IB 
Union Calendar No. 387 
109TH CONGRESS 
2D SESSION 
H. R. 5835 
[Report No. 109–651, Part I] 
To amend title 38, United States Code, to improve information management 
within the Department of Veterans Affairs, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 19, 2006 
Mr. BUYER (for himself, Mr. FILNER, Mr. BILIRAKIS, Mr. EVANS, Mr. 
STEARNS, Mr. GUTIERREZ, Mr. BURTON of Indiana, Ms. CORRINE 
BROWN of Florida, Mr. BROWN of South Carolina, Mr. MICHAUD, Mr. 
MILLER of Florida, Ms. HERSETH, Mr. BOOZMAN, Mr. STRICKLAND, Mr. 
BRADLEY of New Hampshire, Mr. REYES, Ms. GINNY BROWN-WAITE of 
Florida, Ms. BERKLEY, Mr. BILBRAY, Mr. SALAZAR, Mr. TOM DAVIS of 
Virginia, Mr. WAXMAN, Mr. WALSH, Mr. EDWARDS, Mr. DINGELL, and 
Ms. SCHAKOWSKY) introduced the following bill; which was referred to 
the Committee on Veterans’ Affairs, and in addition to the Committee 
on Government Reform, for a period to be subsequently determined by 
the Speaker, in each case for consideration of such provisions as fall with-
in the jurisdiction of the committee concerned 
SEPTEMBER 13, 2006 
Additional sponsors: Mr. MORAN of Kansas, Mr. BOSWELL, Mr. HAYES, Ms. 
WATSON, Mrs. BONO, Mr. COSTA, Mr. CARTER, Mr. CASE, Mr. BROWN 
of Ohio, Ms. JACKSON-LEE of Texas, Mr. JOHNSON of Illinois, Mr. GER-
LACH, Mr. DAVIS of Florida, Mr. WOLF, Mr. WELDON of Pennsylvania, 
Mrs. DRAKE, Mr. MANZULLO, Mr. BISHOP of Georgia, Mr. GONZALEZ, 
Mr. ABERCROMBIE, Mrs. CAPITO, Mr. DOGGETT, Mr. FORTUN˜O, Mr. 
CAMP of Michigan, Mr. SOUDER, Mr. ENGLISH of Pennsylvania, Mr. 
YOUNG of Florida, Mr. HIGGINS, Mr. SMITH of Washington, Mr. CAL-
VERT, Mr. SCHWARZ of Michigan, Mr. KUHL of New York, Mr. 
MCDERMOTT, Mr. CUMMINGS, Mr. BARROW, Mrs. DAVIS of California, 
Mr. BARTLETT of Maryland, Mr. PASTOR, Mrs. BLACKBURN, Mr. RENZI, 
and Mr. EVERETT 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
SEPTEMBER 13, 2006 
Reported from the Committee on Veterans’ Affairs with an amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
SEPTEMBER 13, 2006 
The Committee on Government Reform discharged; committed to the Com-
mittee of the Whole House on the State of the Union and ordered to be 
printed 
[For text of introduced bill, see copy of bill as introduced on July 19, 2006] 
A BILL 
To amend title 38, United States Code, to improve informa-
tion management within the Department of Veterans 
Affairs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans Identity and 
Credit Security Act of 2006’’. 
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION RE-
QUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MANAGE-
MENT AND BUDGET TO ESTABLISH DATA BREACH POLI-
CIES.—Section 3543(a) of title 44, United States Code, is 
amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00002
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
(3) by adding at the end the following new para-
graph: 
‘‘(9) establishing policies, procedures, and stand-
ards for agencies to follow in the event of a breach of 
data security involving the disclosure of sensitive per-
sonal information in violation of section 552a of title 
5, including a requirement for timely notice to be 
given to those individuals whose sensitive personal in-
formation could be compromised as a result of such 
breach, except no notice shall be required if the breach 
does not create a reasonable risk of identity theft, 
fraud, or other unlawful conduct regarding such indi-
vidual.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER TO 
ENFORCE DATA BREACH POLICIES.—Section 3544(a)(3) of 
title 44, United States Code, is amended by inserting after 
‘‘authority to ensure compliance with’’ the following: ‘‘and, 
to the extent determined necessary and explicitly authorized 
by the head of the agency, to enforce’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY
INFORMATION
SECURITY
PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following new para-
graph: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards estab-
lished under section 3543(a)(9) of this title.’’. 
