HR9152-119

What This Bill Does

The VETRA Act would require the Department of Veterans Affairs to run a two-year pilot that replaces legacy knowledge-based or single-factor identity checks with higher-assurance digital identity tools. VA would select no more than three high-volume digital service platforms, potentially including disability compensation, health enrollment, education benefits, or home-loan systems. Each selected platform could include multiple underlying systems or applications.

VA would map transactions to different identity-assurance levels based on sensitivity, fraud risk, and potential harm. It would use adaptive authentication that adjusts to contextual and behavioral risk signals and, where practicable under federal standards, reserve more demanding checks for transactions that warrant them. The pilot's stated goals are to reduce fraud and improper payments, improve secure access for veterans and other eligible beneficiaries, and measure savings and operational performance before any wider deployment.

Every pilot solution would have to be commercially available rather than developed only for VA. It would need independent certification at Identity Assurance Level 2 or higher, multi-factor authentication at Authentication Assurance Level 2 or higher, and compliance with applicable VA confidentiality, Privacy Act, federal information-security, cybersecurity, and privacy requirements.

VA could spend no more than $25 million in total from amounts already authorized for its information technology systems. The bill would authorize no additional funding. An implementation plan would be due within 120 days of enactment. Within one year after the pilot begins, VA would report completion, authentication, account-recovery, abandonment, fraud, cost, and cybersecurity metrics against pre-pilot baselines. A final evaluation and legislative recommendations would be due 90 days before the pilot authority expires.

The Government Accountability Office would independently evaluate the pilot within 18 months of enactment. Its review would cover standards compliance, fraud and unauthorized access, cost and financial benefits, risk-tiered authentication, scalability, integration, and access effects for rural veterans, veterans with disabilities, and veterans with limited digital literacy. GAO would recommend expansion, modification, or discontinuation. The pilot authority would end two years after enactment, and VA could not exceed the stated scope or funding cap without a later Act of Congress.

Who Benefits and How

Veterans and other VA beneficiaries could face less account takeover, identity theft, and benefit fraud while using participating platforms. Risk-based checks could avoid imposing the strongest authentication on routine low-risk transactions. Federal taxpayers and VA programs could benefit if stronger identity proofing reduces improper payments and support costs. Vendors offering commercially available, independently certified identity and multi-factor-authentication products could compete for pilot work.

Who Bears the Burden and How

Users of participating platforms would have to complete stronger identity proofing and multi-factor authentication. Rural veterans, people with disabilities, and users with limited digital literacy could encounter device, connectivity, accessibility, recovery, or support barriers; the bill requires GAO to measure those effects but does not prescribe a particular accommodation. VA would divert up to $25 million from existing IT authority, implement the pilot, support users, protect sensitive data, collect baselines, and report performance. GAO would conduct a separate technical and access evaluation.

Key Provisions

• Requires a VA digital identity pilot on no more than three high-volume platforms.
• Replaces legacy checks with risk-tiered, adaptive, multi-factor authentication.
• Requires commercial solutions independently certified at IAL2 and AAL2 or higher.
• Limits total spending to $25 million from existing VA information-technology authority.
• Requires an implementation plan plus interim and final VA performance reports.
• Directs GAO to evaluate security, savings, scalability, and veteran access.
• Terminates pilot authority two years after enactment.
• Prohibits administrative expansion of the scope or funding cap.