To enhance protection of records of the Department of Veterans Affairs containing personal identifying information that is required by law to be confidential and privileged from disclosure except as authorized by law.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Veterans Identity Protection Act of 
2006''.

SEC. 2. SENSE OF CONGRESS.

    It is the sense of Congress that--
            (1) the Department of Veterans Affairs is responsible by 
        law for safeguarding and holding confidential the records of 
        the Department that contain personal identifying information 
        about present and former members of the Armed Forces and their 
        family members; and
            (2) it is the responsibility of the Department when such 
        identifying information is lost or compromised due to the 
        carelessness of the Department or its employees to assist those 
        individuals whose identifying information is affected in 
        mitigating any affect of that loss or compromise.

SEC. 3. OFFICE OF IDENTITY PROTECTION IN DEPARTMENT OF VETERANS 
              AFFAIRS.

    (a) Establishment.--There is established within the Department of 
Veterans Affairs an Office of Identity Protection. The Office shall be 
administered by a Director who shall be appointed by the Secretary.
    (b) Purpose.--The purpose of the Office shall be--
            (1) to prevent the loss or compromise of personal 
        identifying information (including name, social security 
        number, financial records, and health records) about present 
        and former members of the Armed Forces and their family members 
        that is required by section 5701 of title 38, United States 
        Code, or any other provision of law to be held confidential and 
        privileged and protected from disclosure except as authorized 
        by law; and
            (2) to assist any person whose personal identifying 
        information referred to in paragraph (1) is or may have been 
        compromised by the Department or a Department employee in 
        mitigating the effect of any such compromise.
    (c) Responsibilities.--The Secretary of Veterans Affairs, acting 
through the Office of Veterans Identity Protection, shall--
            (1) whenever there is a loss or compromise of personal 
        identifying information described in subsection (b)(1), notify 
        each individual whose personal identifying information was lost 
        or compromised of that loss or compromise;
            (2) contract with national credit reporting agencies to 
        provide one credit report every six months for three years, 
        without charge to the recipient, to any individual whose 
        personal identifying information held by the Department of 
        Veterans Affairs is or may have compromised due to the 
        carelessness of the Department or its employees in violation of 
        section 5701 of title 38, United States Code, or any other 
        provision of law;
            (3) offer a 24-hour toll-free telephone number and a 
        website for individuals described in paragraph (2) to provide 
        them information regarding access to credit reporting services;
            (4) work in coordination with the Department of Defense and 
        the Federal Trade Commission to ensure that active-duty 
        military personnel, especially those deployed in combat zones, 
        have access to credit reporting services; and
            (5) make available to present and former members of the 
        Armed Forces and their family members, through internet web 
        pages, outreach activities, and other appropriate means, 
        information on possible fraudulent consumer credit or reporting 
        services that may be aimed at present or former members of the 
        Armed Forces.
    (d) Agencies to Be Notified.--The Office shall be responsible for 
ensuring that the Department of Justice and the Federal Trade 
Commission are notified immediately when the Department of Veterans 
Affairs knows or suspects that personal data in the records of the 
Department have been compromised.

SEC. 4. INSPECTOR GENERAL REPORT ON DATA SECURITY PRACTICES OF 
              DEPARTMENT OF VETERANS AFFAIRS.

    (a) Study.--The Inspector General of the Department of Veterans 
Affairs shall conduct a study of the data security practices of the 
Department, including practices relating to access to personal 
identifying information held by the Department and the authorization 
process for removing such data from secure custody in the files of the 
Department.
    (b) Report.--Not later than six months after the date of the 
enactment of this Act, the Inspector General shall submit to the 
Committees on Veterans' Affairs of the Senate and the House of 
Representatives a report providing the results of the study under 
subsection (a).

SEC. 5. CRIMINAL PENALTY.

    Any officer or employee of the Department of Veterans Affairs who, 
except as authorized by law or by the Secretary of Veterans Affairs, 
removes from the custody of the Department of Veterans Affairs any 
file, record, report, or document of the Department of Veterans Affairs 
that is subject to section 5701 of title 38, United States Code, shall 
be fined as provided in title 18, United States Code, or imprisoned not 
more than 2 years, or both.

Summary: Veterans Identity Protection Act of 2006 - Expresses the sense of Congress that it is the responsibility of the Department of Veterans Afffairs: (1) to safeguard Department records that contain personal identifying information about present and former members of the Armed Forces and their family members; and (2) when such information is lost or compromised due to the carelessness of the Department or one of its employees, to assist the affected individuals in mitigating the effects of such loss or compromise.

Establishes within the Department an Office of Identity Protection to prevent such loss or compromise of information and to assist affected individuals.

Directs the Department's Inspector General to conduct a study of Department data security practices.

Provides criminal penalties for Department officers or employees who remove from Department custody any protected personnel file, record, report, or document.