(d) SENSITIVE
PERSONAL
INFORMATION
DEFINI-
TION.—Section 3542(b) of title 44, United States Code, is 
amended by adding at the end the following new paragraph: 
‘‘(4) The term ‘sensitive personal information’ 
means any information contained in a record, as de-
fined in section 552a(4) of title 5.’’. 
SEC. 3. UNDER SECRETARY FOR INFORMATION SERVICES. 
(a) UNDER SECRETARY.—Chapter 3 of title 38, United 
States Code, is amended by inserting after section 307 the 
following new section: 
‘‘§ 307A. Under Secretary for Information Services 
‘‘(a) UNDER SECRETARY.—There is in the Department 
an Under Secretary for Information Services, who is ap-
pointed by the President, by and with the advice and con-
sent of the Senate. The Under Secretary shall be the head 
of the Office of Information Services and shall perform such 
functions as the Secretary shall prescribe. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(b) SERVICE AS CHIEF INFORMATION OFFICER.— 
Notwithstanding any other provision of law, the Under Sec-
retary for Information Services shall serve as the Chief In-
formation Officer of the Department under section 310 of 
this title.’’. 
(b) CLERICAL AMENDMENT.—The table of sections at 
the beginning of such chapter is amended by inserting after 
the item relating to section 307 the following new item: 
‘‘307A. Under Secretary for Information Services.’’. 
(c) CONFORMING AMENDMENT.—Section 308(b) of 
such title is amended by striking paragraph (5) and redes-
ignating paragraphs (6) through (11) as paragraphs (5) 
through (10), respectively. 
SEC. 4. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY. 
(a) INFORMATION SECURITY.—Chapter 57 of title 38, 
United States Code, is amended by adding at the end the 
following new subchapter: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘§ 5721. Definitions 
‘‘For the purposes of this subchapter: 
‘‘(1) The term ‘sensitive personal information’ 
means the name, address, or telephone number of an 
individual, in combination with any of the following: 
‘‘(A) The Social Security number of the in-
dividual. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(B) The date of birth of the individual. 
‘‘(C) Any information not available as part 
of the public record regarding the individual’s 
military service or health. 
‘‘(D) Any financial account or other finan-
cial information relating to the individual. 
‘‘(E) The driver’s license number or equiva-
lent State identification number of the indi-
vidual. 
‘‘(F) The deoxyribonucleic acid profile or 
other unique biometric data of the individual, 
including the fingerprint, voice print, retina or 
iris image, or other unique physical representa-
tion of the individual. 
‘‘(2) The term ‘data breach’ means the loss, theft, 
or other unauthorized access to data containing sen-
sitive personal information, in electronic or printed 
form, that results in the potential compromise of the 
confidentiality or integrity of the data. 
‘‘(3) The term ‘data breach analysis’ means the 
identification of any misuse of sensitive personal in-
formation involved in a data breach. 
‘‘(4) The term ‘fraud resolution services’ means 
services to assist an individual in the process of recov-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
ering and rehabilitating the credit of the individual 
after the individual experiences identity theft. 
‘‘(5) The term ‘identity theft’ has the meaning 
given such term under section 603 of the Fair Credit 
Reporting Act (15 U.S.C. 1681a). 
‘‘(6) The term ‘identity theft insurance’ means 
any insurance policy that pays benefits for costs, in-
cluding travel costs, notary fees, and postage costs, 
lost wages, and legal fees and expenses associated with 
the identity theft of the insured individual. 
‘‘(7) The term ‘principal credit reporting agency’ 
means a consumer reporting agency as described in 
section 603(p) of the Fair Credit Reporting Act (15 
U.S.C. 1681a(p)). 
‘‘§ 5722. Office of the Under Secretary for Information 
Services 
‘‘(a) DEPUTY UNDER SECRETARIES.—The Office of the 
Under Secretary for Information Services shall consist of 
the following: 
‘‘(1) The Deputy Under Secretary for Informa-
tion Services for Security, who shall serve as the Sen-
ior Information Security Officer of the Department. 
‘‘(2) The Deputy Under Secretary for Informa-
tion Services for Operations and Management. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(3) The Deputy Under Secretary for Informa-
tion Services for Policy and Planning. 
