; and (ii) shall not engage with a company that works for Oracle, Oracle Cerner, or any subcontractor of either such company. (f) Terms relating to protection of data Any contract of the Department related to electronic health records entered into on or after January 1, 2018, shall include a clause or clauses, or be modified to include such clause or clauses, protecting the health and other personal identifying data of veterans to include a total prohibition on that data being monetized, sold, controlled, or otherwise misused by any internal or external entity conducting work for, with, or on behalf of the Department, including data that has gone through anonymization. 403. Independent verification and validation of certain major modernization efforts of Department of Veterans Affairs (a) Contracting authority Not later than 90 days after the date of the enactment of this Act, the Chief Acquisition Officer of the Department of Veterans Affairs established pursuant to section 1702 of title 41, United States Code, shall enter into a contract with an eligible entity under subsection (b) to carry out the oversight functions described in subsection (c). (b) Eligibility An entity is eligible under this subsection if the Chief Acquisition Officer of the Department determines that, with respect to the solicitation by the Department for a contract under subsection (a), the entity— (1) is currently performing or has performed, during the three-year period preceding the date of the issuance of such solicitation, not fewer than three prime contracts for the independent verification and validation, or equivalent technical and program oversight support, of major defense acquisition programs or priority defense business systems, in accordance with guidance of the Department of Defense relating to such acquisition programs or such business systems