Limitation on access to veteran and department information, systems, and data

(a) Limitations (1) In general Subchapter III of chapter 57 of title 38, United States Code, is amended by adding at the end of the following new section: 5729. Limitations on access to certain information, systems, and data (a) In general The Secretary may not allow any individual to use, exercise administrative control over, or otherwise access any Department information technology system, health or benefits data repository, contracting information, financial system, record system, or other relevant system, or any data from any such system, unless— (1) such individual is an officer, employee, or contractor of the Department; and (2) in the case of an individual not described in paragraph (1)— (A) such individual holds a security clearance at the appropriate level with respect to such system or data and such clearance was granted pursuant to the procedures established under section 801 of the National Security Act of 1947 (50 U.S.C. 3161); (B) such individual’s access to such system or data, or use thereof, does not constitute a violation of section 208 of title 18 (determined after the application of subsection (b)); (C) such individual is not a special Government employee (as defined in section 202 of title 18); (D) such individual’s current continuous service in the civil service (as that term is defined in section 2101 of title 5) as of the date of such access is for a period of not less than one year; (E) such individual has completed any required training or compliance procedures with respect to privacy laws, cybersecurity regulations, national security regulations, and best practices; and (F) has signed a written ethics agreement with either the senior career Designated Agency Ethics Official of the Department, or the most senior career official within the Office of Government Ethics. (b) Treatment of individuals who are not officers or employees of executive branch of Federal Government (1) Any individual who accesses any system or data described in subsection (a) who is not otherwise an officer or employee of the executive branch of the Federal Government shall be treated as an employee of the executive branch of the United States Government for purposes of section 208 of title 18. (2) For purposes of such section 208, exercise of administrative control or stopping, canceling, adjusting, holding, rejecting, changing, or otherwise impacting any payment or data in any Department system, data repository, or other similar location, shall be considered personal and substantial participation as a Government officer or employee in a particular matter. (c) Definition of other relevant system In this section, the term other relevant system means any data, system, connection, database, repository, or any other tangible thing of the Department that stores information of the Department, veterans, surviving spouses, caregivers, or other recipients of health care or benefits under laws administered by the Secretary, including health data, personally identifiable information, protected health information, burial data information, contract data, the Corporate Data Warehouse of the Department, data regarding benefits provided to veterans, financial transaction and bank information, Department of Veterans Affairs Integrated Enterprise Workflow Solution system and data, payroll information, research and development data, and data that is part of the Million Veteran Program.. (2) Clerical amendment The table of sections at the beginning of chapter 57 of such title is amended by inserting after section 5728 the following new section: 5729. Limitations on access to certain information, systems, and data.. (b) Deletion of improperly obtained data In any action brought against the Department of Veterans Affairs or a recipient agency or other recipient in a court of competent jurisdiction for a violation of subsection (b) or (e) of section 552a of title 5, United States Code, the court may order the Secretary of Veterans Affairs, the recipient agency, or other recipient to delete records improperly disclosed or maintained in a system of records in violation of the rules and regulations set out pursuant to such section. (c) Removal of connections Not later than 15 days after the date of the enactment of this Act, the Secretary of Veterans Affairs shall remove any information technology connection between the Department and any entity not in compliance with the provisions of this section or section 5729 of title 38, United States Code, as added by subsection (a).