State Parent Locator Service; Safeguarding Child Support Information

AGENCY:

Administration for Children and Families, Office of Child Support Enforcement (OCSE).

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Personal Responsibility and Work Opportunity Reconciliation Act of 1996 (PRWORA) created and expanded State and Federal title IV-D child support enforcement databases and significantly enhanced access to information for title IV-D child support purposes. States are moving toward integrated service delivery and developing enterprise architecture initiatives to link their program databases. This proposed rule is designed to prescribe requirements for: State Parent Locator Service responses to authorized location requests; and State IV-D agency safeguarding of confidential information and authorized disclosures of this information. This proposed rule would restrict the use of confidential data and information to child support purposes, with exceptions for certain disclosures permitted by statute.

DATES:

Consideration will be given to comments received by December 13, 2005.

ADDRESSES:

Send comments to: Office of Child Support Enforcement, Administration for Children and Families, 370 L'Enfant Promenade, SW., 4th floor, Washington, DC 20447. Attention: Director, Policy Division, Mail Stop: OCSE/DP. Comments will be available for public inspection Monday through Friday from 8:30 a.m. to 5 p.m. on the 4th floor of the Department's offices at the above address. You may also transmit written comments electronically via the Internet at: http://www.regulations.acf.gov . To download an electronic version of the rule, you may access http://www.regulations.gov .

FURTHER INFORMATION CONTACT:

Yvette Hilderson Riddick, Policy and Automation Liaison, OCSE, 202-401-4885, e-mail: yriddick@acf.hhs.gov. Deaf and hearing-impaired individuals may call the Federal Dual Party Relay Service at 1-800-877-8339 between 8 a.m. and 7 p.m. eastern time.

SUPPLEMENTARY INFORMATION:

Statutory Authority

This notice of proposed rulemaking is published under the authority granted to the Secretary by section 1102 of the Social Security Act (the Act), 42 U.S.C. 1302. Section 1102 authorizes the Secretary to publish regulations that may be necessary for the efficient administration of the functions for which he is responsible under the Act.

The provisions of this proposed rule pertaining to the Federal Parent Locator Service (PLS) implement section 453 of the Act, 42 U.S.C. 653. Section 453 requires the Secretary to establish and conduct a Federal PLS to obtain and transmit specified information to authorized persons for purposes of establishing parentage, establishing, modifying, or enforcing child support obligations, and enforcing any Federal or State law with respect to a parental kidnapping; or making or enforcing a child custody or visitation determination, as described in section 463 of the Act. It authorizes the Secretary to use the services of State entities to carry out these functions.

The provisions relating to the State PLS implement section 454(8) of the Act, 42 U.S.C. 654(8), which requires each State plan for child support enforcement to provide that the State will: (1) Establish a service to locate parents utilizing all sources of information and available records and the Federal PLS; and (2) subject to the privacy safeguards in section 454(26) of the Act, 42 U.S.C. 654(26), disclose only the information described in sections 453 and 463 of the Act to the authorized persons specified in those sections.

The provisions relating to the States' computerized support enforcement systems implement section 454A of the Act, 42 U.S.C. 654a, which requires States' systems to perform such functions as the Secretary may specify relating to management of the State title IV-D program.

In addition, the provisions pertaining to safeguarding of information implement section 454(26) of the Act, which requires the State IV-D agency to have in effect safeguards, applicable to all confidential information handled by the State agency, that are designed to protect the privacy rights of the parties. Nothing in this rule is meant to prevent the appropriate use of administrative data for program oversight, management, and research.

Organization of Preamble Discussion

The preamble discussion that follows is divided into two sections. The first section discusses amendments to the regulations on locating individuals and their assets in response to authorized location requests. The second section discusses a proposed new regulation on safeguarding and disclosure of State information and amendments to the regulation on security and confidentiality of information in computerized support enforcement systems.

Provisions of the Regulation

Section 1. State Parent Locator Service (§§ 302.35, 303.3, 303.20, and 303.70)

Current Federal regulations governing the IV-D program offer minimal guidance on the role of the State PLS. Federal regulations at 45 CFR 301.1 define the term “State PLS” to mean “the service established by the IV-D agency pursuant to section 454(8) of the Act to locate parents.” Resident parent in this proposed rule refers to custodial parent as established by the IV-D agency.

The regulations at 45 CFR 302.35 (a) and (b) require the IV-D agency to establish a central State PLS office using all relevant sources of information and records in the State, in other States, and in the Federal PLS.

At paragraph (c) of § 302.35, the role of the State PLS is addressed primarily in relation to the Federal PLS, specifying the individuals and entities from which the State PLS may accept requests to use the Federal PLS. Paragraph (d) restricts disclosure of Federal PLS information to these authorized persons. The current regulation does not provide guidance regarding information obtained through the State PLS from State sources. This proposed rule is intended to provide that guidance.

The regulation is silent about information obtained by the State PLS from State sources. States have interpreted both section 454(8) of the Act and current § 302.35 to permit use of State resources for non-IV-D location purposes, including location for custody and visitation purposes. This interpretation is also based upon a reading of section 453 of the Act that the “authorized persons” who are permitted to make a request to the Federal PLS—including private collection agencies or attorneys under the umbrella of “agent or attorney of a child—would also be authorized to submit requests for location services to the State PLS for matching against the State's own databases and against the databases of other States, often via the Child Support Enforcement Network.

The proposed amendments to the State PLS regulations are designed to:

• Address statutory changes from the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 regarding the information available to the State PLS from the Federal PLS;
• Reflect current processes, such as the automated match data that States routinely receive and no longer have to request from the Federal PLS; and
• Address disclosure of information obtained by the State PLS from State sources.

