Sponsors (3)
The bill increases targeted outreach and formal privacy/cybersecurity protections for veterans while giving veterans control over sharing, but it creates compliance costs, leaves residual breach and unwanted-contact risks, and may constrain some third‑party service partnerships.
Veterans will receive more targeted outreach because State veterans agencies get quarterly contact lists to connect veterans with benefits and services.
Veterans' sensitive information is better protected because the legislation forbids sharing PHI, Social Security numbers, dates of birth, and claims/disability details in the datasets provided to states.
State agencies and veterans' PII are better safeguarded because recipient state agencies must meet federal cybersecurity standards and provide certifications/audits before receiving data.
Veterans' contact details and other PII could still be exposed if State agencies' safeguards are insufficient or not effectively enforced, leaving a meaningful breach risk.
Some veterans may still receive unwanted or unsolicited outreach if they miss the notice window or the opt-out process, causing privacy annoyances or distress.
Implementing opt-out systems, audits, and cybersecurity compliance will impose administrative and compliance costs on the VA and state agencies, which could divert funds from direct services.
Based on analysis of 2 sections of legislative text.
Requires the VA to share limited veterans' contact information quarterly with State veterans agencies for authorized outreach/statistics, with opt-out and security rules.
Requires the Department of Veterans Affairs to share veterans' contact information with each State veterans agency at least quarterly for authorized statistical and outreach purposes, while excluding sensitive identifiers and protected health information. The law sets opt-out rights for veterans, requires advance notice before initial transfers, mandates secure handling by states, requires proof of cybersecurity protections, and instructs the VA to write implementing regulations within 180 days; data sharing begins one year after enactment. Limits on the data to be shared, restrictions on state use (no sale or public disclosure), accessible opt-out mechanisms (online form and toll-free number), and obligations to stop and destroy data after an opt-out are core protections in the bill. States must demonstrate compliance with federal data protection standards before and during data receipt (including certifications or audits).
Official title: Require the Secretary of Veterans Affairs to share veterans' contact information with State veterans agencies to improve outreach, and for other purposes.
Introduced August 6, 2026 by Catherine Marie Cortez Masto · Last progress August 6, 2026