected good order and discipline,” the Air Force found. Commanders at Otis might have opted for verbal counseling or informal memos rather than documented disciplinary action, which “effectively bypassed existing standards for progressive discipline” and stopped some troops from receiving appropriate oversight.

Rachel VanLandingham, a retired Air Force lawyer, questioned whether the Air Force’s disciplinary actions go far enough.

VanLandingham, a professor at Southwestern Law School in Los Angeles, said there are “no long-term repercussions or deterrent message” in the decisions that commanders reached.

“It feels like there is a culture of complacency even higher up, and the commanders are getting off very lightly,” she said. “I don’t see appropriate actions being taken in terms of their responsibilities as commanders.”

Alice Crites contributed to this report.

The policy was revealed in a letter sent late Monday to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.).

The members began investigating the practice after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion.

The revelation could shape the debate over Americans’ expectations of privacy as Texas and other states move to criminalize abortion and drugs related to reproductive health.

Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control.

Because the chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote last year that this could link a person’s out-of-state medical care via a “digital trail” back to their home state.

The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

In briefings, officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

A subpoena can be issued by a government agency and, unlike a court order or warrant, does not require a judge’s approval. To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime.

Officials with CVS, Kroger and Rite Aid said they instruct their pharmacy staff members to process law enforcement requests on the spot, saying the staff members face “extreme pressure to immediately respond,” the lawmakers’ letter said.

The eight pharmacy giants told congressional investigators that they collectively received tens of thousands of legal demands every year, and that most were in connection with civil lawsuits. It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled.

Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a “gag order,” preventing it from doing so, the lawmakers said.

Americans can request the companies tell them if they’ve ever disclosed their data under a HIPAA “accounting of disclosure” rule, but very few people do. CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a “single-digit number” of such consumer requests last year, the letter states.

CVS, the country’s largest pharmacy by prescription revenue, said in a statement that it is compliant with HIPAA and that its pharmacy teams are “trained on how to appropriately respond to lawful requests from regulatory agencies and law enforcement.”

“We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections,” company spokeswoman Amy Thibault said.

Most investigative requests come with a directive requiring the company to keep them confidential, she said; for those that don’t, the company considers “on a case-by-case basis whether it’s appropriate to notify the individual.” The company intends to begin publishing a transparency report that will include information on third-party record requests starting in the first quarter of next year, she said.

HHS did not immediately respond to requests for comment.

A Walgreens spokesman said the company’s law enforcement process follows HIPAA and other applicable laws. A Walmart spokeswoman said the company takes its “customers’ privacy seriously as well as our obligation to law enforcement.”

An Amazon spokeswoman said that the company cooperates with law enforcement requests as required and that such requests “represent a very small percentage of the prescriptions we fill for customers.” (Amazon founder Jeff Bezos owns The Washington Post, and interim Post CEO Patty Stonesifer is a member of Amazon’s board.)

Rite Aid declined to comment. The other companies did not respond to requests for comment.

Carmel Shachar, an assistant clinical professor at Harvard Law School who researches health law and policy, said that pharmacies hold a “ton of sensitive data” and that pharmacists are probably not trained to evaluate the merits or validity of a police request — or to turn an officer down.

“These need to go to someone who understands privacy law for review,” she said. “It probably feels very nerve-racking to get a subpoena and tell the person who gave it to you, ‘Oh, you’ll have to wait.’”

The pharmacy data could be especially concerning for the nearly 1 in 3 women ages 15 to 44 who a Post analysis found live in states where abortion is fully or mostly banned.

In Texas, Attorney General Ken Paxton (R) has warned pharmacies they could face criminal charges for providing women with “abortion-inducing drugs.” Kate Cox, a Dallas-area mother of two who sought an abortion after learning her fetus had a fatal genetic condition, left the state on Monday after the Texas Supreme Court blocked a lower-court ruling that would have allowed her to get the procedure.

Some states, such as Louisiana, Montana and Pennsylvania, offer additional protections for medical data disclosure, though federal law enforcement is not subject to their laws.

In their letter, the lawmakers called on HHS to strengthen HIPAA’s rules and ensure pharmacies insist on a warrant, which would require law enforcement go to court to enforce such requests.

The lawmakers noted that the tech industry had adopted a similar change in the early 2010s, when Google, Microsoft and Yahoo began demanding to see warrants before providing data on customers’ emails.

They also urged the companies to proactively notify customers and to publish regular transparency reports highlighting the volume of law enforcement requests.

“Americans deserve to have their private medical information protected at the pharmacy counter,” they wrote.