Section 302.35, State Parent Locator Service

The current regulation at § 302.35(a) contains a State plan requirement that the IV-D agency shall establish a State Parent Locator Service (PLS) using: (1) All relevant sources of information and records available in the State, and in other States as appropriate; and (2) the Federal PLS of the Department of Health and Human Services.

Proposed paragraph (a) would modify the current requirement for each State to “establish” a State PLS, since all States now have one, and instead require each State to “maintain” a State PLS “to provide locate information to authorized persons for authorized purposes.”

The proposed § 302.35(a)(1), covering IV-D cases, is designed to require that the State PLS access “the Federal PLS and all relevant sources of information and records available in the State, and in other States as appropriate, for locating custodial and noncustodial parents for IV-D purposes.” This proposed amendment makes clear that the State may use the State PLS for locating either parent for IV-D purposes. This is particularly important when a State is unable to distribute child support collections because it does not have a current address for the custodial parent. This paragraph also refers the reader to 45 CFR 303.3 for locate requirements and locate sources to be used for IV-D cases.

Revised paragraph (a)(2), covering locate requests for authorized non-IV-D individuals and purposes, would require a IV-D agency to access and release information authorized to be disclosed under section 453(a)(2) of the Act from “the Federal PLS and, unless prohibited by State law or written policy, information from relevant in-State sources of information and records, as appropriate” to respond to locate requests from a non-IV-D entity or individual specified in paragraph (c), for purposes specified in paragraph (d), as discussed below. This proposed provision implements sections 453 (a)(2) and 454(8) of the Act. Section 453(a)(2) of the Act establishes the Federal PLS to locate an individual, wages and other income from employment, and asset information. Section 454(8) of the Act requires the State PLS to access and release information described in sections 453 and 463 of the Act from the FPLS and from “all sources of information and available records” in the State to “authorized persons specified in such sections for the purposes specified in such sections.”

For non-IV-D requests, under proposed paragraph (a)(2) the State PLS would not access IRS information or financial institution data match information, which are available only to IV-D agencies, and to a limited extent to their agents, under Federal statute. The Internal Revenue Code (IRC) 26 USC6103(1), (6), (8), and (10) prohibits release of IRS information outside of the IV-D program, except for limited release allowed to IV-D contractors. This proposed regulation further restricts release of financial information received from the financial institution data match (FIDM) process under section 466(a)(17) of the Act. This prohibition implements the statutory responsibility of IV-D programs to safeguard confidential information not specifically authorized for release under section 453 of the Act. In addition, the restriction on release of financial information is intended to protect the privacy of individuals and their financial assets.

The State PLS must not access data in its computerized support enforcement system or forward the request to another State IV-D agency for locate. The State PLS would not be required to make subsequent location attempts if initial efforts fail to find the individual or information sought. However, if a requestor demonstrates that there is reason to believe that new information may be available, the State IV-D agency must make a subsequent location attempt. The State PLS would be used only in conjunction with a request for information from the Federal PLS in non-IV-D requests.

The current regulation at paragraph (b) requires that the IV-D agency must “establish a central State PLS office and may also designate additional IV-D offices within the State to submit requests to the Federal PLS.” The proposed amendment to current § 302.35(b) would remove mention of a State PLS “office,” in acknowledgment of changes in technology, which have prompted many States to alter their organizational structure and eliminate such “offices.” It would also require the IV-D agency to “maintain” rather than “establish” a central State PLS.

The current § 302.35(c)(1) through (5) specify the authorized persons and entities from whom the State PLS shall accept requests for locate information. The proposed amendments to paragraph (c) aim to strengthen the process by which authorized requestors obtain locate information through the State PLS, specifically with respect to requests from a resident parent, legal guardian, attorney, or agent of a non-IV-A child, as explained below.

Proposed § 302.35(c)(2), covering IV-D agency requests for information, has been reworded slightly for simplicity, but is otherwise unchanged and is reprinted for ease of review.

Current § 302.35(c)(3) simply refers to the “resident parent, legal guardian, attorney, or agent of a child” in non-IV-A cases as authorized persons. This paragraph would be expanded to address two concerns. The first concern addresses evidence of noncompliance with the statutory and regulatory requirement that requestors under section 453(c)(3) of the Act pay a fee pursuant to section 453(e)(2) of the Act. The second concern involves a private non-IV-D individual or entity acting on behalf of a non-IV-A child (whether or not the child is receiving services under the IV-D plan).

Proposed § 302.35(c)(3) makes it clear that the State PLS will accept locate requests from the resident parent, legal guardian, attorney or agent of a child who is not receiving aid under title IV-A of the Act only if key requirements are met. The proposed regulation would require the individual to: (i) Attest that the request is being made to obtain information on, or to facilitate the discovery of, an individual for the purpose of establishing parentage, establishing, setting the amount of, modifying, or enforcing child support obligations; (ii) attest that any information obtained through the Federal or State PLS will be used solely for these purposes and otherwise treated as confidential; (iii) provide evidence (e.g., an ID) that the requestor is the resident (custodial) parent, legal guardian or attorney of a child not receiving aid under title IV-A of the Act, or if an agent of such a child, evidence of a valid contract that meets any requirements in State law or written policy for acting as an agent; (iv) provide evidence that the requestor is the named individual who has requisite authority (e.g., guardianship papers identifying the requestor as the guardian) and (v) pay the Federal PLS fee required under section 453(e)(2) of the Act and current § 303.70(e)(2)(i) of this chapter (redesignated herein as § 303.70(f)(2)(i)), if the State does not pay the fee itself. The proposal also specifies that the State may charge a fee to cover its costs of processing these requests. A State's fee must be as close to actual costs as possible, so as not to discourage requests to use the Federal PLS. See 304.23(e) and 304.50 (a).