‘‘(b) APPOINTMENTS.—Appointments under subsection 
(a) shall be made by the Secretary, notwithstanding the 
limitations of section 709 of this title. 
‘‘(c) QUALIFICATIONS.—At least one of positions estab-
lished and filled under subsection (a) shall be filled by an 
individual who has at least five years of continuous service 
in the Federal civil service in the executive branch imme-
diately preceding the appointment of the individual as a 
Deputy Under Secretary. For purposes of determining such 
continuous service of an individual, there shall be excluded 
any service by such individual in a position— 
‘‘(1) of a confidential, policy-determining, pol-
icy-making, or policy-advocating character; 
‘‘(2) in which such individual served as a non-
career appointee in the Senior Executive Service, as 
such term is defined in section 3132(a)(7) of title 5; 
or 
‘‘(3) to which such individual was appointed by 
the President. 
‘‘§ 5723. Information security management 
‘‘(a) RESPONSIBILITIES OF CHIEF INFORMATION OF-
FICER.—To support the economical, efficient, and effective 
execution of subtitle III of chapter 35 of title 44, and poli-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
cies and plans of the Department, the Secretary shall ensure 
that the Chief Information Officer of the Department has 
the authority and control necessary to develop, approve, im-
plement, integrate, and oversee the policies, procedures, 
processes, activities, and systems of the Department relating 
to that subtitle, including the management of all related 
mission applications, information resources, personnel, and 
infrastructure. 
‘‘(b) ANNUAL COMPLIANCE REPORT.—Not later than 
March 1 of each year, the Secretary shall submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives, the Committee on Government Reform 
of the House of Representatives, and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate, a report on the Department’s compliance with subtitle 
III of chapter 35 of title 44. The information in such report 
shall be displayed in the aggregate and separately for each 
Administration, office, and facility of the Department. 
‘‘(c) REPORTS TO SECRETARY OF COMPLIANCE DEFI-
CIENCIES.—(1) At least once every month, the Chief Infor-
mation Officer shall report to the Secretary any deficiency 
in the compliance with subtitle III of chapter 35 of title 
44 of the Department or any Administration, office, or fa-
cility of the Department. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(2) The Chief Information Officer shall immediately 
report to the Secretary any significant deficiency in such 
compliance. 
‘‘(d) DATA BREACHES.—(1) The Chief Information 
Officer shall immediately provide notice to the Secretary 
of any data breach. 
‘‘(2) Immediately after receiving notice of a data 
breach under paragraph (1), the Secretary shall provide no-
tice of such breach to the Director of the Office of Manage-
ment and Budget, the Inspector General of the Department, 
and, if appropriate, the Federal Trade Commission and the 
United States Secret Service. 
‘‘(e) BUDGETARY MATTERS.—When the budget for any 
fiscal year is submitted by the President to Congress under 
section 1105 of title 31, the Secretary shall submit to Con-
gress a report that identifies amounts requested for Depart-
ment implementation and remediation of and compliance 
with this subchapter and subtitle III of chapter 35 of title 
44. The report shall set forth those amounts both for each 
Administration within the Department and for the Depart-
ment in the aggregate and shall identify, for each such 
amount, how that amount is aligned with and supports 
such implementation and compliance. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘§ 5724. Congressional reporting and notification of 
data breaches 
‘‘(a) QUARTERLY REPORTS.—(1) Not later than 30 
days after the last day of a fiscal quarter, the Secretary 
shall submit to the Committees on Veterans’ Affairs of the 
Senate and House of Representatives a report on any data 
breach with respect to sensitive personal information proc-
essed or maintained by the Department that occurred dur-
ing that quarter. 
‘‘(2) Each report submitted under paragraph (1) shall 
identify, for each data breach covered by the report, the Ad-
ministration and facility of the Department responsible for 
processing or maintaining the sensitive personal informa-
tion involved in the data breach. 
‘‘(b) 
NOTIFICATION
OF
SIGNIFICANT
DATA 
BREACHES.—(1) In the event of a data breach with respect 
to sensitive personal information processed or maintained 
by the Secretary that the Secretary determines is signifi-
cant, the Secretary shall provide notice of such breach to 
the Committees on Veterans’ Affairs of the Senate and 
House of Representatives. 
‘‘(2) Notice under paragraph (1) shall be provided 
promptly following the discovery of such a data breach and 
the implementation of any measures necessary to determine 
the scope of the breach, prevent any further breach or unau-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
thorized disclosures, and reasonably restore the integrity of 
the data system. 
