Digital identity pilot modernization

Full Title:
VETRA Act

Summary#

This bill directs the Secretary of Veterans Affairs to run a time‑limited pilot program to modernize how the VA verifies and authenticates people who use its digital services. The pilot would replace single‑factor or knowledge‑based checks with multi‑factor, higher‑assurance digital identity solutions that meet certain federal standards. The stated goals are to reduce fraud and improper payments, improve secure access for veterans and other beneficiaries, and measure cost and operational effects before any wider rollout.

  • Main change: a pilot to upgrade identity proofing and authentication on up to three high‑volume VA digital platforms (examples listed include disability claims, health enrollment, education benefits, and home loan systems).
  • The solutions must be commercially available, meet NIST identity and authentication assurance standards (IAL2 and AAL2), and follow federal cybersecurity and privacy laws.
  • Funding is limited to up to $25 million in total, from amounts already authorized for VA IT; no new appropriations are authorized.
  • The bill requires an implementation plan, interim and final reports to congressional veterans’ committees, and an independent GAO evaluation.
  • The pilot authority ends two years after the law takes effect, and the VA cannot expand scope or funding without a new law.

What it means for you#

  • Veterans and benefit applicants: The pilot could change how you log in, create accounts, or recover access for the selected VA online services. You may be asked to use stronger authentication (for example, multi‑factor methods) or provide more proof of identity for certain transactions.
  • People applying for specific benefits: If a platform you use (disability claims, health enrollment, education benefits, or home loans) is chosen, you may see different sign‑in requirements and support workflows during the pilot.
  • Veterans with limited internet access, disabilities, or low digital literacy: The bill asks for assessment of impacts on these groups but does not specify exact accommodations. This could affect how easily some veterans can use the updated systems.
  • VA IT staff and program offices: They would run the pilot, integrate commercial identity products, collect metrics, and report results.
  • Commercial identity vendors: Only commercially available solutions may be used, so private vendors that meet the NIST standards could compete to supply the VA.
  • Congress and oversight bodies: Will receive implementation plans, interim/final reports, and an 18‑month GAO evaluation to decide whether to expand, modify, or stop the program.

Expenses#

Estimated public cost: up to $25,000,000, drawn from existing VA IT funding; no new authorization of funds.

  • The bill caps VA spending on the pilot at $25 million in the aggregate and says those funds must come from amounts already authorized for Information Technology Systems under VA law.
  • No separate fiscal note or detailed cost breakdown is included in the bill text.
  • Additional likely costs (not quantified in the bill) could include integration work, user support and training, vendor contracts, and internal administration and reporting.
  • The GAO evaluation and required reporting may involve staff time and administrative costs, but the bill does not provide separate funding for those tasks.

Proponents' View#

  • The bill appears intended to modernize outdated identity checks and reduce identity‑related fraud and improper payments.
  • Supporters may argue that using commercially available solutions that meet NIST IAL2/AAL2 will increase trust in VA digital services and protect veteran accounts.
  • A pilot lets the VA test changes on a limited number of platforms and measure operational and cost effects before a full rollout.
  • Risk‑tiered (adaptive) authentication could focus stricter checks where the risk or potential harm is higher, reducing unnecessary friction for low‑risk actions.

Opponents' View#

  • One concern is that stronger authentication could create new access barriers for veterans in rural areas, those with disabilities, or those with limited digital skills; the bill requires study of this but does not mandate specific accommodations.
  • It is unclear whether $25 million is enough to implement, integrate, and evaluate high‑assurance solutions across even three major VA platforms.
  • The bill does not specify which platforms will be chosen, the timeline for starting the pilot, or detailed methods for measuring cost savings.
  • There may be implementation risks around integration with existing VA systems, data sharing, privacy protections, and ongoing maintenance that the bill does not fully describe.
  • The pilot is limited to commercially available solutions and may not address cases where custom integrations are required.