The attestations proposed in new clauses (i) and (ii) of § 302.35(c)(3) are modeled after the attestations that IV-D Directors or designees make in receiving Federal PLS data from OCSE under current § 303.70(d)(1) and (2). The goal is to apply to private individuals and entities requesting Federal PLS data under section 453(c)(3) the same standard to which IV-D agencies must adhere.

Proposed clause (iii) strengthens the process for ensuring that the requestor is one of the individuals authorized to act on behalf of a non-IV-A child for purposes of Federal PLS locate requests.

Proposed clause (iv) is intended to bolster the process for ensuring the required Federal fee is paid, to clarify that the State also may recover its costs through a fee, and to ensure that States are aware that no Federal financial participation is available in expenditures that States incur if they pay these fees themselves in non-IV-D cases. As indicated in § 304.50(a) the IV-D agency must exclude from its quarterly expenditures claims an amount to all fees which are collected during the quarter under the title IV-D State plan all fees which are collected during the quarter under title IV-D.

The proposed paragraph (c)(4) simplifies the language regarding the use of the Federal PLS for parental kidnapping, child custody or visitation cases. Previously, section 463 of the Act allowed States to enter into agreements to use the Federal PLS for parental kidnapping cases. Now States are required to have these agreements in place. The new language reflects the mandatory nature of this use, rather than making it contingent upon the existence of an agreement, as before. OCSE issued a recent Action Transmittal to raise awareness about use of the Federal PLS to locate a parent or child in order to: (1) Make or enforce a custody or visitation order; or (2) enforce a Federal or State law in a parental kidnapping case. This Action Transmittal, OCSE-AT-03-06, dated December 22, 2003, is available on the OCSE website at http://www.acf.hhs.gov/programs/cse under the heading Policy Documents.

The proposed paragraph (c)(5) merely rewords in simpler fashion the current language allowing locate requests from State title IV-B and title IV-E agencies.

The current paragraph (d) is redesignated as paragraph (e), as discussed below. A new paragraph (d) is proposed to be added to specify the authorized purposes for which the State PLS and the Federal PLS may be used and the locate information that may be released for these purposes. Paragraph (d)(1) covers the purposes of parentage and child support and related authorized releases of information. It pertains to IV-D and non-IV-D authorized persons and programs, including title IV-B and IV-E agencies. Proposed paragraph (d)(2) covers the purposes of enforcing a State law with respect to the unlawful taking or restraint of a child or for making or enforcing a child custody or visitation determination and the related authorized releases of information. The new paragraph (d) is intended to clarify how the purpose, requestor, and authorized release of information are tied together in responding to an information request. Section 463 of the Act, 42 U.S.C. 663, limits the information that may be disclosed for this type of inquiry.

Paragraph (d) of the current regulation, redesignated here as paragraph (e), requires privacy safeguards for Federal PLS information only. The proposed amendment, specifies at paragraphs (e)(1) and (2) that, subject to the requirements of this section and the privacy safeguards required under section 454(26) of the Act, the State PLS shall disclose “Federal PLS information” described in sections 453 and 463 of the Act and “information from in-State locate sources as required by this section and described in § 303.3(b)(1) of this chapter” only to authorized persons for authorized purposes.

A proposed Appendix A has been added at the end of this section to show graphically the linkages between authorizing statute, authorized purpose, authorized person or program, and authorized information.

Section 303.3, Location of Noncustodial Parents in IV-D Cases

The current regulation at § 303.3, Location of noncustodial parents, is divided into three main paragraphs. Paragraph (a) defines the term “location.” Paragraph (b) specifies the types of cases in which “the IV-D agency must attempt to locate all noncustodial parents or sources of income and/or assets when location is necessary to take necessary action.” Paragraphs (b)(1) through (5) describe the steps the IV-D agency must take under this standard. Paragraph (c) requires the State to establish guidelines defining diligent efforts to serve process.

Under the proposed regulation, § 303.3 is re-titled “Location of noncustodial parents in IV-D cases.”

Under paragraph (a) location is defined to mean “information concerning the physical whereabouts of the noncustodial parent, or the noncustodial parent's employers(s), other sources of income or assets, as appropriate, which is sufficient and necessary to take the next appropriate action in a case.” The proposed amendment to paragraph (a) clarifies that the definition of “location” is applicable for this section only. It further clarifies that “location” is an action that means “obtaining information,” not simply “information.”

The proposed amendments to paragraph (b) and its subparagraphs clarify which location requirements apply to IV-D cases.

Paragraph 303.3(b) requires the IV-D agency to attempt to locate a noncustodial parent in a IV-D case when location is needed to take necessary action. Paragraphs (b)(1) through (5) provide an extensive list of location sources, which as discussed below are unchanged for the most part from the current regulation. While all of these sources cited in § 303.3(b)(1) are available in IV-D cases, they may not be all available in response to non-IV-D location requests, depending upon State law or written policy. We believe State IV-D agencies should search State databases upon receiving a request from a resident parent, legal guardian, attorney, or agent of a child but are allowing States to determine the extent of that search, in accordance with State law or policy. Therefore we have proposed adding the words “for IV-D services” in paragraph (b) to clarify that location provisions under this paragraph are required in IV-D cases only.

Current paragraphs (b)(1) and (2) remain unchanged, but are republished to aid the reader.

