I 
109TH CONGRESS 
2D SESSION 
H. R. 5487 
To require the Secretary of Veterans Affairs to take certain actions to 
mitigate the effects of the breach of data security that occurred, or 
is likely to have occurred, in May, 2006, at the Department of Veterans 
Affairs, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 25, 2006 
Ms. HOOLEY (for herself, Mr. LATOURETTE, Ms. BEAN, Mr. BAKER, Mr. 
MOORE of Kansas, Mr. KANJORSKI, Mr. CROWLEY, Mrs. MCCARTHY, Mr. 
MEEKS of New York, Mr. HINOJOSA, Ms. MOORE of Wisconsin, Mr. 
CLAY, Mrs. KELLY, Ms. HARMAN, Mr. LARSON of Connecticut, Mr. RA-
HALL, Mr. DELAHUNT, Ms. CORRINE BROWN of Florida, Mr. KUCINICH, 
Mr. MICHAUD, Mr. DAVIS of Alabama, Mr. AL GREEN of Texas, Mr. 
SCOTT of Georgia, Mr. LYNCH, Mr. GRIJALVA, Ms. DEGETTE, Ms. 
BORDALLO, Mr. BACA, Mr. SMITH of Washington, Mr. CLYBURN, Mr. 
CONYERS, Mr. THOMPSON of Mississippi, Mr. DICKS, Mr. INSLEE, Mr. 
POMEROY, Mr. FILNER, Mr. RAMSTAD, Ms. WASSERMAN SCHULTZ, Mr. 
WALDEN of Oregon, Mr. DEFAZIO, Mr. BAIRD, and Ms. HERSETH) in-
troduced the following bill; which was referred to the Committee on Vet-
erans’ Affairs 
A BILL 
To require the Secretary of Veterans Affairs to take certain 
actions to mitigate the effects of the breach of data 
security that occurred, or is likely to have occurred, 
in May, 2006, at the Department of Veterans Affairs, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans’ ID Theft 
Protection Act of 2006’’. 
SEC. 2. ACTIONS REQUIRED WITH RESPECT TO VETERANS 
ADMINISTRATION DATA BREACH. 
(a) IN GENERAL.—With respect to the breach of data 
security that occurred, or is likely to have occurred, in 
May, 2006, at the Department of Veterans Affairs, the 
Secretary of Veterans Affairs shall take the following ac-
tions with respect to such breach in addition to any other 
actions the Secretary may determine to be appropriate. 
(1) SYSTEM
RESTORATION
REQUIREMENTS.— 
The Secretary shall take prompt and reasonable 
measures to— 
(A) repair the breach and restore the secu-
rity and confidentiality of the sensitive financial 
personal information involved to limit further 
unauthorized misuse of such information; and 
(B) restore the integrity of the Depart-
ment’s data security safeguards and make ap-
propriate improvements to its data security 
policies and procedures. 
(2) NOTICE REQUIREMENTS.— 
(A) IN
GENERAL.—The Secretary shall 
without unreasonable delay notify any person 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
affected by the breach in the manner provided 
in this paragraph, as well as— 
(i) each nationwide consumer report-
ing agency described in section 603(p) of 
the Fair Credit Reporting Act with respect 
to the breach itself and each person af-
fected by the breach; and 
(ii) any other appropriate critical 
third parties who will be required to under-
take further action with respect to such in-
formation to protect such persons from re-
sulting fraud or identity theft. 
(B) CONTENT OF NOTICE.—Any notice re-
quired to be provided under subparagraph (A) 
by the Secretary to any person affected by the 
breach shall be provided in a standardized 
transmission or envelope clearly marked as con-
taining an important notice from the Depart-
ment of Veterans Affairs on stolen identity in-
formation, and shall include the following in a 
clear and conspicuous manner: 
(i) An appropriate heading or notice 
title. 
(ii) A description of the nature and 
types of information and accounts as ap-
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
propriate that were, or are reasonably be-
lieved to have been, subject to the breach 
of data security. 
(iii) If known, the date, or the best 
reasonable approximation of the period of 
time, on or within which sensitive personal 
information related to the consumer was, 
or is reasonably believed to have been, sub-
ject to a breach. 
(iv) A general description of the ac-
tions taken by the Secretary to restore the 
security and confidentiality of the breached 
information. 
(v) A telephone number by which any 
person affected by the breach may call the 
Department of Veterans Affairs, free of 
charge, to obtain additional information 
about how to respond to the breach. 
(vi) A copy of the summary of rights 
of consumer victims of fraud or identity 
theft prepared by the Federal Trade Com-
mission under section 609(d) of the Fair 
Credit Reporting Act, as well as any addi-
tional appropriate information on how the 
person affected by the breach may— 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
(I) obtain a copy of a consumer 
report free of charge in accordance 
with section 612 of the Fair Credit 
Reporting Act; 
(II) place a fraud alert in any file 
relating to the person at a consumer 
reporting agency under section 605A 
of such Act to discourage unauthor-
ized use; and 
(III) contact the Federal Trade 
Commission for more detailed infor-
mation. 
(vii) A prominent statement that file 
monitoring will be made available upon re-
quest in accordance with paragraph (3) to 
the person affected by the breach free of 
charge for a period of not less than 6 
months, together with a telephone number 
at the Department of Veterans Affair for 
requesting such services. The statement 
may also include such additional contact 
information as a mailing address, e-mail, 
or Internet website address. 
(viii) The approximate date the notice 
is being issued. 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
(C) RESPONSIBILITY AND COSTS.— 
(i) IN
GENERAL.—The Secretary of 
Veterans Affairs shall be— 
(I) responsible for providing any 
notices and file monitoring required 
under this section with respect to such 
breach; and 
(II) responsible for the reason-
able actual costs of any notices pro-
vided under this section. 
(ii) NO
CHARGE
TO
PERSONS
AF-
FECTED BY THE BREACH.—The cost for 
the notices and file monitoring described in 
clause (i) may not be charged to the per-
sons affected by the breach. 
(3) FREE FILE MONITORING.—The Secretary of 
Veterans Affairs, if requested by the person affected 
by the breach before the end of the 90-day period 
beginning on the date of such notice, shall make 
available to the person, free of charge and for at 
least a 6-month period a service that monitors na-
tionwide credit activity regarding a consumer from a 
consumer reporting agency described in section 
603(p) of the Fair Credit Reporting Act. 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS
(b) NEGOTIATING AUTHORITY.—The Secretary of 
Veterans Affairs shall have broad authority to secure the 
best possible price for credit monitoring services on behalf 
of taxpayers. 
(c) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to be appropriated to the Secretary of Vet-
erans Affairs the sum of $100,000,000 to carry out the 
requirements of this section. 
Æ 
VerDate Aug 31 2005 
04:00 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6301
E:\BILLS\H5487.IH
H5487
CCOLEMAN on PROD1PC71 with BILLS