‘‘§ 5725. Data breaches 
‘‘(a) INDEPENDENT RISK ANALYSIS.—(1) In the event 
of a data breach with respect to sensitive personal informa-
tion that is processed or maintained by the Secretary, the 
Secretary shall ensure that, as soon as possible after the 
data breach, a non-Department entity conducts an inde-
pendent risk analysis of the data breach to determine the 
level of risk associated with the data breach for the potential 
misuse of any sensitive personal information involved in 
the data breach. 
‘‘(2) If the Secretary determines, based on the findings 
of a risk analysis conducted under paragraph (1), that a 
reasonable risk exists for the potential misuse of sensitive 
information involved in a data breach, the Secretary shall 
provide credit protection services in accordance with section 
5726 of this title. 
‘‘(b) NOTIFICATION.—(1) In the event of a data breach 
with respect to sensitive personal information that is proc-
essed or maintained by the Secretary, the Secretary shall 
provide to an individual whose sensitive personal informa-
tion is involved in that breach notice of the data breach— 
‘‘(A) in writing; or 
‘‘(B) by email, if— 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(i) the Department’s primary method of 
communication with the individual is by email; 
and 
‘‘(ii) the individual has consented to receive 
such notification. 
‘‘(2) Notice provided under paragraph (1) shall— 
‘‘(A) describe the circumstances of the data 
breach and the risk that the breach could lead to mis-
use, including identity theft, involving the sensitive 
personal information of the individual; 
‘‘(B) describe the specific types of sensitive per-
sonal information that was compromised as a part of 
the data breach; 
‘‘(C) describe the actions the Department is tak-
ing to remedy the data breach; 
‘‘(D) inform the individual that the individual 
may request a fraud alert and credit security freeze 
under this section; 
‘‘(E) clearly explain the advantages and dis-
advantages to the individual of receiving fraud alerts 
and credit security freezes under this section; and 
‘‘(F) includes such other information as the Sec-
retary determines is appropriate. 
‘‘(3) The notice required under paragraph (1) shall be 
provided promptly following the discovery of a data breach 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
and the implementation of any measures necessary to deter-
mine the scope of the breach, prevent any further breach 
or unauthorized disclosures, and reasonably restore the in-
tegrity of the data system. 
‘‘(c) REPORT.—For each data breach with respect to 
sensitive personal information processed or maintained by 
the Secretary, the Secretary shall promptly submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives a report containing the findings of any 
independent risk analysis conducted under subsection 
(a)(1), any determination of the Secretary under subsection 
(a)(2), and a description of any credit protection services 
provided under section 5726 of this title. 
‘‘(d) FINAL DETERMINATION.—Notwithstanding sec-
tions 511 and 7104(a) of this title, any determination of 
the Secretary under subsection (a)(2) with respect to the 
reasonable risk for the potential misuse of sensitive informa-
tion involved in a data breach is final and conclusive and 
may not be reviewed by any other official, administrative 
body, or court, whether by an action in the nature of man-
damus or otherwise. 
‘‘(e) FRAUD ALERTS.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall arrange, upon the request of an individual whose sen-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
sitive personal information is involved in the breach to a 
principal credit reporting agency with which the Secretary 
has entered into a contract under section 5726(d) and at 
no cost to the individual, for the principal credit reporting 
agency to provide fraud alert services for that individual 
for a period of not less than one year, beginning on the 
date of such request, unless the individual requests that such 
fraud alert be removed before the end of such period, and 
the agency receives appropriate proof of the identity of the 
individual for such purpose. 
‘‘(2) The Secretary shall arrange for each principal 
credit reporting agency referred to in paragraph (1) to pro-
vide any alert requested under such subsection in the file 
of the individual along with any credit score generated in 
using that file, for a period of not less than one year, begin-
ning on the date of such request, unless the individual re-
quests that such fraud alert be removed before the end of 
such period, and the agency receives appropriate proof of 
the identity of the individual for such purpose. 
‘‘(f) CREDIT SECURITY FREEZE.—(1) In the event of 
a data breach with respect to sensitive personal information 
that is processed or maintained by the Secretary, the Sec-
retary shall arrange, upon the request of an individual 
whose sensitive personal information is involved in the 
breach and at no cost to the individual, for each principal 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
credit reporting agency to apply a security freeze to the file 
of that individual for a period of not less than one year, 
beginning on the date of such request, unless the individual 
requests that such security freeze be removed before the end 
of such period, and the agency receives appropriate proof 
of the identity of the individual for such purpose. 