Paragraph (b)(3) currently requires timely access of all appropriate locations sources and specifies that this includes the Federal PLS. We propose to remove the words “including transmitting appropriate cases to the Federal PLS” because States now submit cases to the Federal Case Registry for automatic matching with the National Directory of New Hires for locate purposes.

The existing regulation at paragraph (b)(4) requires the IV-D agency to “Refer appropriate cases to the IV-D agency of any other State, in accordance with the requirements of § 303.7 of this part.” The proposed amendment inserts the word “IV-D” before the word “cases” to clarify that the IV-D agency of State 1 may refer only IV-D cases to the IV-D agency of State 2.

Current paragraph (b)(5) remains unchanged, but is republished to aid the reader.

Proposed new paragraph (b)(6) is intended to draw a direct link between the IV-D agency's duty to locate noncustodial parents and the duty to safeguard information. The proposal incorporates by reference both the existing statutory requirement at section 454(26) of the Act and the proposed regulatory requirement at § 303.21.

Current paragraph (c) regarding diligent efforts to serve process is unchanged, but is republished to aid the reader in reviewing this section.

Section 303.20, Minimum Organizational and Staffing Requirements

The current regulation at § 303.20 describes the minimum organizational and staffing requirements for the IV-D agency. Paragraph (b) of this section requires an organizational structure and staff sufficient to fulfill specified State level functions, including, in paragraph (b)(7), “operation of the State Parent Locator Service as required under § 302.35 of this chapter.”

The proposed amendment to § 303.20(b)(7) inserts “§ 303.3 and 303.70” after the citation “§ 302.35.” The amendment is designed to heighten awareness about the critical role of the State PLS and ensure that the IV-D agency dedicates adequate resources to comply with the State PLS's responsibilities.

Section 303.21, Safeguarding and Disclosure of Confidential Information

As discussed below we are proposing to add a new Section 303.21 that will address safeguarding and disclosure of confidential information. This proposed regulation is discussed below in Section 2 of the Preamble.

Section 303.70, Procedures for Submissions to the State Parent Locator Service (State PLS) or the Federal Parent Locator Service (Federal PLS)

The following proposes that the Federal PLS reflect the automated matching and return of information to IV-D agencies in IV-D cases from the Federal PLS's Federal Case Registry and National Directory of New Hires. We are proposing to revise this section to address the current processes under which States no longer “request” Federal PLS information and we propose to replace the word “requests” with “submittals” wherever it appears. We are also proposing to redesignate paragraph (a) as (b) and to insert a new paragraph (a) in this section.

Paragraph (b) as redesignated includes language regarding a central State PLS “office.” For the reasons discussed earlier with regard to § 302.35, we are proposing to omit mention of a central “office.” The words “submit requests for information” are replaced with “make submittals” and the phrase “for the purposes specified in paragraph (a)” is added at the end.

Current paragraph (b) is redesignated as (c) and “requests” is replaced by “submittals”.

The existing regulation at § 303.70(c) is redesignated as paragraph (d). The current paragraph (c)(2) requires the IV-D agency to make “every reasonable effort” to find the individual's SSN prior to submitting a request to the Federal PLS. The newly designated paragraph (d)(2) changes this wording to “reasonable efforts,” in recognition of the increased technological capabilities at the Federal level to identify an individual's SSN, or to search without it. In addition, in newly designated paragraph (d)(1) and (2), references to “requests” have been changed to “submittals” and “parent” has been changed to “parent or putative father” to clarify that information may also be sought to determine paternity.

Existing paragraph (c)(3) requires that the request indicate “whether the individual is or has been a member of the armed services, if known.” Existing paragraph (c)(4) requires that the request indicate “whether the individual is receiving, or has received, any Federal compensation or benefits, if known.” Because the Federal PLS now automatically conducts a search to determine whether a person is or has been a member of the armed services, this proposed amendment removes current § 303.70(c)(3). The rationale for the proposed removal of current § 303.70(c)(4) regarding searches for receipt of Federal compensation or benefits is the same as that for removal of current § 303.70(c)(3). Removal of these two obsolete paragraphs necessitates the redesignation of current paragraph (c)(5) as new paragraph (d)(3).

The current regulation at § 303.70(d) has been redesignated as paragraph (e). It requires that each request from the State PLS to the Federal PLS be accompanied by a statement from the IV-D director, attesting to compliance with the listed requirements. Due to the expansion of the Federal PLS, submittals to the Federal PLS from the State PLS are received electronically. In addition, there has been a great increase in the volume of submittals. Although the concept of requiring an attestation remains important, requiring an attestation with every submittal is impractical and overwhelming. Thus, the proposed regulation allows for a single, annual attestation of compliance by the IV-D director regarding the use of the Federal PLS. The revised paragraph (e)(1)(i) would replace language about requests for information with language specifying that the IV-D agency will “obtain” information, since States obtain most Federal PLS information automatically now without request. A new paragraph (e)(1)(ii) would clarify that the IV-D agency will only provide information to authorized persons as specified in sections 453(c) and 463(d) of the Act.

Proposed paragraph (e)(2) is new and would require that, in the case of a submittal made on behalf of a resident parent, legal guardian, attorney or agent of a child not receiving aid under title IV-A, the IV-D agency must verify that the requestor has complied with the provisions of § 302.35. The proposed paragraph is designed to add more specificity about the role of the State PLS as a gatekeeper to the Federal PLS and heighten the State PLS's scrutiny of requests made by non-IV-D entities or individuals for Federal PLS services. The cross-reference to § 302.35 is intended to tighten up the procedures for accepting such requests.

