thefederalregister.com

Daily Rules, Proposed Rules, and Notices of the Federal Government

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of Child Support Enforcement

45 CFR Parts 302, 303, and 307

RIN 0970-AC01

State Parent Locator Service; Safeguarding Child Support Information

AGENCY: Office of Child Support Enforcement (OCSE), Administration for Children and Families (ACF), Department of Health and Human Services (HHS).
ACTION: Final rule.
SUMMARY: The Personal Responsibility and Work Opportunity Reconciliation Act of 1996 (PRWORA) created and expanded State and Federal title IV-D child support enforcement databases and significantly enhanced access to information for title IV-D child support purposes. States are moving toward integrated service delivery and developing enterprise architecture initiatives to link their program databases. This final rule prescribes requirements for: State Parent Locator Service responses to authorized location requests; and State IV-D program safeguarding of confidential information and authorized disclosures of this information. This rule restricts the use of confidential data and information to child support purposes, with exceptions for certain disclosures permitted by statute.
DATES: This rule is effective March 23, 2009.
FOR FURTHER INFORMATION CONTACT: Yvette Hilderson Riddick, Policy and Automation Liaison, OCSE, 202-401-4885, e-mail:yvetteriddick@acf.hhs.gov.Deaf and hearing-impaired individuals may call the Federal Dual Party Relay Service at 1-800-877-8339 between 8 a.m. and 7 p.m. eastern time.
SUPPLEMENTARY INFORMATION: I. Statutory Authority II. Summary Description of Regulatory Provisions A. State Parent Locator Service B. Safeguarding and Disclosure of Confidential Information III. Section-by-Section Discussion of Comments IV. Regulatory Review A. Paperwork Reduction Act B. Regulatory Flexibility Analysis C. Regulatory Impact Analysis D. Unfunded Mandates Reform Act of 1995 E. Congressional Review F. Assessment of Federal Regulations and Policies on Families G. Executive Order 13132 I. Statutory Authority

This final regulation is published under the authority granted to the Secretary of HHS (Secretary) by section 1102 of the Social Security Act (the Act), 42 U.S.C. 1302. Section 1102 authorizes the Secretary to publish regulations that may be necessary for the efficient administration of the functions for which he is responsible under the Act.

The provisions of this final rule pertaining to the Federal Parent Locator Service (PLS) implement section 453 of the Act, 42 U.S.C. 653. Section 453 requires the Secretary to establish and conduct a Federal PLS to obtain and transmit specified information to authorized persons for purposes of establishing parentage; establishing, modifying, or enforcing child support obligations; and enforcing any Federal or State law with respect to a parental kidnapping; or making or enforcing a child custody or visitation determination, as described in section 463 of the Act. It authorizes the Secretary to use the services of State entities to carry out these functions.

The provisions relating to the State PLS implement section 454(8) of the Act, 42 U.S.C. 654(8), which requires each State plan for child support enforcement to provide that the State will: (1) Establish a service to locate parents utilizing all sources of information and available records; and the Federal PLS established under section 453; and (2) shall subject to the privacy safeguards in section 454(26) of the Act, 42 U.S.C. 654(26), disclose only the information described in sections 453 and 463 of the Act to the authorized persons specified in those sections.

The provisions relating to the States' computerized support enforcement systems implement section 454A of the Act, 42 U.S.C. 654a, which requires States' systems to perform such functions as the Secretary may specify relating to management of the State title IV-D program. Additionally, as stated in section 454A(f) of the Act, the State shall use the statewide automated system to extract information from, to share and compare information with, and to receive information from, other data bases and information necessary to enable the State agency (or the Secretary or other State or Federal agencies) to carry out the Child Support Enforcement program under title IV-D of the Act, and other programs designated by the Secretary.

In addition, the provisions pertaining to safeguarding of information implement section 454(26) of the Act, which requires the State IV-D program to have in effect safeguards, applicable to all confidential information handled by the State agency, that are designed to protect the privacy rights of the parties. Nothing in this rule is meant to prevent the appropriate use of administrative data for program oversight, management, and research.

II. Summary Description of Regulatory Provisions

The following is a summary of the regulatory provisions included in this final rule. The Notice of Proposed Rulemaking (NPRM) was published in theFederal Registeron October 14, 2005 (70 FR 60038). The NPRM was organized into two major sections. Section 1: State Parent Locator Service discussed amendments to the proposed regulations on locating individuals and their assets in response to authorized location requests. Affected regulations include §§ 302.35, 303.3, 303.20, and 303.70. Section 2: Safeguarding and Disclosure of Confidential Information discussed new regulations on safeguarding and disclosure of confidential information, § 303.21 and amendments to the regulation on security and confidentiality of information in computerized support enforcement systems, § 307.13.

The Section-by-Section Discussion of Comments (Section III) provides a detailed listing of the comments and responses. Many commenters asked for points of clarification rather than for change of language in the regulation. There were some comments, however, that brought about regulatory language changes in the final rule. Specifically, major changes include:

In § 303.21(a) we deleted the last sentence “The amount of support ordered and the amount of a support collection are not considered confidential information for purposes of this section.” Commenters were concerned that this language may be interpreted as IV-D payment records could be made available to requestors not associated with the case who may want the information for purposes not related to child support.

In response to comments, we deleted paragraph (1) of § 303.21(d), which in the NPRM authorized disclosure of confidential information to the individual to whom the information pertains. To the extent that an individual is requesting information about himself/herself in the IV-D agency's files for a IV-D program purpose, the information may bedisclosed under paragraph (c), General rule. We also deleted under paragraph (e) Safeguards, that “safeguards shall prohibit disclosure to any committee or legislative body (Federal, State, or local) of any confidential information, unless authorized by the individual as specified in paragraph (d) of this section.” To the extent that an individual in a IV-D case submits a request to a legislator or legislative body concerning his or her IV-D case, the IV-D agency may disclose the information necessary for the response because the inquiry relates to the administration of the IV-D program and is authorized under paragraph (c).