‘‘(2) The Secretary shall arrange for a principal credit 
reporting agency applying a security freeze under para-
graph (1)— 
‘‘(A) to send a written confirmation of the secu-
rity freeze to the individual within five business days 
of applying the freeze; 
‘‘(B) to refer the information regarding the secu-
rity freeze to other consumer reporting agencies; 
‘‘(C) to provide the individual with a unique 
personal identification number or password to be used 
by the individual when providing authorization for 
the release of the individual’s credit for a specific 
party or period of time; and 
‘‘(D) upon the request of the individual, to tem-
porarily lift the freeze for a period of time specified 
by the individual, beginning not later than three 
business days after the date on which the agency re-
ceives the request. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘§ 5726. Provision of credit protection services 
‘‘(a) COVERED INDIVIDUAL.—For purposes of this sec-
tion, a covered individual is an individual whose sensitive 
personal information that is processed or maintained by 
the Department (or any third-party entity acting on behalf 
of the Department) is involved, on or after August 1, 2005, 
in a data breach for which the Secretary determines a rea-
sonable risk exists for the potential misuse of sensitive per-
sonal information under section 5725(a)(2) of this title. 
‘‘(b) NOTIFICATION.—(1) In addition to any notice re-
quired under subsection 5725(b) of this title, the Secretary 
shall provide to a covered individual notice in writing 
that— 
‘‘(A) the individual may request credit protec-
tion services under this section; 
‘‘(B) clearly explains the advantages and dis-
advantages to the individual of receiving credit pro-
tection services under this section; 
‘‘(C) includes a notice of which principal credit 
reporting agency the Secretary has entered into a con-
tract with under subsection (d), and information 
about requesting services through that agency; 
‘‘(D) describes actions the individual can or 
should take to reduce the risk of identity theft; and 
‘‘(E) includes such other information as the Sec-
retary determines is appropriate. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(2) The notice required under paragraph (1) shall be 
made as promptly as possible and without unreasonable 
delay following the discovery of a data breach for which 
the Secretary determines a reasonable risk exists for the po-
tential misuse of sensitive personal information under sec-
tion 5725(a)(2) of this title and the implementation of any 
measures necessary to determine the scope of the breach, 
prevent any further breach or unauthorized disclosures, and 
reasonably restore the integrity of the data system. 
‘‘(3) The Secretary shall ensure that each notification 
under paragraph (1) includes a form or other means for 
readily requesting the credit protection services under this 
section. Such form or other means may include a telephone 
number, email address, or Internet website address. 
‘‘(c) AVAILABILITY OF SERVICES THROUGH OTHER 
GOVERNMENT AGENCIES.—If a service required to be pro-
vided under this section is available to a covered individual 
through another department or agency of the Government, 
the Secretary and the head of that department or agency 
may enter into an agreement under which the head of that 
department or agency agrees to provide that service to the 
covered individual. 
‘‘(d) CONTRACT WITH CREDIT REPORTING AGENCY.— 
Subject to the availability of appropriations and notwith-
standing any other provision of law, the Secretary shall 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
enter into contracts or other agreements as necessary with 
one or more principal credit reporting agencies in order 
to ensure, in advance, the provision of credit protection 
services under this section and fraud alerts and security 
freezes under section 5725 of this title. Any such contract 
or agreement may include provisions for the Secretary to 
pay the expenses of such a credit reporting agency for the 
provision of such services. 
‘‘(e) DATA BREACH ANALYSIS.—The Secretary shall 
arrange, upon the request of a covered individual and at 
no cost to the individual, to provide data breach analysis 
for the individual for a period of not less than one year, 
beginning on the date of such request. 
‘‘(f) PROVISION OF CREDIT MONITORING SERVICES 
AND IDENTITY THEFT INSURANCE.—During the one-year 
period beginning on the date on which the Secretary notifies 
a covered individual that the individual’s sensitive personal 
information is involved in a data breach, the Secretary 
shall arrange, upon the request of the individual and with-
out charge to the individual, for the provision of credit mon-
itoring services to the individual. Credit monitoring serv-
ices under this subsection shall include each of the following: 
‘‘(1) One copy of the credit report of the indi-
vidual every three months. 
‘‘(2) Fraud resolution services for the individual. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(3) Identity theft insurance in a coverage 
amount that does not exceed $30,000 in aggregate li-
ability for the insured. 
‘‘§ 5727. Contracts for data processing or maintenance 
‘‘(a) CONTRACT REQUIREMENTS.—If the Secretary en-
ters into a contract for the performance of any Department 
function that requires access to sensitive personal informa-
tion, the Secretary shall require as a condition of the con-
tract that— 
‘‘(1) the contractor shall not, directly or through 
an affiliate of the contractor, disclose such informa-
tion to any other person unless the disclosure is law-
ful and is expressly permitted under the contract; 
‘‘(2) the contractor, or any subcontractor for a 
subcontract of the contract, shall promptly notify the 
Secretary of any data breach that occurs with respect 
to such information. 
‘‘(b) LIQUIDATED DAMAGES.—Each contract subject to 
the requirements of subsection (a) shall provide for liq-
uidated damages to be paid by the contractor to the Sec-
retary in the event of a data breach with respect to any 
sensitive personal information processed or maintained by 
the contractor or any subcontractor under that contract. 
‘‘(c) PROVISION OF CREDIT PROTECTION SERVICES.— 
Any amount collected by the Secretary under subsection (b) 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
shall be deposited in or credited to the Department account 
from which the contractor was paid and shall remain avail-
able for obligation without fiscal year limitation exclusively 
for the purpose of providing credit protection services in 
accordance with section 5726 of this title. 
‘‘§ 5728. Authorization of appropriations 
‘‘There are authorized to be appropriated to carry out 
this subchapter such sums as may be necessary for each fis-
cal year.’’. 
(b) CLERICAL AMENDMENT.—The table of sections at 
the beginning of such chapter is amended by adding at the 
end the following new items: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘5721. Definitions. 
‘‘5722. Office of the Under Secretary for Information Services. 
‘‘5723. Information security management. 
‘‘5724. Congressional reporting and notification of data breaches. 
‘‘5725. Data breaches. 
‘‘5726. Provision of credit protection services. 
‘‘5727. Contracts for data processing or maintenance. 
‘‘5728. Authorization of appropriations.’’. 
(c) DEADLINE FOR REGULATIONS.—Not later than 60 
days after the date of the enactment of this Act, the Sec-
retary of Veterans Affairs shall publish regulations to carry 
out subchapter III of chapter 57 of title 38, United States 
Code, as added by subsection (a). 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
SEC. 5. REPORT ON FEASIBILITY OF USING PERSONAL 
IDENTIFICATION NUMBERS FOR IDENTIFICA-
TION. 
Not later than 180 days after the date of the enactment 
of this Act, the Secretary of Veterans Affairs shall submit 
to Congress a report containing the assessment of the Sec-
retary with respect to the feasibility of using personal iden-
tification numbers instead of Social Security numbers for 
the purpose of identifying individuals whose sensitive per-
sonal information (as that term is defined in section 5721 
of title 38, United States Code, as added by section 4) is 
processed or maintained by the Secretary. 
SEC. 6. DEADLINE FOR APPOINTMENTS. 
(a) DEADLINE.—Not later than 180 days after the date 
of the enactment of this Act— 
(1) the President shall nominate an individual 
to serve as the Under Secretary of Veterans Affairs for 
Information Services under section 307A of title 38, 
United States Code, as added by section 3; and 
(2) the Secretary of Veterans Affairs shall ap-
point an individual to serve as each of the Deputy 
Under Secretaries of Veterans Affairs for Information 
Services under section 5722 of such title, as added by 
section 4. 
(b) REPORT.—Not later than 30 days after the date 
of the enactment of this Act, and every 30 days thereafter 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
until the appointments described in subsection (a) are 
made, the Secretary of Veterans Affairs shall submit to Con-
gress a report describing the progress of such appointments. 
SEC. 7. INFORMATION SECURITY EDUCATION ASSISTANCE 
PROGRAM. 
(a) PROGRAM REQUIRED.—Title 38, United States 
Code, is amended by inserting after chapter 78 the following 
new chapter: 
‘‘CHAPTER 79—INFORMATION SECURITY 
EDUCATION ASSISTANCE PROGRAM 
‘‘Sec. 