Proposed paragraph (e)(3), formerly paragraph (d)(2), has been changed to specify that the IV-D agency shall treat information obtained through the Federal PLS as confidential and shall safeguard the information in accordance with statutory requirements and proposed § 303.21. The IV-D agencies must continue to emphasize to any other entities with which they share information the importance of treating the information as confidential and safeguarding it.

Current paragraph (e) has been redesignated as (f). In new paragraph (f)(1), the statutory references have been accompanied by explanatory phrases to enable the reader to better understand their meaning without requiring reference to the Act. In addition, current paragraph (e)(4)(i) is redundant of other language in this section and we propose to remove it and redesignate (e)(4)(ii) and (iii) as (f)(4)(i) and (ii). Finally, we propose to replace the word “transmitted” in new paragraph (f)(4)(ii) with the word “paid” to allow OCSE to alter payment methods as technology advances, without a change to the regulations.

Section 2. Safeguarding and Disclosure of Confidential Information (§ 303.21 and Amended § 307.13)

In the late 1990s, several amendments to the Social Security Act dramatically expanded the scope of information available to State IV-D agencies. The chart that follows lists the specific laws that had an impact on, or otherwise expanded access to and information received by, the Federal PLS and state child support enforcement programs. In addition, the amended legislation rendered obsolete or inconsistent several Federal regulations at 45 CFR chapter III, including the former regulation at 45 CFR 303.21, Safeguarding information. That regulation was not fully responsive to the post-PRWORA context in which the IV-D program now operates and it was removed by an interim final rule published in the Federal Register on February 9, 1999 (64 FR 6237, finalized on May 12, 2003 at 68 FR 25293). The Description of Regulatory Provisions is in the Preamble to the interim final rule indicated that OCSE would “develop comprehensive guidance consistent with PRWORA's provisions concerning safeguarding information, including any implementing regulations that may be necessary.”

In recent years, a frequently voiced position of State and local officials is the need for more data sharing across automated systems, particularly to provide better support for case managers in integrating services to clients. State officials often highlight the need for expanded capabilities to query multiple automated systems to support local program managers in obtaining the information they need to meet their particular management challenges. In making a disclosure under this provision, the IV-D agency may only disclose the minimum amount of confidential information needed for the purpose provided.

The General Accounting Office (GAO) has issued several recent reports that examine the barriers to data sharing. These reports, available from GAO, include “The Challenge of Data Sharing: Results of a GAO-Sponsored Symposium on Benefit and Loan Programs' (GAO-01-67, October 20, 2000). A GAO symposium was held July 7-8, 2000 and a major issue that it addressed was privacy and data sharing. The Child Support Enforcement program's National Directory of New Hires was frequently cited by symposium participants to illustrate both the benefits of data sharing and the privacy concerns. Participants discussed how access to, and use of, shared information could be appropriately limited to official personnel for authorized purposes related to program administration.

Many States now have enterprise architecture plans that envision systems integration efforts to support the delivery of integrated services and that advance the “no wrong door” concept for clients seeking services. In the past, because of different program and funding requirements, most of the State client information and eligibility systems were designed and built in relative isolation. To support an integrated approach to service delivery, current information systems may be integrated to allow greater sharing of client data and prevent redundant data collection, to the degree allowed by Federal and State law. States pursuing this approach to customer service cite privacy and security of data as major considerations. As a result, States are eager for guidance on how to restrict access to authorized users for authorized purposes only.

In addition, we now have tribal child support programs funded under section 455(f) of the Act. States need to know what information may be provided to tribal child support agencies.

These proposed regulations will add a new 45 CFR 303.21 to address the following concerns:

• What information is covered by safeguarding requirements?
• Who is subject to the regulation?
• What general rule applies to the information and the agencies and entities subject to the regulation?
• What exceptions are there?
• What safeguards are required?
• What penalties apply if the regulation is violated?

We also propose to amend 45 CFR 307.13, Security and confidentiality for computerized support enforcement systems in operation after October 1, 1997, for consistency with the changes in this proposed regulation requiring disclosure from the computerized support enforcement system of noncustodial parent names, addresses, telephone numbers and identifying IV-A case numbers to Workforce Investment Boards, in accordance with section 454A(f)(5) of the Act, as discussed further below.

Proposed Section 303.21, Safeguarding and Disclosure of Confidential Information

The proposed regulation consists of six paragraphs: (a) Definition; (b) Scope; (c) General rule; (d) Authorized disclosures; (e) Safeguards; and (f) Penalties for unauthorized disclosure.

Proposed Section 303.21(a), Definition

The proposed regulation begins with a definition of the term “confidential information.” Paragraph (a) would provide that “confidential information means any information relating to a specified individual or an individual who can be identified by reference to one or more factors specific to him or her, including, but not limited, to the individual's Social Security number, residential and mailing addresses, employment information, and financial information. The amount of support ordered and the amount of a support collection are not considered confidential information for purposes of this section.”

Proposed § 303.21(a) is designed to serve two primary purposes. First, the proposed new § 303.21 provides for safeguarding information pertaining to individuals, including not only “applicants or recipients of support enforcement services,” but also other individuals about whom information is maintained by the IV-D agency, such as information about noncustodial parents and children receiving IV-D services, as well as individuals not receiving IV-D services, such as newly hired employees reported to the State Directory of New Hires, who may have no connection to the IV-D program.

Second, the proposed regulation provides that the responsibility of the IV-D agency to safeguard information applies to information that specifically relates to an identified or identifiable individual. Thus, the phrase “including but not limited to” in § 303.21(a) is intended to highlight the types of information maintained by the IV-D agency that are most likely to be associated with a specific individual.