We revised § 303.21(d)(2)(ii) and (iii) and relocated it to § 303.21(d)(1). Section 454A of the Act only permits the disclosure of information for non-IV-D purposes to State agencies of designated programs where the information is necessary to carry out a State agency function under that program. Therefore, we have relocated these disclosures to clarify that they are encompassed within this authority specified in § 303.21(d)(1). In paragraph (2), we restricted disclosure of information for income and eligibility verification purposes under sections 453A and 1137 of the Act to SDNH information.

We added language to § 303.21(e) that refers to family violence indicator requirements under § 307.11(f)(1)(x). Commenters thought we should add language regarding the family violence indicator which is an additional privacy safeguard for family violence victims.

We also changed § 307.13(a) of the NPRM by deleting paragraph (4). It referred to welfare-to-work, a grant program that no longer exists. We redesignated paragraph (a)(5) as paragraph (a)(4) and revised the language for clarity. As revised, it requires written policies that limit disclosure outside the IV-D program of National Directory of New Hire, Federal Case Registry and Internal Revenue Service (IRS) information from the computerized support enforcement system. The regulation sets forth the circumstances when information may be disclosed to IV-A, IV-B, and IV-E agencies and when IRS information may be disclosed. As revised, financial institution information cannot be shared outside the IV-D program. We made this change because of the language in section 469A(a) and (b) of the Act. These sections provide for non-liability for financial institutions when they disclose financial record information only for child support related purposes. Throughout the preamble and regulation we use “financial institution information” to refer to information covered by section 469A(a) and (b) of the Act. This information includes Multistate Financial Data Matches (MSFIDM) and State Financial Institute Data Matches (State FIDM).

Some commenters found the charts confusing, especially Appendix A in Section I and Appendix A in Section 2. We reorganized the two previous charts into three charts: Appendix A, B, and C. In Appendix A we reordered the chart by displaying locate efforts first by person rather than by purpose. Appendix A illustrates authority for locating individuals through the State PLS. Appendix B illustrates authority for locating an individual sought in a child custody/visitation or parental kidnapping case. Appendix C illustrates authority for State IV-D agencies to release information to non-IV-D Federal, State, and Tribal Programs. These charts are included at the end of the preamble for illustrative purposes only.

Section II. A. State Parent Locator Service (Sections 302.35, 303.3, 303.20, and 303.70) Section 302.35, State Parent Locator Service

The previous regulation at § 302.35(a) contained a State plan requirement that the IV-D program shall establish a State Parent Locator Service (PLS) using: (1) All relevant sources of information and records available in the State, and in other States as appropriate; and (2) the Federal PLS of the Department of Health and Human Services.

Paragraph (a) modifies the requirement for each State to “establish” a State PLS, and instead requires each State to “maintain” a State PLS “to provide locate information to authorized persons for authorized purposes.”

Section § 302.35(a)(1), covering IV-D agencies, cases and purposes, requires that the State PLS access “the Federal PLS and all relevant sources of information and records available in the State, and in other States as appropriate, for locating custodial parents, noncustodial parents, and children for IV-D purposes.” Paragraph (a)(2) addresses locate requests for authorized non-IV-D individuals and purposes. For purposes of this regulation, all requests under section 453(c)(3) of the Act are considered to be requests by non-IV-D individuals and purposes. This provision requires a IV-D program to access and release information authorized to be disclosed under section 453(a)(2) of the Act from “the Federal PLS and, in accordance with State law, information from relevant in-state sources of information and records, as appropriate” to respond to locate requests from a non-IV-D entity or authorized individual specified in paragraph (c) and for authorized purposes specified in paragraph (d).

For non-IV-D requests, under paragraph (a)(2), the State PLS will not access IRS information or financial institution information, which is available only to IV-D agencies and to a limited extent to their agents, under Federal statute.

The previous regulation at paragraph (b) required that the IV-D agency must “establish a central State PLS office and also may designate additional IV-D offices within the State to submit requests to the Federal PLS.” The amendment to § 302.35(b) removes mention of a State PLS “office.” It also requires the IV-D program to “maintain” rather than “establish” a central State PLS.

The previous § 302.35(c)(1) through (5) language specified the authorized persons and entities from whom the State PLS shall accept requests for locate information. The amendments to paragraph (c) strengthen the process by which authorized requestors obtain locate information through the State PLS, specifically with respect to requests from a resident parent, legal guardian, attorney, or agent of a non-IV-A child.

Previously, § 302.35(c)(3) simply referred to the “resident parent, legal guardian, attorney, or agent of a child” in non-IV-A cases as authorized persons. The revised § 302.35(c)(3) makes it clear that the State PLS will accept locate requests from the resident parent, legal guardian, attorney or agent of a child who is not receiving assistance under title IV-A of the Act only if key requirements are met. The regulation requires the individual to: (i) Attest that the request is being made to obtain information on, or to facilitate the discovery of, any individual in accordance with section 453(a)(2) of the Act for the purpose of establishing parentage, establishing, setting the amount of, modifying, or enforcing child support obligations; (ii) attest that any information obtained through the Federal or State PLS will be used solely for these purposes and otherwise treated as confidential; (iii) provide evidence that the requestor is the parent, legal guardian, attorney, or agent of a child not receiving assistance under title IV-A of the Act, and if an agent of such a child, evidence of a valid contract that meets any requirements in State law or written policy for acting as an agent, and if a parent, attestation that he or sheis the resident parent; and (iv) pay the Federal PLS fee required under section 453(e)(2) of the Act and § 303.70(f)(2)(i), if the State does not pay the fee itself. The regulation also specifies that the State may charge a fee to cover its costs of processing these requests. A State's fee must be as close to actual costs as possible, so as not to discourage requests to use the Federal PLS. See §§ 304.23(e) and 304.50(a). Paragraph (c)(4) simplifies the language regarding the use of the Federal PLS for parental kidnapping, child custody, or visitation cases. Paragraph (c)(5) rewords the previous language allowing locate requests from State title IV-B and title IV-E agencies.

