HB7241, the “Protect Veterans from the Theft of Health and Identifying Information in Electronic Forms Act” or “Protect Veterans from the THIEF Act,” would amend title 38 of the U.S. Code to restrict how the Department of Veterans Affairs handles sensitive personal information in its contracts. The bill prohibits the VA from entering into any contract that allows a contractor to sell, or otherwise disclose for consideration, sensitive personal information maintained by the Secretary of Veterans Affairs.
The bill also requires the VA, within one year of enactment, to ensure that covered contracts include clauses barring contractors, subcontractors, affiliates, and other non-VA entities from monetizing, selling, or misusing covered information. In addition, the VA would have to issue internal guidance to help employees and contractors identify prohibited conduct and to report back to Congress with the required contract language, guidance, and a summary of other compliance actions.
Impact
If enacted, the bill would add a new restriction to section 5725 of title 38 and impose new contract-management and oversight requirements on the Department of Veterans Affairs. It would affect current and future VA contracts involving protected health information or personally identifiable information, including anonymized data, and would apply to information protected under federal privacy laws and specified VA confidentiality provisions. The measure is aimed at limiting commercialization of veterans’ data and strengthening privacy safeguards in VA procurement and data-handling arrangements.
Sentiment
The available record suggests the bill is framed positively and as a privacy-protection measure for veterans, with no recorded committee debate or votes indicating opposition or support levels. Its title and structure emphasize preventing misuse of veterans’ health and identifying information, suggesting a generally protective, consumer-privacy-oriented purpose. Because there are no transcripts or roll-call votes provided, the broader sentiment can only be inferred from the bill’s sponsor framing and its referral status.
Contention
No specific points of contention are documented in the provided materials, but the main policy issue likely concerns how broadly the prohibition on monetization and disclosure would apply to VA contractors, subcontractors, and affiliates. Potential questions could include compliance burdens for contractors, the scope of “covered information,” and how the VA would determine whether information has been “misused” or disclosed for consideration. The bill’s inclusion of anonymized information and broad cross-references to privacy laws may also raise implementation and interpretation questions.