Proposed Section 303.21(b), Scope

The definition of the term “confidential information” in proposed § 303.21(a) is followed by a provision describing the scope of the proposed regulation. Proposed paragraph (b) reads: “The requirements of this section apply to the IV-D agency, any other State or local agency or official to whom the IV-D agency delegates any of the functions of the IV-D program, any official with whom a cooperative agreement as described in § 302.34 has been entered into, and any person or private agency from whom the IV-D agency has purchased services pursuant to § 304.22.”

The provision extends the application of the proposed regulation beyond the IV-D agency to encompass individuals and entities performing IV-D functions under contract or cooperative agreement with the IV-D agency or from whom the IV-D agency has purchased services. Proposed § 303.21(b) comports with language in existing § 302.12, which requires that each State plan provide for the establishment or designation of a single and separate organizational unit to administer the IV-D plan. Section 302.12(a)(2) makes it clear that the IV-D agency shall be responsible and accountable for the operation of the IV-D program but, with limited exceptions, need not perform all the functions of the IV-D program. If the agency delegates any of the IV-D functions or purchases services from any individual or entity, however, § 302.12(a)(3) makes it clear that the IV-D agency shall have responsibility for securing compliance with the State plan. In part, proposed § 303.21(b) tracks the language in § 302.12(a)(3) and is generally intended to clarify that entities under cooperative agreement with the IV-D agency and private contractors to the IV-D agency are bound by the same safeguarding requirements that bind the IV-D agency and its employees. The proposed provision relating to private contractors is similar to a requirement that applies to Federal contractors under the Privacy Act of 1974 (5 U.S.C. 552a(m)(1)), which governs Federal agencies, as well as the HHS regulations implementing the Privacy Act (45 CFR 5b.2(b)(1)).

Proposed Section 303.21(c), General Rule

Proposed paragraph (c) presents a general rule which states that “[e]xcept as authorized by the Act and implementing regulations, no entity described in paragraph (b) of this section shall disclose any confidential information obtained in connection with the performance of IV-D functions outside the administration of the IV-D program.”

The general rule at proposed § 303.21(c) prohibiting disclosure of confidential information is modeled after both the Federal Privacy Act and section 6103 of the IRC. Both the Privacy Act and the IRC provision on safeguarding data begin with a general prohibition on disclosure and then enumerate specific exceptions to the general rule. Proposed paragraph (d), described immediately below, enumerates the exceptions to the general rule presented in proposed paragraph (c).

Proposed Section 303.21(d), Authorized Disclosures

Proposed paragraph (d) sets forth the authorized disclosures that are exceptions to the general rule prohibiting disclosure of confidential information. Modeled after the first exception to the general prohibition against disclosure of tax information in section 6103 of the IRC, paragraph (d)(1) authorizes disclosure to the individual to whom the information pertains and anyone he or she designates. It would also enable the IV-D agency to release information that may be needed by an individual applying for certain services. In keeping with the view that an individual may consent to, or request, disclosure, this paragraph would make explicit that an individual shall be provided with his or her own confidential information, if requested. This would not include confidential information concerning any other individual involved in the case.

Under proposed paragraph (d)(2), the IV-D agency would be required to disclose information for certain limited purposes, as designated. Under paragraph (d)(2)(i), and to the extent that it does not interfere with the IV-D agency meeting its own obligations, information must be shared for administration of programs under titles IV (TANF, child and family services, and foster care and adoption programs), XIX (Medicaid program), and XXI (State Children's Health Insurance [SCHIP] program). Information is required to be shared with State programs under title IV and XIX in accordance with sections 454A(f)(3) and 453A(h)(2) of the Act. Using the Secretary's rule making authority under section 1102 of the Act, we included authority for States to share information with title XXI programs because of their close relationship with the IV-D program and because medical support is an important aspect of the Child Support Enforcement program.

Similarly, the proposed regulation would include disclosure to tribal programs authorized under titles IV-A and IV-D because of the need for these programs to work closely with State IV-D programs. State IV-D agencies are required to share information with these programs only to the extent that it does not interfere with their ability to meet their own obligations.

Programs receiving confidential information may use the information only for the purpose for which it was disclosed and may not redisclose the information. Based on the Secretary's general rulemaking authority in Section 1102, this rule proposes in paragraph (d)(2)(ii), that information may be disclosed for investigations, prosecutions or criminal or civil proceedings related to the administration of the programs listed in paragraph (d)(2)(i). Paragraph (d)(2)(iii) would permit the release of information to appropriate agencies and officials in cases of suspected child abuse. Release of such information would take the best interest of the child in consideration. Finally, paragraph (d)(2)(iv) would permit the release of information to programs designated pursuant to sections 453A and 1137 of the Act for income and eligibility verification purposes.

Proposed paragraph (d)(3) would require that, except for disclosures to title IV-A agencies, authorized disclosures under § 303.21(d)(2) shall not include confidential information from the National Directory of New Hires or Federal Case Registry, unless the information has been independently verified. No IRS information or financial institution data match information could be disclosed outside the administration of the IV-D program, unless independently verified or specifically authorized in Federal statute. IRS information is restricted as specified in the IRC. Note that financial institution data matches are authorized under section 466(a)(17) of the Act to increase the effectiveness of the IV-D program. Although a match occurs in coordination with the Federal PLS, financial institution data match information is not maintained by the Federal PLS, nor is it retrieved for Federal PLS location efforts outside the IV-D program. The information received in a financial institution data match may be used only as authorized in section 466(a)(17) of the Act for the purposes of locating and encumbering assets of a parent owing past-due support. In addition, section 453 of the Act does not include specific reference to the Federal role as intermediary in the financial institution data match required under section 466(a)(17) of the Act and, therefore, information received from such matches is not included in “information described in sections 453 and 463” required to be disclosed under section 454(8) of the Act to “authorized persons” referenced in those sections. Further, we believe that it is critical for IV-D agencies to protect and use only for IV-D purposes any financial information received as a result of these matches.