Previous paragraph (d) is redesignated as paragraph (e), as discussed below. A new paragraph (d) is added to specify the authorized purposes for which the State PLS and the Federal PLS may be used and the locate information that may be released for these purposes. Paragraph (d)(1) covers the purposes of establishing parentage and establishing, modifying, or enforcing child support. It also covers related authorized releases of information to locate an individual who has or may have parental rights with respect to the child. It pertains to IV-D and non-IV-D authorized persons and programs, including title IV-B and IV-E agencies. For IV-B/IV-E cases that are non-IV-D and other cases under (d)(1), wage information is authorized and the State PLS may provide asset and/or debt information from the Federal PLS. Paragraph (d)(2) covers the purposes of enforcing a State law with respect to the unlawful taking or restraint of a child or for making or enforcing child custody or visitation determination and the related authorized releases of information.

Paragraph (e), requires privacy safeguards for Federal PLS information only. The amendment specifies at paragraphs (e)(1) and (2) that, subject to the requirements of this section and the privacy safeguards required under section 454(26) of the Act and the family violence indicators under section 307.11(f)(1)(x), the State PLS shall disclose “Federal PLS information” described in sections 453 and 463 of the Act and “information from in-state locate.” An Appendix A has been added at the end of the preamble to show the linkages between authorizing statute, authorized purpose, authorized person or program, and authorized information.

Section 303.3, Location of Noncustodial Parents in IV-D Cases

Under the final rule, § 303.3 is re-titled “Location of noncustodial parents in IV-D cases.” Under paragraph (a), location is defined to mean “information concerning the physical whereabouts of the noncustodial parent, or the noncustodial parent's employer(s), other sources of income or assets, as appropriate, which is sufficient and necessary to take the next appropriate action in a IV-D case.”

The amendments to paragraph (b) clarify which location requirements apply to IV-D cases. Paragraph 303.3(b) requires the IV-D program to attempt to locate a noncustodial parent in a IV-D case or his or her sources of income and/or assets when location is needed to take necessary action. Paragraphs (b)(1) through (5) provide an extensive list of location sources that as discussed below are unchanged for the most part from the previous regulation.

Paragraph (b)(3) no longer includes the words “including transmitting appropriate cases to the Federal PLS” because States now submit cases to the Federal Case Registry for automatic matching with the National Directory of New Hires for locate purposes.

The previous regulation at paragraph (b)(4) required the IV-D program to “Refer appropriate cases to the IV-D program of any other State, in accordance with the requirements of § 303.7 of this part.” The amendment inserts the word “IV-D” before the word “cases” to clarify that the IV-D program of State 1 may refer only IV-D cases to the IV-D program of State 2.

New paragraph (b)(6) draws a direct link between the IV-D program's duty to locate noncustodial parents and the duty to safeguard information. The language incorporates by reference both the existing statutory requirement at sections 454(26) and 454A(d) and (f) of the Act and the regulatory requirements at §§ 303.21 and 307.13.

Current paragraph (c) regarding diligent efforts to serve process is unchanged, but is republished to aid the reader in reviewing this section.

Section 303.20, Minimum Organizational and Staffing Requirements

The regulation at § 303.20 describes the minimum organizational and staffing requirements for the IV-D program. Paragraph (b) of this section requires an organizational structure and staff sufficient to fulfill specified State level functions, including, in paragraph (b)(7), “operation of the State Parent Locator Service as required under §§ 302.35, 303.3, and 303.70 of this chapter.”

Section 303.21, Safeguarding and Disclosure of Confidential Information

This new regulation is discussed in Section II.B.

Section 303.70, Procedures for Submissions to the State Parent Locator Service (State PLS) or the Federal Parent Locator Service (Federal PLS)

With passage of legislation that established the National Directory of New Hires (NDNH) in 1996 and established the Federal Case Registry (FCR) in 1998, the Federal PLS became highly automated. The language in this section has been revised to indicate that the Federal PLS reflects the automated matching and return of information to IV-D programs in IV-D cases from the Federal PLS's Federal Case Registry and National Directory of New Hires. For example, while requests for Federal PLS information are accepted, State IV-D programs no longer “request” Federal PLS information and we replaced the word “requests” with “submittals” wherever it appears. We eliminated the word “office” as in State PLS “office” to demonstrate that this work is automated.

A new paragraph (a) has been inserted: The State agency will have procedures for submitting to the State PLS or the Federal PLS for the purpose of locating parents, putative fathers, or children for the purpose of establishing parentage or establishing, setting the amount of, modifying, or enforcing child support obligations; or for the purpose of enforcing any Federal or State law with respect to the unlawful taking or restraint of a child; or making or enforcing a child custody or visitation determination as defined in section 463(d)(1) of the Act. The previous paragraph (a) has been redesignated as paragraph (b) and the previous paragraph (b) has been redesignated as paragraph (c).

In addition, in newly designated paragraph (d) all submittals shall contain the following information: (1) The parent's or putative father's name; (2) the parent's or putative father's Social Security Number (SSN). If the SSN is unknown the IV-D program must make reasonable efforts to ascertain the individual's SSN before making a submittal to the Federal PLS; and (3) any other information prescribed by the Office.

The previous regulation at § 303.70(d) has been redesignated as paragraph (e). It requires that annually the IV-D director attest to compliance with the listed requirements. Paragraph (e)(1)(i) specifies that the IV-D program will “obtain” rather than “request”information. A new paragraph (e)(1)(ii) clarifies that the IV-D program will only provide information to authorized persons as specified in sections 453(c) and 463(d) of the Act and § 302.35.

Paragraph (e)(2) is new and requires that, in the case of a submittal made on behalf of a resident parent, legal guardian, attorney or agent of a child not receiving assistance under title IV-A, the IV-D program must verify that the requestor has complied with the provisions of § 302.35.