‘‘7901. Programs; purpose. 
‘‘7902. Scholarship program. 
‘‘7903. Education debt reduction program. 
‘‘7904. Preferences in awarding financial assistance. 
‘‘7905. Requirement of honorable discharge for veterans receiving assistance. 
‘‘7906. Regulations. 
‘‘7907. Termination. 
‘‘§ 7901. Programs; purpose 
‘‘(a) IN GENERAL.—To encourage the recruitment and 
retention of Department personnel who have the informa-
tion security skills necessary to meet Department require-
ments, the Secretary shall carry out programs in accord-
ance with this chapter to provide financial support for edu-
cation in computer science and electrical and computer en-
gineering at accredited institutions of higher education. 
‘‘(b) TYPES OF PROGRAMS.—The programs authorized 
under this chapter are as follows: 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(1) Scholarships for pursuit of doctoral degrees 
in computer science and electrical and computer engi-
neering at accredited institutions of higher education. 
‘‘(2) Education debt reduction for Department 
personnel who hold doctoral degrees in computer 
science and electrical and computer engineering at ac-
credited institutions of higher education. 
‘‘§ 7902. Scholarship program 
‘‘(a) AUTHORITY.—(1) Subject to the availability of 
appropriations, the Secretary shall establish a scholarship 
program under which the Secretary shall, subject to sub-
section (d), provide financial assistance in accordance with 
this section to a qualified person— 
‘‘(A) who is pursuing a doctoral degree in com-
puter science or electrical or computer engineering at 
an accredited institution of higher education; and 
‘‘(B) who enters into an agreement with the Sec-
retary as described in subsection (b). 
‘‘(2)(A) Except as provided under subparagraph (B), 
the Secretary may provide financial assistance under this 
section to an individual for up to five years. 
‘‘(B) The Secretary may waive the limitation under 
subparagraph (A) if the Secretary determines that such a 
waiver is appropriate. 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
‘‘(3)(A) The Secretary may award up to five scholar-
ships for any academic year to individuals who did not 
receive assistance under this section for the preceding aca-
demic year. 
‘‘(B) Not more than one scholarship awarded under 
subparagraph (A) may be awarded to an individual who 
is an employee of the Department when the scholarship is 
awarded. 
‘‘(b) SERVICE AGREEMENT FOR SCHOLARSHIP RECIPI-
ENTS.—(1) To receive financial assistance under this sec-
tion an individual shall enter into an agreement to accept 
and continue employment in the Department for the period 
of obligated service determined under paragraph (2). 
‘‘(2) For the purposes of this subsection, the period of 
obligated service for a recipient of financial assistance 
under this section shall be the period determined by the Sec-
retary as being appropriate to obtain adequate service in 
exchange for the financial assistance and otherwise to 
achieve the goals set forth in section 7901(a) of this title. 
In no event may the period of service required of a recipient 
be less than the period equal to two times the total period 
of pursuit of a degree for which the Secretary agrees to pro-
vide the recipient with financial assistance under this sec-
tion. The period of obligated service is in addition to any 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
other period for which the recipient is obligated to serve 
on active duty or in the civil service, as the case may be. 
‘‘(3) An agreement entered into under this section by 
a person pursuing an doctoral degree shall include terms 
that provide the following: 
‘‘(A) That the period of obligated service begins 
on a date after the award of the degree that is deter-
mined under the regulations prescribed under section 
7906 of this title. 
‘‘(B) That the individual will maintain satisfac-
tory academic progress, as determined in accordance 
with those regulations, and that failure to maintain 
such progress constitutes grounds for termination of 
the financial assistance for the individual under this 
section. 
‘‘(C) Any other terms and conditions that the 
Secretary determines appropriate for carrying out 
this section. 
‘‘(c) AMOUNT OF ASSISTANCE.—(1) The amount of the 
financial assistance provided for an individual under this 
section shall be the amount determined by the Secretary as 
being necessary to pay— 
‘‘(A) the tuition and fees of the individual; and 
‘‘(B) $1500 to the individual each month (in-
cluding a month between academic semesters or terms 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
leading to the degree for which such assistance is pro-
vided or during which the individual is not enrolled 
in a course of education but is pursuing independent 
research leading to such degree) for books, laboratory 
expenses, and expenses of room and board. 
‘‘(2) In no case may the amount of assistance provided 
for an individual under this section for an academic year 
exceed $50,000. 