Proposed Section 303.21(e), Safeguards

This proposed section has its historical antecedent in 45 CFR 303.21(b). Proposed paragraph (e) provides that “In addition to, and not in lieu of, the safeguards described in § 307.13 of this chapter, which governs computerized support enforcement systems, the IV-D agency shall establish appropriate safeguards to comply with the provisions of this section.” Covered entities shall have in place appropriate administrative, technical, and physical safeguards. The cross-reference to part 307 is intended to make it clear that the proposed regulation applies to all confidential information obtained by the IV-D agency, whether the data is maintained in an automated or non-automated fashion.

Proposed paragraph (e) also provides that these “safeguards shall also prohibit disclosure to any committee or legislative body (Federal, State, or local) of any confidential information, unless authorized by the individual as specified in paragraph (d) of this section.” This makes clear that a legislative body or governmental committee cannot compel the release of information pertaining to an individual without consent of the individual.

Proposed Section 303.21(f), Penalties for Unauthorized Disclosure

Proposed paragraph (f) provides that “[a]ny disclosure of confidential information in violation of the Act and implementing regulations remains subject to any State and Federal statutes that impose legal sanctions for such disclosure.”

The reference to Federal law in proposed § 303.21(f) reflects the fact that, in addition to State statutes imposing legal sanctions, Federal statutes may also contain legal sanctions regarding the unauthorized disclosure of confidential information. Federal law grants the Secretary authority to ensure State compliance with the requirements of title IV-D through a variety of mechanisms, including reductions in quarterly payments and State plan disapproval. For example, pursuant to section 452(a) of the Act, the Secretary may disapprove a State's IV-D plan if the plan fails to comply with the requirements of section 454, including paragraph (26) of that section, requiring States to safeguard confidential information.

An Appendix A has been included at the end of this section to show graphically the linkages between authorizing statute, authorized purposes for release of information, authorized persons or programs, and authorized information.

Section 307.13—Security and Confidentiality for Computerized Support Enforcement Systems in Operation After October 1, 1997

Section 307.13 addresses security and confidentiality of computerized systems. We are revising paragraph (a) of § 307.13. Under the proposed rule, current paragraphs (a), (a)(1) and (a)(2) are unchanged, but have been republished to aid the reader. Paragraph (a) requires the State IV-D agency to have safeguards, including written policies, concerning access to data in the State's computerized support enforcement system. Paragraph (a)(1) requires the IV-D agency to have written policies to permit access to and use of data to the extent needed to carry out the State IV-D program. Paragraph (a)(2) requires the IV-D agency to specify in its written policies the data that may be used for particular program purposes, and the personnel permitted access to such data.

Current § 307.13(a)(3) requires that the State agency have written procedures to permit access to data by title IV-A and XIX programs, as necessary for their program purposes We are proposing to revise this paragraph to require the IV-D agency exchange data from its computerized support enforcement system with other title IV programs and the State Children's Health Insurance Program (SCHIP), to the extent that it does not interfere with the IV-D agency meeting its own obligations. The Office of the Inspector General, HHS, has conducted studies in cooperation with several States that demonstrated that many noncustodial parents are able to contribute to the costs of public health insurance, including SCHIP, on behalf of their children. The exchange and sharing of data between IV-D agencies and various other State and tribal IV-A and IV-D agencies, as well as State Medicaid and SCHIP programs, is critical to the success of these programs achieving their mutual goals, ensuring that families attain and maintain their independence from government cash and medical assistance.

In addition, the proposed regulation adds a new paragraph (a)(4) to require written policies that permit disclosure of noncustodial parent names, addresses, telephone numbers and identifying IV-A case numbers to Workforce Investment Boards (formerly called private industry councils) that receive welfare-to-work grants, as authorized in section 454A(f)(5) of the Act. These Boards support work for low-income noncustodial parents in their service areas.

The proposed paragraph (a)(5) would require written policies that limit disclosure, outside the IV-D program, of National Directory of New Hire or Federal Case Registry information, IRS information or financial institution data match information, from the computerized support enforcement system, to information that has been independently verified. The rationale for these limitations is discussed previously in this Preamble. The single exception would be the required disclosure of National Directory of New Hire or Federal Case Registry information to title IV-A agencies, where verification before disclosure is not required.

Paperwork Reduction Act

Section 302.35(c) contains an information collection requirement. As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), the Administration for Children and Families has submitted a copy of this section to the Office of Management and Budget (OMB) for its review.

The Locate Request Attestation in the proposed § 302.35(c)(3) is the information collection requirement, which is proposed to ensure that only authorized persons obtain information from the Federal PLS. The State IV-D agency would be required to obtain an attestation from each resident parent, legal guardian, attorney or agent of a child not receiving aid under title IV-A who requests information from the Federal PLS. Each requesting individual must: (1) Attest that the request for locate information is being made for an authorized purpose; (2) attest that the information will be used only for the authorized purpose and otherwise treated as confidential; and (3) provide evidence that the requestor is an authorized person. This information will be used to verify that the person making the request for Federal PLS information is in fact the resident parent, legal guardian, attorney or agent of a child not receiving aid under title IV-A and to ensure that this person understands that the information must only be used for child support purposes and otherwise treated as confidential.