Paragraph (e)(3), formerly paragraph (d)(2), has been changed to specify that the IV-D program shall treat information obtained through the Federal PLS as confidential and shall safeguard the information in accordance with statutory requirements at § 303.21.

Paragraph (f) has minor changes. In (f)(1) the statutory references have been accompanied by explanatory phrases for better understanding and in (f)(4)(ii) the word “paid” has been changed to “transmitted” to reflect the change in payment methodology due to technology advances.

II.B. Safeguarding and Disclosure of Confidential Information (Sections 303.21 and 307.13) Section 303.21, Safeguarding and Disclosure of Confidential Information

The regulation consists of six paragraphs: (a) Definitions; (b) Scope; (c) General rule; (d) Authorized disclosures; (e) Safeguards; and (f) Penalties for unauthorized disclosure.

Section 303.21(a)Definitions

The regulation begins with a definition of the term “confidential information.” Paragraph (a)(1) provides that “confidential information” means any information relating to a specified individual or an individual who can be identified by reference to one or more factors specific to him or her, including, but not limited, to the individual's Social Security Number, residential and mailing addresses, employment information, and financial information. Paragraph (a)(2) defines independent verification to mean the process of acquiring and confirming confidential information through the use of a second source. The information from the second source, which verifies the information about NDNH or FCR data, may be released to those authorized to inspect and use the information as authorized under the regulations or the Act.

Section 303.21(b)Scope

Paragraph (b) reads: “The requirements of this section apply to the IV-D agency, any other State or local agency or official to whom the IV-D agency delegates any of the functions of the IV-D program, any official with whom a cooperative agreement as described in § 302.34 has been entered into, and any person or private agency from whom the IV-D agency has purchased services pursuant to § 304.22.”

Section 303.21(c)General Rule

Paragraph (c) presents a general rule which states that “[e]xcept as authorized by the Act and implementing regulations, an entity described in paragraph (b) of this section may not disclose any confidential information, obtained in connection with the performance of IV-D functions, outside of the administration of the IV-D program.”

Section 303.21(d)Authorized Disclosures

Paragraph (d) sets forth the authorized disclosures that are exceptions to the general rule prohibiting disclosure of confidential information. Under paragraph (d)(1), upon request, the IV-D agency may, to the extent that it does not interfere with the IV-D agency meeting its own obligations, disclose information for certain limited purposes. Under paragraph (d)(1) information may be shared for administration of programs under titles IV (TANF, child and family services, and foster care and adoption programs), XIX (Medicaid program), and XXI (State Children's Health Insurance [SCHIP] program) of the Act. The regulation also includes disclosure to Tribal programs authorized under title IV-A and IV-D of the Act.

Paragraph (d)(2) (previously paragraph (d)(2)(iv)) permits the release of SDNH information to programs designated pursuant to sections 453A and 1137 of the Act for income and eligibility verification purposes.

Paragraph (d)(3) requires that authorized disclosures under § 303.21(d)(1) and (2) shall not include confidential information from the National Directory of New Hires, the Federal Case Registry, or Internal Revenue Service (IRS), unless authorized under § 307.13 or unless the information has been independently verified. A State may independently verify the NDNH or the FCR information through another source, in which case the information from the second source may be used. Independent verification is the process of acquiring and confirming confidential information through the use of a second source. The information from the second source may be released to those authorized to inspect and use the information. For example, if a State determines that an address is correct through a postal verification the State can share the information it acquired from the second source (the Post Office). No IRS information can be disclosed outside of the administration of the IV-D program, unless specifically authorized in Federal statute or independently verified. IRS information is restricted as specified in the Internal Revenue Code (IRC). No financial institution information may be disclosed outside the IV-D program. The restriction on release of financial institution information outside the IV-D program is due to the liability protection given to financial institutions for release of information to the Federal PLS or to the State IV-D programs for child support purposes as indicated in section 466(a)(17)(C) of the Act and limitations in section 469A of the Act, regarding the use of such information.

Section 303.21(e)Safeguards

Paragraph (e) provides that “In addition to, and not in lieu of, the safeguards described in § 307.13 of this chapter, which governs computerized support enforcement systems, the IV-D agency shall establish appropriate safeguards to comply with the provisions of this section.” These safeguards shall also include prohibitions against the release of information when the State has reasonable evidence of domestic violence or child abuse against a party or a child and that the disclosure of such information could be harmful to the party or the child, as required by § 454(26) of the Act, and shall include use of the family violence indicator required under § 307.11(f)(1)(x) of this chapter.

Section 303.21(f)Penalties for Unauthorized Disclosure

Paragraph (f) provides that “[a]ny disclosure or use of confidential information in violation of the Act and implementing regulations remains subject to any State and Federal statutes that impose legal sanctions for such disclosure.”

Section 307.13Security and Confidentiality for Computerized Support Enforcement Systems in Operation After October 1, 1997

Section 307.13 addresses security and confidentiality of computerized systems. Paragraph (a), (a)(1), and (a)(2) are unchanged. Paragraph (a) addresses information integrity and security. Automated systems must have safeguards protecting the integrity,accuracy, completeness of, access to, and use of data in the computerized support enforcement system. These safeguards shall include written policies concerning access to data by IV-D program personnel, and the sharing of data with other persons to: (a)(1) Permit access to and use of data to the extent necessary to carry out the State IV-D program under this chapter and (a)(2) specify the data which may be used for particular IV-D program purposes, and the personnel permitted access to such data.

Paragraph (a)(3) permits the IV-D agency to exchange data from its computerized support enforcement system with agencies administering other programs under titles IV, XIX, and XXI of the Act to the extent necessary to carry out State and Tribal agency responsibilities under such programs in accordance with section 454A(f)(3) of the Act; and to the extent that it does not interfere with the IV-D agency meeting its own obligations.

Paragraph (a)(4) as written in the NPRM has been deleted. It referred to welfare-to-work, a grant program that no longer exists. The present paragraph (a)(4) which previously was paragraph (a)(5) has been rewritten for clarity and requires written policies that generally prohibit disclosure outside the IV-D program of National Directory of New Hire or Federal Case Registry information, or IRS information from the computerized support enforcement system, to information that has been independently verified. IV-A, IV-B, and IV-E agencies are authorized under various subsections of section 453 of the Act to receive NDNH and FCR information from the Federal PLS for certain specified purposes. Since these agencies are authorized to have this information, we are permitting the IV-D agency to disclose the NDNH or FCR information from the IV-D computerized support enforcement system directly to the IV-A, IV-B, or IV-E agency if it is being requested for the purpose authorized under section 453 of the Act. For IV-B and IV-E programs this includes establishing paternity or parental rights with respect to a child.

III. Section-by-Section Discussion of Comments

This section provides a detailed discussion of comments received on the proposed rule, and describes changes made to the proposed rule. We refer generally to actions of the “Department” pursuant to the rule. The rule itself refers to actions of the “Secretary” but the day-to-day activities of the Secretary's functions have been delegated and are exercised by other Department officials, primarily in the Administration for Children and Families. “Office” refers to the Federal Office of Child Support Enforcement (OCSE). We received approximately 200 comments from 20 IV-D programs (including 1 tribe), 3 organizations, and 1 private citizen. Many comments were for points of clarification rather than stating support or opposition to the proposed regulation. For example, many comments indicated a lack of awareness on existing longtime requirements such as the statutory restrictions of access to Federal PLS data on IV-D systems for certain unauthorized persons and programs.

General Comments

There were various comments that are not attributable to specific sections of the regulation and are discussed below.

1. Comment:Two commenters ask that once the final rule is imposed, OCSE provide States with reasonable time to implement these regulations, which may include changes to State legislation and automated systems. Another commenter believes the Office should make clear what the effective date is of this regulation as was done with some regulations while implementing PRWORA.

Response:This rule is effective 6 months from the date of publication.

2. Comment:One commenter requested that the Secretary insert language from sections of the Social Security Act so the reader does not have to look up sections of the Act.

Response:To do so would significantly increase the length of regulatory language. We have attempted to ensure there are no cross-references without a brief summary of the content of those statutory sections.

3. Comment:This regulation possibly sets up competing public interests. For example: Pitting the confidentiality regulation versus the openness of the judicial system and court files; the regulation versus the State's public policy of open government (Sunshine laws); the regulation versus the State Constitution's provision for access to public records and meetings.

Response:These regulations govern disclosure of IV-D data under sections 454(26), 453, and 454A of the Act. A wide array of personal information is available to IV-D agencies and it is imperative that the Federal and State governments protect these data to the greatest extent possible and use them only where necessary for authorized purposes. Child support records, including Federal PLS information, contain information that poses a high risk of identity theft, and thus should be treated with special care.

4. Comment:One commenter asks why this rule includes proposed additional restrictions on sharing certain Federal data with other public agencies in one part of the rule while proposing granting broad access to State data to private entities in another part. According to the commenter, use of data disclosed to other State agencies can be easily monitored while private entities are less accountable, harder to monitor, and more likely to use data for unauthorized purposes.

Response:This regulation is determined in large part by explicit Federal statute. Section 454(8) of the Act says that “the agency administering the (State) plan will establish a service to locate parents * * * and shall, subject to the privacy safeguards required under paragraph (26), disclose only the information described in sections 453 (Federal PLS) and 463 (Use of the Federal PLS in connection with enforcement of determination of child custody and in cases of parental kidnapping) to the authorized persons specified in such sections for the purposes specified in such sections.” With respect to private entities the regulation at § 302.35(c)(3) requires an attestation process that must be used by the resident parent, legal guardian, attorney, or agent of a child who is not receiving assistance under title IV-A of the Act when obtaining information on or to facilitate the discovery of any individual in accordance with section 453(a)(2) of the Act.

5. Comment:In 42 U.S.C. 654(26), Congress allowed States to have flexibility in crafting confidentiality requirements. States may find it difficult to follow a regulatory “one size fits all” approach and make changes to the law in matters over which child support agencies have no authority.

Response:The regulation reflects statutory requirements as stated in section 454(26) of the Act that a child support State Plan must provide that States have in effect safeguards, applicable to all confidential information handled by the State agency, that are designed to protect the privacy rights of the parties involved. It also reflects other statutory restrictions on disclosure in sections 453 and 454A of the Act.

6. Comment:If the Federal Bureau of Investigations (FBI) was called to investigate possible sources of threats to a IV-D caseworker and the FBI demanded the names and contact information for every person on the IV-D employee's caseload, would the IV-D agency be justified in sharing thisinformation with the FBI? Does protecting a IV-D worker from potential harm fall under the provisions of a IV-D purpose?

Response:The IV-D agency could share the information because the investigation relates to the administration of the IV-D program.

7. Comment:Two commenters say that OCSE should reaffirm its commitment to additional privacy safeguards for family violence victims by incorporating references to the family violence indicator in the rule.

Response:We agree and have added language to § 303.21(e) that provides explicit reference to required family violence indicators for potential domestic violence or child abuse.

8. Comment:Two commenters are concerned that when enforcing a referral from a Tribal IV-D agency located in that State or in another State, a State would be unable to provide information about whether a Federal tax refund offset occurred and the amount collected. This would make it impossible for the Tribal IV-D agency to correctly adjust the arrearage to give the noncustodial parent credit for the tax refund offset. Another commenter believes the Internal Revenue Services (IRS) statute at 26 U.S.C. 6103 sufficiently provides for confidentiality limitations for States to disclose information to Tribes and States. Tribal IV-D agencies do not need another regulation to further burden negotiations with State IV-D agencies.

