(B) Financial records. 
(C) Previous or current health records, in-
cluding hospital or treatment records of any 
kind, including drug and alcohol rehabilitation 
records. 
(D) Criminal records. 
(E) Licenses. 
(F) License denials, suspensions, or rev-
ocations. 
(G) Tax returns. 
(H) Information that has been specifically 
authorized under criteria established by an Ex-
ecutive order or an Act of Congress to be kept 
classified in the interest of national defense or 
foreign policy. 
(I) Personally identifiable information. 
(2) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means any information, in any form or me-
dium, that relates to the past, present, or future 
physical or mental health, predisposition, or condi-
tion of an individual or the provision of health care 
to an individual. 
(3) FEDERAL COMPUTER SYSTEM.—The term 
‘‘Federal computer system’’ has the meaning given 
VerDate Aug 31 2005 
23:00 Jan 18, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H516.IH
H516
frosa on PROD1PC71 with BILLS
such term in section 20(d) of the National Institute 
of Standards and Technology Act (15 U.S.C. 278g– 
3(d)). 
(4) AGENCY.—The term ‘‘agency’’ has the 
meaning provided in section 3502(1) of title 44, 
United States Code. 
(5) RECORD.—The term ‘‘record’’ has the 
meaning provided in section 552a(a) of title 5, 
United States Code. 
SEC. 3. REQUIREMENT FOR USE OF ENCRYPTION FOR SEN-
SITIVE DATA. 
(a) REQUIREMENT FOR ENCRYPTION.— 
(1) IN
GENERAL.—All sensitive data main-
tained by the Federal Government, including such 
data maintained in Federal computer systems, shall 
be secured by the use of the most secure encryption 
standard recognized by the National Institute of 
Standards and Technology. 
(2) UPDATING REQUIRED EVERY 6 MONTHS.— 
Any sequence of characters (known as an encryption 
key) used to secure an encryption standard used on 
Federal computer systems shall be changed every 6 
months, at a minimum, to provide additional secu-
rity. 
VerDate Aug 31 2005 
23:00 Jan 18, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H516.IH
H516
frosa on PROD1PC71 with BILLS
(3) IMPLEMENTATION.—The requirements of 
this subsection shall be implemented not later than 
6 months after the date of the enactment of this 
Act. 
(b) FEDERAL
AGENCY
RESPONSIBILITIES.—The 
head of each agency shall be responsible for complying 
with the requirements of subsection (a) within the agency. 
Such requirement shall be considered to be a requirement 
of subchapter III of chapter 35 of title 44, United States 
Code, for purposes of section 3544(a)(1)(B) of such title. 
SEC. 4. REQUIREMENTS RELATING TO ACCESS BY AGENCY 
PERSONNEL TO SENSITIVE DATA. 
(a) ON-SITE ACCESS.—No employee of the Federal 
government may have access to sensitive data on Govern-
ment property unless the employee has received a security 
clearance at the ‘‘secret’’ level or higher and has completed 
a financial disclosure form, in accordance with applicable 
provisions of law and regulation. 
(b) OFF-SITE ACCESS.— 
(1) PROHIBITION.—Sensitive data maintained 
by an agency may not be transported or accessed 
from a location off Government property unless a re-
quest for such transportation or access is submitted 
and approved by the Inspector General of the agency 
in accordance with paragraph (2). 
VerDate Aug 31 2005 
23:00 Jan 18, 2007
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H516.IH
H516
frosa on PROD1PC71 with BILLS
(2) PROCEDURES.— 
(A) DEADLINE
FOR
APPROVAL
OR
DIS-
APPROVAL.—In the case of any request sub-
mitted under paragraph (1) to an Inspector 
General of an agency, the Inspector General 
shall approve or disapprove the request within 
2 business days after the date of submission of 
the request. 
(B) LIMITATION TO 10,000 RECORDS.—If a 
request is approved, the Inspector General shall 
limit the access to not more than 10,000 
records at a time. 
(3) ENCRYPTION.—Any technology used to 
store, transport, or access sensitive data during for 
purposes of off-site access approved under this sub-
section shall be secured by the use of the most se-
cure encryption standard recognized by the National 
Institute of Standards and Technology. 
(c) IMPLEMENTATION.—The requirements of this 
subsection shall be implemented not later than 6 months 
after the date of the enactment of this Act. 
SEC. 5. REQUIREMENTS RELATING TO GOVERNMENT CON-
TRACTORS INVOLVING SENSITIVE DATA. 
(a) APPLICABILITY
TO
GOVERNMENT
CONTRAC-
TORS.—In entering into any contract that may involve 
VerDate Aug 31 2005 
23:00 Jan 18, 2007
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H516.IH
H516
frosa on PROD1PC71 with BILLS
sensitive data in electronic or digital form on 10,000 or 
more United States citizens, an agency shall require the 
contractor and employees of the contractor to comply with 
the requirements of sections 3 and 4 of this Act in the 
performance of the contract, in the same manner as agen-
cies and government employees comply with such require-
ments. 
(b) IMPLEMENTATION.—The requirements of this 
subsection shall be implemented with respect to contracts 
entered into on or after the date occurring 6 months after 
the date of the enactment of this Act. 
Æ 
VerDate Aug 31 2005 
23:00 Jan 18, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H516.IH
H516
frosa on PROD1PC71 with BILLS