H.R. 7280 — Veteran DATA Act

This section prohibits the Secretary of Veterans Affairs from entering into a contract that permits a contractor to sell (or otherwise disclose for consideration) sensitive personal information. (Thus, this requirement supplements existing contract mandates for nondisclosure, breach notification, and liquidated damages applicable to Department contracts requiring access to such information.)

This section directs the Secretary of Veterans Affairs, not later than one year after enactment, to (1) ensure that each covered contract includes or is modified to include a clause prohibiting contractors, subcontractors, affiliates, or other non-VA entities from monetizing, selling, or misusing covered information; and (2) issue guidance to VA employees and contractors on identifying such prohibited activities to verify contractor compliance. The section also requires the Secretary to submit a report to the House and Senate Committees on Veterans’ Affairs within the same timeframe containing a copy of the contract clause, the guidance, and a summary of other compliance actions. It defines covered contracts as VA contracts handling covered information that are entered into after enactment or entered into before enactment and do not expire before enactment; and covered information as protected health information or personally identifiable information (including anonymized data) protected under the Privacy Act (5 U.S.C. 552a), 38 U.S.C. §§ 5701 or 7332, HIPAA regulations (45 C.F.R. pts. 160, 161, 164), or other laws as determined by the Secretary.