Response:Policy Interpretation Question (PIQ) 07-02 addresses this. Seehttp://www.acf.dhhs.gov/programs/cse/pol/PIQ/2007/piq-07-02.htm. A State may submit arrearages owed in Tribal IV-D cases for Federal tax refund offset if the following conditions are met:

1. The approved Tribal IV-D plan or plan amendment indicates that the Tribe has entered into a cooperative agreement with the State under § 309.60(b) and (c) for the State to submit arrearages owed in Tribal IV-D cases for Federal tax refund offset. The Tribe must submit as part of its Tribal IV-D plan or plan amendment copies of any such agreement. The regulations governing Tribal IV-D programs at § 309.35(d) require that after approval of the original Tribal IV-D program application, all relevant changes required by new Federal statutes, rules, regulations, and Department interpretations are required to be submitted so that the Secretary may determine whether the plan continues to meet Federal requirements and policies.

2. The cooperative agreement between the Tribe and State includes a statement that the Tribal IV-D program will comply with all safeguarding requirements with respect to Federal tax refund offset in accordance with § 309.80, section 454(26) of the Act and the Internal Revenue Code 26 U.S.C. 6103, which prohibits the release of IRS information outside of the IV-D program.

3. The Tribal IV-D plan provides evidence that the Tribe's application for IV-D services under § 309.65(a)(2) includes a statement that the applicant is applying for State IV-D services for purposes of submitting arrearages for Federal tax refund offset.

9. Comment:One commenter says there must be an easy-to-use procedure for individuals misidentified by child support database programs to correct agency records and also requests that this rule provide for a system to flag errors where files are “mixed.”

Response:If an individual believes he or she has been misidentified by the IV-D system, he or she should contact the appropriate IV-D office. The IV-D program should fix the error as soon as possible. These regulations do not go into the details of step-by-step State case processing that would make such a proposal appropriate.

10. Comment:One commenter requests that language in the preamble to the proposed rule be incorporated into the actual regulation. Page 60044, column 3 says “programs receiving confidential information may use the information only for the purpose for which it was disclosed and may not redisclose the information.” However, this restriction on redisclosure is not in the text of the proposed rule.

Response:This regulation is for title IV-D programs and we cannot regulate other programs once information is disclosed. However, State IV-D programs must make clear to those authorized to receive child support data, the limited purpose for which information may be used. Improper use or disclosure would be governed by State and Federal statutes that impose penalties for such disclosure.

11. Comment:One commenter says there is no legislative history that Congress contemplated expanding access to State databases and records beyond the IV-D program or beyond what is otherwise permitted by State law.

Response:The provisions relating to the State PLS implement section 454(8) of the Act, 42 U.S.C. 654(8), which requires each State plan for child support enforcement to provide that the State will: (1) Establish a service to locate parents utilizing all sources of information and available records including the Federal PLS; and (2) be subject to the privacy safeguards in section 454(26) of the Act, 42 U.S.C. 654(26) and disclose only the information described in sections 453 and 463 of the Act to the authorized persons specified in those sections. This language authorizes a system of disclosure of State data based on the system in place for the Federal PLS. We have revised the regulation to recognize the possibility of more restricted access to State data by incorporating the language “in accordance with State law.”

12. Comment:One commenter is concerned that States are not informing individuals when disclosure of their Social Security Number (SSN) to another source will occur and by collecting noncustodial parents' SSNs from a third party source.

Response:States are required to comply with section 7(b) of the Privacy Act and its disclosure requirements (5 U.S.C. 552a). In all IV-D cases, the Privacy Act requires a Federal, State, or local government agency to provide certain information to the individual from whom a SSN is requested by the agency.

13. Comment:One commenter says that notice and due process are required when States use, release, or enter data into State PLS and Federal PLS computer interface records on individuals who do not need to be located for purposes of child support.

Response:Access to personal data covered by the regulation is authorized as explicitly provided for in Federal title IV-D statute.

Section 302.35, State Parent Locator Service

1. Comment:Two commenters have major concerns with this section. One would like to know the reason for these amendments, opposes the requirement that the State PLS provide information to requestors with regard to in-state sources, and strongly recommends that references to access and release of in-state State PLS information be deleted from the proposed regulation. The other commenter is concerned with this section and believes the regulation erodes the capability of the child support program to safeguard confidential information. The regulation creates a presumption, not supported by law, that non-IV-D entities may access in-state resources.

Response:A State/Federal workgroup, established after the passage of the Personal Responsibility and Work Opportunity Reconciliation Act,recommended that these regulations be promulgated in order to clarify the statutory limitations of sharing data. In response to comments we have revised the regulation to provide State searches only to the extent authorized by State law. With regard to in-state sources, section 454(8) of the Act says a State shall be subject to the privacy safeguards in section 454(26) of the Act, 42 U.S.C. 654(26).

2. Comment:One commenter asks why the regulation does not clearly tie authorized persons to the authorized purposes for which they may receive locate information, addressing persons and in separate subsections.

Response:We disagree. The authorized persons and purposes are clearly stated in the regulation and are identical to those of the Federal PLS. Appendix A displays this set of authorities.

3. Comment:One commenter would like to eliminate the reference in Appendix A that says “No automated system” for Authorized Purpose B, C, and D.

Response:This Appendix and others have been revised and/or added. Any limitation of disclosure of automated systems data is required by section 454A of the Act.

4. Comment:One commenter proposes adding a section to this provision that requires maintenance of an audit log to deter employee misuse of databases. Audit logs hold individuals responsible for their use of personal information databases and would record who accesses personal information, and the purpose for which it was accessed.

Response:Federal requirements do not prescribe this level of mandate on State responsibilities. It is up to the State to implement necessary and appropriate methods to ensure that access and disclosure is for proper purposes and only to authorized persons. States have discretion, however, to implement similar audit procedures.

5. Comment:One commenter recommends moving § 302.35(b) closer to § 302.35(a) to clarify that the Federal PLS is considered part of the State PLS for IV-D cases and for authorized non-IV-D purposes under this section.

