HR7241-119

What This Bill Does

The Protect Veterans from the THIEF Act targets VA contractor handling of veterans' data. Within one year, the VA Secretary must ensure every covered contract includes or is modified to include a clause prohibiting covered information from being monetized, sold, or otherwise misused by any contractor, subcontractor, affiliate, or other non-VA entity. VA must also issue a directive or policy guiding employees and contractors on how to identify monetization, sale, or misuse so contractors comply with the contract clauses. Within the same year, VA must report to the House and Senate Veterans' Affairs Committees with the required contract clause, guidance, and a summary of other compliance actions. Covered contracts are VA contracts that handle covered information and were entered into after enactment or before enactment if still active. Covered information means protected health information or personally identifiable information, including anonymized information, protected by the Privacy Act, VA confidentiality statutes, HIPAA regulations, or other law the Secretary identifies.

Who Benefits and How

Veterans, VA patients, VA benefit recipients, veterans privacy advocates, VA contracting officers, and congressional veterans committees benefit from contract clauses and guidance designed to prevent monetization, sale, or misuse of veterans' health and personal data by contractors or affiliates. VA employees get a clearer standard for spotting misuse in covered contracts.

Who Bears the Burden and How

VA contractors, VA subcontractors, contractor affiliates, VA procurement staff, VA privacy officers, VA program offices, and non-VA data handlers face contract modifications, data-use restrictions, compliance monitoring, policy training, and reporting burdens. Contractors lose any ability to monetize or sell covered veteran information handled through VA contracts.

Key Provisions

• Requires VA covered contracts to prohibit monetization, sale, or misuse of covered veteran information.
• Extends the prohibition to contractors, subcontractors, affiliates, and other non-VA entities.
• Includes protected health information, personally identifiable information, and anonymized covered information.
• Requires VA guidance for employees and contractors on identifying misuse.
• Requires a congressional report with the contract clause, guidance, and compliance actions within one year.