The respondents affected by this information collection are State agencies and the parent, legal guardian, attorney or agent of a child not receiving aid under title IV-A.

The Administration for Children and Families will consider comments by the public on this proposed collection of information in the following areas:

• Evaluating whether the proposed collection is necessary for the proper performance of the functions of ACF, including whether the information will have practical utility;
• Evaluating the accuracy of the ACF's estimate of the burden of the proposed collection[s] of information, including the validity of the methodology and assumptions used;
• Enhancing the quality, usefulness, and clarity of the information to be collected; and
• Minimizing the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technology, e.g., permitting electronic submission of responses.

OMB is required to make a decision concerning the collection of information contained in these proposed regulations between 30 and 60 days after publication of this document in the Federal Register. Therefore, a comment is best assured of having its full effect if OMB receives it within 30 days of publication. This does not affect the deadline for the public to comment to the Department on the proposed regulations. Written comments to OMB for the proposed information collection should be sent directly to the following: Office of Management and Budget, Paperwork Reduction Project, 725 17th Street, NW., Washington, DC20503, Attention: Desk Officer for the Administration for Children and Families.

Regulatory Flexibility Analysis

The Secretary certifies that, under 5 U.S.C. 605(b), as enacted by the Regulatory Flexibility Act (Pub. L. 96-354), this rule will not result in a significant impact on a substantial number of small entities. The primary impact is on State governments. State governments are not considered small entities under the Act.

Regulatory Impact Analysis

Executive Order 12866 requires that regulations be reviewed to ensure that they are consistent with the priorities and principles set forth in the Executive Order. The Department has determined that this rule is consistent with these priorities and principles. This regulation responds to State requests for guidance on data privacy issues and therefore should not raise negative impact concerns.

Unfunded Mandates Reform Act of 1995

Section 202 of the Unfunded Mandates Reform Act of 1995 requires that a covered agency prepare a budgetary impact statement before promulgating a rule that includes any Federal mandate that may result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year.

If a covered agency must prepare a budgetary impact statement, section 205 further requires that it select the most cost-effective and least burdensome alternative that achieves the objectives of the rule and is consistent with the statutory requirements. In addition, section 203 requires a plan for informing and advising any small governments that may be significantly or uniquely impacted by the rule.

We have determined that this rule will not result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of more than $100 million in any one year. Accordingly, we have not prepared a budgetary impact statement, specifically addressed the regulatory alternatives considered, or prepared a plan for informing and advising any significantly or uniquely impacted small governments. Based on FY2004 data and analysis, some States allowing Private Collection Agencies to submit requests for location services to the FPLS, would at most double the amount of locate requests received by the FPLS. In FY2004, states reimbursed the FPLS for 20% of these types of costs. Therefore, the net cost to the FPLS would be less than .2% of the overall FPLS costs.

Congressional Review

This notice of proposed rule making is not a major rule as defined in 5 U.S.C. chapter 8.

Assessment of Federal Regulations and Policies on Families

Section 654 of the Treasury and General Government Appropriations Act of 1999 requires Federal agencies to determine whether a proposed policy or regulations may affect family well-being. If the agency's determination is affirmative, then the agency must prepare an impact assessment addressing seven criteria specified in the law. This regulation protects the confidentiality of information contained in the records of State child support enforcement agencies. These regulations will not have an impact on family well-being as defined in the legislation.

Executive Order 13132

Executive Order 13132 prohibits an agency from publishing any rule that has federalism implications if the rule either imposes substantial direct compliance costs on State and local governments and is not required by statute, or the rule preempts state law, unless the agency meets the consultation and funding requirements of section 6 of the Executive Order. We do not believe the regulation has federalism impact as defined in the Executive order. However, consistent with Executive Order 13132, the Department specifically solicits comments from State and local government officials on this proposed rule.

List of Subjects

45 CFR Part 302

• Child support
• Grants programs/social programs
• Reporting and recordkeeping requirements

45 CFR Part 303

• Child support
• Grant programs/social programs
• Reporting and recordkeeping requirements

45 CFR Part 307

• Child support
• Grant programs/social programs, computer technology,

(Catalog of Federal Domestic Assistance Programs No. 93.563, Child Support Enforcement Program.)

For the reasons discussed above, we propose to amend title 45 chapter III of the Code of Federal Regulations as follows:

PART 302—STATE PLAN REQUIREMENTS

1. The authority citation for part 302 is revised to read as follows:

Authority: 42 U.S.C. 651 through 658, 660, 664, 666, 667, 1302, 1396a(a)(25), 1396b(d)(2), 1396b(o), 1396b(p), 1396(k).

2. Section 302.35 is revised to read as follows:

PART 303—STANDARDS FOR PROGRAM OPERATIONS

1. The authority citation for part 303 is amended to read as follows:

Authority: 42 U.S.C. 651 through 658, 660, 663, 664, 666, 667, 1302, 1396a(a)(25), 1396b(d)(2), 1396b(o), 1396b(p) and 1396(k).

2. Revise § 303.3 to read as follows:

PART 307—COMPUTERIZED SUPPORT ENFORCEMENT SYSTEMS IN OPERATION AFTER OCTOBER 1, 1997

1. The authority citation for part 307 continues to read as follows:

Authority: 42 U.S.C. 652 through 658, 664, 666 through 669A, and 1302.

2. Amend § 307.13 by revising paragraph (a) to read as follows: