Summary
Directs VA employees and contractors to use approved generative AI tools, restricts VA sensitive data including PHI and PII to tools with an appropriate Authority to Operate, requires users to verify outputs, and preserves user accountability and existing privacy, security, and records-management duties.
Healthcare Implications
VA care teams and contractors must use authorized tools for sensitive health data and remain responsible for AI-assisted work. High-impact uses involving healthcare or benefits are also subject to use-case inventory and risk-management requirements.