I 
109TH CONGRESS 
2D SESSION 
H. R. 6109 
To amend title 38, United States Code, to provide for enhanced protection 
of sensitive personal information processed or maintained by the Sec-
retary of Veterans Affairs. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 19, 2006 
Mr. MURPHY (for himself, Mr. GERLACH, Mr. PLATTS, Mr. SALAZAR, Ms. 
HART, Mrs. BLACKBURN, Mr. BRADLEY
of New Hampshire, Mr. 
MCCOTTER, Mr. HOEKSTRA, and Mr. LAHOOD) introduced the following 
bill; which was referred to the Committee on Veterans’ Affairs 
A BILL 
To amend title 38, United States Code, to provide for en-
hanced protection of sensitive personal information proc-
essed or maintained by the Secretary of Veterans Affairs. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Stop Endangering the 
Records of Veterans (SERVE) Act of 2006’’. 
SEC. 2. FINDINGS. 
Congress finds as follows: 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS
(1) Identity theft remains a critical problem for 
consumers. In May 2006, the Federal Trade Com-
mission revealed that 10,000,000 individuals are 
subjected to theft of their personal identification li-
censes and records each year. 
(2) Recent thefts of computer hardware con-
taining sensitive personal information from the De-
partment of Veterans Affairs and its contractors 
have made millions of veterans vulnerable to identity 
theft and fraud. 
(3) On May 22, 2006, the Department of Vet-
erans Affairs announced an employee laptop con-
taining personal records of nearly 26,500,000 mil-
lion veterans and spouses had been stolen. 
(4) On August 7, 2006, a desktop computer 
containing personal information of more than 
38,000 veterans was stolen from a subcontractor 
hired to assist in insurance collections for medical 
centers of the Department of Veterans Affairs in 
Pittsburgh and Philadelphia, Pennsylvania. 
(5) In August 2006, in response to the loss of 
these records, the Secretary of Veterans Affairs cre-
ated the office of Special Advisor to the Secretary 
for Information Security. 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS
(6) On August 14, 2006, the Secretary an-
nounced the award of a $3,700,000 contract to a 
service-disabled, veteran-owned small business to up-
grade all Department computers with enhanced data 
security encryption systems. 
(7) In order to prevent the Nation’s veterans 
from being exposed to identity theft and fraud, addi-
tional Federal safeguards, including those provided 
by this Act, must be applied to increase account-
ability of those who handle veterans’ records in 
order to prevent future losses of sensitive personal 
information. 
SEC. 3. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY. 
(a) INFORMATION SECURITY.—Chapter 57 of title 
38, United States Code, is amended by adding at the end 
the following new subchapter: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘§ 5721. Definitions 
‘‘For the purposes of this subchapter: 
‘‘(1) The term ‘sensitive personal information’ 
means the name, address, or telephone number of an 
individual, in combination with any of the following: 
‘‘(A) The social security number of the in-
dividual. 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS
‘‘(B) The date of birth of the individual. 
‘‘(C) Any information not available as part 
of the public record regarding the individual’s 
military service or health. 
‘‘(D) Any financial account or other finan-
cial information relating to the individual. 
‘‘(E) The driver’s license number of the in-
dividual. 
‘‘(2) The term ‘encrypt’ means to use software 
to obscure electronic information to make that infor-
mation unreadable for unauthorized employees and 
contractors of the Department. 
‘‘§ 5722. Physical security of sensitive personal infor-
mation processed or maintained by the 
Secretary 
‘‘The Secretary shall physically secure all sensitive 
personal information processed or maintained by the Sec-
retary and all equipment of the Department containing 
such sensitive personal information. 
‘‘§ 5723. Encryption of sensitive personal information 
processed or maintained by the Secretary 
‘‘The Secretary shall encrypt all sensitive personal in-
formation processed or maintained by the Secretary. 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS
‘‘§ 5724. Contracts for the processing or maintenance 
of sensitive personal information 
‘‘(a) CONTRACT REQUIREMENTS.—If the Secretary 
enters into a contract for the performance of any Depart-
ment function that requires access to sensitive personal 
information, the Secretary shall require as a condition of 
the contract that— 
‘‘(1) the contractor ensures that it will— 
‘‘(A) encrypt or encode any such informa-
tion to which the contractor has access; and 
‘‘(B) physically secure all such information 
that it processes or maintains and all equip-
ment containing such information; and 
‘‘(2) the contractor agrees to reimburse the 
Secretary for any amount paid by the Secretary to 
any person as a result of the contractor’s unauthor-
ized disclosure of any sensitive personal information 
to which the contractor has access under the con-
tract. 
‘‘(b) PENALTY
FOR VIOLATIONS.—Any contractor 
who violates any requirement of this subtitle shall be 
debarred from contracting with the Department for a pe-
riod of one year. 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS
‘‘§ 5725. Criminal penalty for unauthorized disclosure 
of sensitive personal information 
‘‘Any person who engages in the unauthorized disclo-
sure of sensitive personal information processed or main-
tained by the Secretary or by a contractor performing a 
function on behalf of the Secretary shall be fined in ac-
cordance with title 18, imprisoned for not more than one 
year, or both.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by adding 
at the end the following new items: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘5721. Definitions. 
‘‘5722. Physical security of sensitive personal information processed or main-
tained by the Secretary. 
‘‘5723. Encryption of sensitive personal information processed or maintained by 
the Secretary. 
‘‘5724. Contracts for the processing or maintenance of sensitive personal infor-
mation. 
‘‘5725. Criminal penalty for unauthorized disclosure of sensitive personal infor-
mation.’’. 
(c) IMPLEMENTATION.—The requirement of section 
5723 of title 38, United States Code, as added by sub-
section (a), shall be implemented not later than 90 days 
after the date of the enactment of this Act. 
SEC. 4. DIRECTOR OF OFFICE OF MANAGEMENT AND BUDG-
ET STUDY AND REPORT. 
Not later than 180 days after the date of the enact-
ment of this Act, the Director of the Office of Manage-
ment and Budget shall complete a study of the security 
VerDate Aug 31 2005 
23:48 Sep 20, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6109.IH
H6109
CCOLEMAN on PROD1PC71 with BILLS