H.R. 7241 — Protect Veterans from the THIEF Act

This section prohibits the Secretary of Veterans Affairs from entering into a contract that permits a contractor to sell (or otherwise disclose for consideration) sensitive personal information. (Thus, contractors handling Department of Veterans Affairs data—such as veterans' health records or benefits information—are barred from profiting by selling or sharing it with third parties.)

This section requires the Secretary of Veterans Affairs, not later than one year after the date of enactment, to (1) ensure that each covered contract includes or is modified to include a clause prohibiting covered information from being monetized, sold, or otherwise misused by contractors, subcontractors, affiliates, or other non-Department entities; and (2) issue guidance to Department employees and contractors on identifying such prohibited activities to verify compliance. The section further requires the Secretary to submit a report to the Committees on Veterans’ Affairs of the House of Representatives and the Senate within one year containing the contract clause, guidance, and a summary of other compliance actions. Covered contracts are Department contracts for handling covered information entered into after enactment or preexisting and not expiring before enactment; covered information includes protected health information or personally identifiable information (including anonymized data) protected under the Privacy Act (5 U.S.C. §552a), 38 U.S.C. §§5701 and 7332, HIPAA regulations (45 C.F.R. pts. 160, 161, and 164), or other applicable laws.