S.Amdt. 3001

SA 3001. Mr. BLUMENTHAL submitted an amendment intended to be
proposed by him to the bill H.R. 3944, making appropriations for
military construction, the Department of Veterans Affairs, and related
agencies for the fiscal year ending September 30, 2026, and for other
purposes; which was ordered to lie on the table; as follows:

At the appropriate place in title II of division A, insert
the following:

SEC. 2__. LIMITATION ON ACCESS TO VETERAN AND DEPARTMENT
INFORMATION, SYSTEMS, AND DATA.

(a) Limitations.--
(1) In general.--Subchapter III of chapter 57 of title 38,
United States Code, is amended by adding at the end of the
following new section:

``Sec. 5729. Limitations on access to certain information,
systems, and data

``(a) In General.--The Secretary may not allow any
individual to use, exercise administrative control over, or
otherwise access any Department information technology
system, health or benefits data repository, contracting
information, financial system, record system, or other
relevant system, or any data from any such system, unless--
``(1) such individual is an officer, employee, or
contractor of the Department; and
``(2) in the case of an individual not described in
paragraph (1)--
``(A) such individual holds a security clearance at the
appropriate level with respect to such system or data and
such clearance was granted pursuant to the procedures
established under section 801 of the National Security Act of
1947 (50 U.S.C. 3161);

[[Page S4682]]

``(B) such individual's access to such system or data, or
use thereof, does not constitute a violation of section 208
of title 18 (determined after the application of subsection
(b));
``(C) such individual is not a special Government employee
(as defined in section 202 of title 18);
``(D) such individual's current continuous service in the
civil service (as that term is defined in section 2101 of
title 5) as of the date of such access is for a period of not
less than one year;
``(E) such individual has completed any required training
or compliance procedures with respect to privacy laws,
cybersecurity regulations, national security regulations, and
best practices; and
``(F) has signed a written ethics agreement with either the
senior career Designated Agency Ethics Official of the
Department, or the most senior career official within the
Office of Government Ethics.
``(b) Treatment of Individuals Who Are Not Officers or
Employees of Executive Branch of Federal Government.--(1) Any
individual who accesses any system or data described in
subsection (a) who is not otherwise an officer or employee of
the executive branch of the Federal Government shall be
treated as an employee of the executive branch of the United
States Government for purposes of section 208 of title 18.
``(2) For purposes of such section 208, exercise of
administrative control or stopping, canceling, adjusting,
holding, rejecting, changing, or otherwise impacting any
payment or data in any Department system, data repository, or
other similar location, shall be considered personal and
substantial participation as a Government officer or employee
in a particular matter.
``(c) Definition of Other Relevant System.--In this
section, the term `other relevant system' means any data,
system, connection, database, repository, or any other
tangible thing of the Department that stores information of
the Department, veterans, surviving spouses, caregivers, or
other recipients of health care or benefits under laws
administered by the Secretary, including health data,
personally identifiable information, protected health
information, burial data information, contract data, the
Corporate Data Warehouse of the Department, data regarding
benefits provided to veterans, financial transaction and bank
information, Department of Veterans Affairs Integrated
Enterprise Workflow Solution system and data, payroll
information, research and development data, and data that is
part of the Million Veteran Program.''.
(2) Clerical amendment.--The table of sections at the
beginning of chapter 57 of such title is amended by inserting
after section 5728 the following new section:

``5729. Limitations on access to certain information, systems, and
data.''.
(b) Deletion of Improperly Obtained Data.--In any action
brought against the Department of Veterans Affairs or a
recipient agency or other recipient in a court of competent
jurisdiction for a violation of subsection (b) or (e) of
section 552a of title 5, United States Code, the court may
order the Secretary of Veterans Affairs, the recipient
agency, or other recipient to delete records improperly
disclosed or maintained in a system of records in violation
of the rules and regulations set out pursuant to such
section.
(c) Removal of Connections.--Not later than 15 days after
the date of the enactment of this Act, the Secretary of
Veterans Affairs shall remove any information technology
connection between the Department and any entity not in
compliance with the provisions of this section or section
5729 of title 38, United States Code, as added by subsection
(a).
______