Response:The Federal PLS is not part of the State PLS. Subparagraph (b) is based on the requirement that requests for Federal PLS data must flow through the State PLS.

6. Comment:One commenter asks for confirmation that together §§ 302.35(a)(1) and (2) and 302.35(c) limit the use of the State PLS for IV-D cases to only IV-D purposes but permits the use of the State PLS for non-IV-D individuals or non-IV-D cases for the authorized non-IV-D purposes.

Response:Section 302.35(a)(1) and (2) limit the use of the State PLS for IV-D cases to only IV-D purposes but permits the use of SPLS for non-IV-D individuals or non-IV-D cases for the authorized non-IV-D purposes.

7. Comment:One commenter suggests that the title of paragraph (1) be changed to “For IV-D cases and IV-D purposes” for clarity.

Response:For clarity, we have revised the title of paragraphs (1) and (2) to distinguish between IV-D requests and non-IV-D requests.

8. Comment:One commenter asks that the Office clarify why locate information, restricted for custody and visitation purposes to the most recent address and place of employment, requires such strict confidentiality where there is not a family violence indicator or other information giving rise to safety concerns for the parties. The address of a litigant to a court proceeding is considered public information and necessary for the case to proceed.

Response:The restriction is statutory. Section 463(c) of the Act [Use of Federal PLS in connection with the enforcement or determination of child custody and in cases of parental kidnapping of a child] contains the restriction “Only information as to the most recent address and place of employment of any parent or child shall be provided under this section.”

9. Comment:In addition to using the State PLS for locating either parent for IV-D purposes, one commenter asks that the agency also be able to use the State PLS for locating the child for IV-D purposes.

Response:IV-D agencies already have that authority with the Federal PLS. Section 453(a)(2)(iii), which states “to whom such an obligation is owed” includes the child. However, in response to this comment, we have added “children” to § 302.35(a)(1).

10. Comment:One commenter points out what he or she believes to be a mistake: “Child” is included in Appendix A to § 302.35 under “Authorized Purpose” but is not included in the preamble or in the regulation. Another commenter suggests that this section of the regulation be revised by deleting the words “noncustodial parents” and inserting “a parent or child.”

Response:We agree and have included reference to custodial parents, noncustodial parents and children in both the preamble and the regulation at § 302.35.

11. Comment:One commenter suggests substituting the word “parties” for “parents” since the IV-D or a cooperating agency may be enforcing a support order in a IV-D case for a custodial party other than a parent.

Response:The statute uses the term parent, although we recognize there may be instances where children are in the custodial care of individuals other than their parents.

12. Comment:One commenter points out that the reference to § 303.3 in the second sentence of § 302.35(a)(1) creates confusion because § 303.3 only addresses locate requirements for noncustodial parents in IV-D cases. The commenter assumes this is not the intent of the proposed regulation and, to avoid confusion, recommends removing the second sentence of § 302.35(a)(1) because the first sentence clearly conveys the intent of the subsection.

Response:We agree and have removed the reference to § 303.3, which only applies to location of noncustodial parents in IV-D cases.

13. Comment:Several commenters had comments relating to the use of the State Disbursement Unit in non-IV-D case situations. Since it is a IV-D function to disburse support to custodial parents in non-IV-D cases subject to income withholding, can a IV-D program use the State PLS or Federal PLS to locate a non-IV-D custodial parent for purposes of disbursing child support?

Response:Yes, this would be a legitimate use of locate sources for IV-D agencies seeking to locate such custodial parents in non-IV-D cases subject to income withholding.

14. Comment:One commenter points out a contradiction in the regulation regarding the use of in-state locate sources. On the one hand, § 302.35(a)(2) provides a mechanism for States to “opt out” of using in-state locate sources in response to a non-IV-D request if such use is “prohibited by State law or written policy.” Yet § 302.35(e) states “the State PLS shall disclose * * * information from in-state locate sources as required by this section and described in § 303.3(b)(1).” This latter language suggests that expanded access is required regardless of State law or written policy, which is contrary to the intent expressed in the preamble to the proposed rule, as well as the intent of the statute.

Response:We agree. We have revised the language to provide in-state searches in accordance with State law.

15. Comment:One commenter requests that the following terms be eliminated in the final rule: Non-IV-D individual(s); non-IV-D case(s); non-IV-D request(s) and be replaced with “non-IV-D purpose” and another commenter asked that the Office provide a definition of non-IV-D purpose.

Response:Reference to all four terms is appropriate each time a specific term is used in the regulation. Non-IV-D purpose is addressed in paragraph (d): the State PLS shall obtain location information under this section only for the purposes specified in paragraphs (d)(1) and (d)(2) of § 302.35. Section 453 of the Act provides statutory authority for using the Federal PLS for the purpose of locating any individual who has or may have parental rights with respect to a child, enforcing any State or Federal law with respect to the unlawful taking or restraint of a child; or making or enforcing a child custody or visitation determination.

16. Comment:One commenter seeks confirmation that taken together, these sections mean that once a State establishes policy to define State PLS sources of information, any other data contained in the State's computerized support enforcement system may not be released under this section, regardless of the source of that information.

Response:The State's computerized support enforcement system is not a source of information for the State PLS. Access to any data on the statewide automated system is limited in sections 454A(d) and (f) of the Act and 45 CFR part 307. Independently verified information may be released to those authorized to access and use the information. For example, if a State determines that an address is correct through a postal verification the State can share the information it acquired from the second source (the Post Office).

17. Comment:One commenter strongly suggests that this proposed regulation be modified to make it clear that it is the Federal OCSE's responsibility to exclude IRS information, or MSFIDM information when in receipt of a non-IV-D request for FPLS information.

Response:If the State codes its requests correctly, (e.g., pk, ad, etc.), OCSE only returns appropriate information for that request. Please see the FCR Interface Guidance Document (Chart 6-14)http://www.acf.hhs.gov/programs/cse/newhire/library/fcr/fcr.htm. However, the State may have such information in its files and the State bears the responsibility to assure that only authorized information is released in response to a request.

