This Act may be cited as the Empowering States to Serve Veterans Act.

(a) In general (1) Requirement Subject to paragraph (2), not less frequently than quarterly, the Secretary of Veterans Affairs shall share with each State veterans agency contact information of veterans maintained by the Department of Veterans Affairs for statistical purposes and conducting outreach to veterans residing in that State. (2) Limitations Contact information shared under this Act shall not include— (A) any protected health information (as defined in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations)); (B) any Social Security number or date of birth; (C) any financial, disability rating, appeal, or claims information; or (D) any information designated by the Secretary as sensitive or restricted under Federal law. (b) Notice; opt out (1) Notice (A) In general The Secretary shall provide clear notice to each veteran, in paper and electronic communications, that— (i) the veteran’s contact information may be shared, for statistical and outreach purposes, with the State veterans agency of the State in which the veteran resides; and (ii) the veteran may opt out of such sharing at any time. (B) Timing The Secretary shall provide notice required by subparagraph (A)— (i) 45 days before the initial transfer of contact information to a State veterans agency for any individual who is a veteran on the date of the enactment of this Act; and (ii) at the time of transition from military service for any individual who is a member of the Armed Forces. (2) Opt out (A) Process The Secretary shall establish and maintain an accessible process for veterans to opt out of contact-information sharing under this Act, including an online form and toll-free telephone number. (B) Prohibition If a veteran opts out of contact-information sharing under this Act through the process established under subparagraph (A)— (i) the Secretary shall not share the contact information of the veteran under this Act unless the veteran subsequently provides the Secretary affirmative consent for such sharing; and (ii) any State veterans agency in receipt of contact information of the veteran shall immediately cease use of and destroy that information. (c) Privacy and security (1) Use and disclosure Each State veterans agency that receives contact information of veterans under this Act— (A) shall use such information solely for statistical and outreach purposes authorized by the Secretary; and (B) shall not— (i) sell, transfer, or otherwise disclose such information to any third party; or (ii) publish data based on such information. (2) Security measures Each State veterans agency that receives contact information of veterans under this Act shall implement data protection and cybersecurity measures consistent with Federal standards for safeguarding personally identifiable information. (3) Compliance The Secretary— (A) shall require proof of compliance with the measures described in paragraph (2) before sharing contact information of veterans under this Act with a State veterans agency; (B) shall not share contact information of veterans under this Act with a State veterans agency that does not demonstrate compliance with the requirements of this Act; and (C) shall require certifications or audits to ensure ongoing compliance with this Act. (d) State veterans agency defined In this section, the term State veterans agency means an agency of a State government that provides a range of benefits and services to veterans and their families. (e) Regulations Not later than 180 days after the date of the enactment of this Act, the Secretary shall prescribe regulations to carry out this Act, including procedures for contact-information sharing, opt-out management, and security compliance. (f) Effective date Subsections (a) through (d) shall take effect on the date that is one year after the date of the enactment of this Act.