‘‘(3) In no case may the total amount of assistance 
provided for an individual under this section exceed 
$200,000. 
‘‘(4) Notwithstanding any other provision of law, fi-
nancial assistance paid an individual under this section 
shall not be considered as income or resources in deter-
mining eligibility for, or the amount of benefits under, any 
Federal or federally assisted program. 
‘‘(d) REPAYMENT FOR PERIOD OF UNSERVED OBLI-
GATED SERVICE.—(1) An individual who receives financial 
assistance under this section shall repay to the Secretary 
an amount equal to the unearned portion of the financial 
assistance if the individual fails to satisfy the requirements 
of the service agreement entered into under subsection (b), 
except in certain circumstances authorized by the Secretary. 
‘‘(2) The Secretary may establish, by regulations, pro-
cedures for determining the amount of the repayment re-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
quired under this subsection and the circumstances under 
which an exception to the required repayment may be 
granted. 
‘‘(3) An obligation to repay the Secretary under this 
subsection is, for all purposes, a debt owed the United 
States. A discharge in bankruptcy under title 11 does not 
discharge a person from such debt if the discharge order 
is entered less than five years after the date of the termi-
nation of the agreement or contract on which the debt is 
based. 
‘‘(e) WAIVER OR SUSPENSION OF COMPLIANCE.—The 
Secretary shall prescribe regulations providing for the 
waiver or suspension of any obligation of a individual for 
service or payment under this section (or an agreement 
under this section) whenever noncompliance by the indi-
vidual is due to circumstances beyond the control of the in-
dividual or whenever the Secretary determines that the 
waiver or suspension of compliance is in the best interest 
of the United States. 
‘‘(f) INTERNSHIPS.—(1) The Secretary may offer a 
compensated internship to an individual for whom finan-
cial assistance is provided under this section during a pe-
riod between academic semesters or terms leading to the de-
gree for which such assistance is provided. Compensation 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
provided for such an internship shall be in addition to the 
financial assistance provided under this section. 
‘‘(2) An internship under this subsection shall not be 
counted toward satisfying a period of obligated service 
under this section. 
‘‘(g) INELIGIBILITY OF INDIVIDUALS RECEIVING CER-
TAIN EDUCATION ASSISTANCE PAYMENTS.—An individual 
who receives a payment of educational assistance under 
chapter 30, 31, 32, 34, or 35 of this title or chapter 1606 
or 1607 of title 10 for a month in which the individual 
is enrolled in a course of education leading to a doctoral 
degree in information security is not eligible to receive fi-
nancial assistance under this section for that month. 
‘‘§ 7903. Education debt reduction program 
‘‘(a) AUTHORITY.—(1) Subject to the availability of 
appropriations, the Secretary shall establish an education 
debt reduction program under which the Secretary shall 
make education debt reduction payments under this section 
to qualified individuals eligible under subsection (b) for the 
purpose of reimbursing such individuals for payments by 
such individuals of principal and interest on loans de-
scribed in paragraph (2) of that subsection. 
‘‘(2)(A) For each fiscal year, the Secretary may accept 
up to five individuals into the program established under 
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS
paragraph (1)who did not receive such a payment during 
the preceding fiscal year. 
‘‘(B) Not more than one individual accepted into the 
program for a fiscal year under subsection (A) shall be a 
Department employee as of the date on which the individual 
is accepted into the program. 
‘‘(b) ELIGIBILITY.—An individual is eligible to par-
ticipate in the program under this section if the indi-
vidual— 
‘‘(1) has completed a doctoral degree a doctoral 
degree in computer science or electrical or computer 
engineering at an accredited institution of higher 
education during the five-year period preceding the 
date on which the individual is hired; 
‘‘(2) is an employee of the Department who 
serves in a position related to information security 
(as determined by the Secretary); and 
‘‘(3) owes any amount of principal or interest 
under a loan, the proceeds of which were used by or 
on behalf of that individual to pay costs relating to 
a doctoral degree in computer science or electrical or 
computer engineering at an accredited institution of 
higher education. 
‘‘(c) AMOUNT OF ASSISTANCE.—(1) Subject to para-
graph (2), the amount of education debt reduction pay-
VerDate Aug 31 2005 
22:11 Sep 14, 2006
Jkt 049196
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H5835.RH
H5835
rwilkins on PROD1PC63 with BILLS