18. Comment:One commenter strongly suggests that there be a simple system set up for OCSE to receive formal requests from States (preferably online with a predefined outgoing and incoming data format) that would ensure that all requests to the Federal PLS are properly documented and the authorized information would be returned in a pre-defined format suitable to direct redisclosure to authorized requestors. The States' only duty would be to submit and return requests for information on behalf of non-IV-D authorized requestors. This would greatly enhance the security and confidentiality of this Federal requirement.

Response:The FCR Interface Guidance Document, mentioned above, provides this service. For example, a Foster Care case locate-only code provides only authorized information but a request with a IV-D code provides much more data because the request is on a IV-D case.

19. Comment:One commenter believes a better approach for this section would be for those individuals who desire child support services under the title IV-D program, including location services, to apply for services.

Response:The Federal statute at sections 453 and 454(8) of the Act require States to disclose certain information to authorized non-IV-D persons for authorized purposes. Such purposes includes access for locate purposes. There is no requirement that individuals apply for IV-D services to receive requested information.

20. Comment:One State does not support requiring the State PLS to release information gathered from in-state sources to non-IV-D individuals unless there is a State law or policy prohibiting such a release as provided in § 302.35(a)(2)(i) and believes this requirement exceeds the authority granted in 42 U.S.C. 653(a)(2) which pertains only to Federal PLS information. Instead, the State favors a provision that authorizes the State PLS to release in-state source information only if permitted under State law or regulation.

Response:We accept the commenter's position and have revised the regulation accordingly.

21. Comment:Two commenters would like recognized that the preamble claims States have interpreted current law “to permit use of State resources for non-IV-D location purposes, including location for custody and visitation purposes” and notes that while a handful of States may permit broad access to State databases by private entities, these practices are not widespread and are not based on a common or settled interpretation of Federal law. Because some States have chosen to disclose State PLS and Federal PLS information to non-IV-D requestors should not be the basis of requiring all States to do so.

Response:See response to comment 20.

22. Comment:A commenter says that if a State wishes to disclose State PLS data, it should have to have a written law or policy describing what it will disclose, to whom it will disclose it, and under what circumstances. In the absence of such a policy, State PLS data should not be disclosed to non-IV-D entities.

Response:It is up to the State to set standards for disclosure.

23. Comment:One commenter believes the final regulation should acknowledge that there may be other State laws governing the disclosure of personal data to nongovernmental entities if any mention of State duty to provide State PLS data is retained.

Response:We believe the revised language “in accordance with State law” takes this into account.

24. Comment:One commenter would like clarification on the reason for the restriction that prevents the State PLS from searching the statewide computer system or providing a non-IV-D requestor with any information contained in the system. The commenter asks for the rationale behind this restriction and an explanation on how OCSE envisions compliance by States whose non-IV-D cases are part of their statewide computer system.

Response:Access to information in the IV-D automated system is strictly limited by Federal statute. Section 454A of the Act restricts disclosure of information in a State IV-D automated system to purposes related to the administration of the IV-D program so non-IV-D requestors cannot get such information.

25. Comment:One commenter says that the language referring to the support enforcement computer system (along with Appendix A) can be read to prohibit the release of information contained in the system even where that information was derived from non-IRS or non-MSFIDM sources and asks whether this was the intent.

Response:Yes, this is the intent. The Federal statute at sections 454A(d) and (f) clearly restricts access to and disclosure of State automated child support system data.

26. Comment:One commenter requests further explanation or clarification regarding the prohibition against releasing information from automated support enforcement systems to fulfill non-IV-D requests. Clarification is needed because any information received in the course of IV-D program business is typicallyregistered in such system; therefore, exactly what may be legally disclosed under § 302.35(a)(2)(ii) is unclear.

Response:Section 454A of the Act does not authorize access to State systems for non-IV-D purposes. Therefore, a State may only seek or locate information in a non-IV-D case directly from the State PLS or from the Federal PLS and disclose that data to a non-IV-D requestor. (Also see # 27. below.)

27. Comment:One commenter seeks clarification that the idea of § 302.35(a)(2)(ii) is that if a State receives a non-IV-D request, it may not look to any information “existing” on its system but rather must conduct State PLS and Federal PLS searches for information and only the information resulting from those searches could be released, as authorized.

Response:Yes, if a State receives a non-IV-D request, it may not look to any information “existing” in its system but rather must conduct State PLS and Federal PLS searches for information and only the information resulting from those searches can be released.

28. Comment:One commenter notes that § 302.35(c)(3) indicates that the State PLS may use some sources of data for non-IV-D location requests. However, it is noted in other parts that the State PLS shall not release information from the computerized support enforcement system. Many of the location sources the State agency uses feed into, and become part of, the computerized support enforcement system. Is the regulation forbidding the use of the CSE system to access otherwise permissible State sources of information?

Response:The regulation prohibits release of information residing on the State's computerized support enforcement system, unless explicitly authorized. States may only share information on their automated system with authorized entities under 45 CFR Part 307. The State PLS may use the automated system to seek information from other sources as part of its location efforts in IV-D cases.

29. Comment:One commenter proposes new language for § 302.35(a)(2)(ii) “* * * IRS information or financial institution data match information relating to a financial account * * *” Incorporating this language would allow other information (such as address information) from MSFIDM to be released pursuant to a non-IV-D request.

Response:We are not incorporating the proposed change because of the need to safeguard all data received from a financial institution data match.

30. Comment:One commenter wants IV-B/IV-E agencies to be able to view limited, address-related data from other States' IRS and financial institutions if such information could assist in locating the parent or person who could be a child's parent and is otherwise not available in any other system.

Response:There is no authority under title IV-D of the Act or the Internal Revenue Service Code to allow this.

31. Comment:One commenter disagrees with prohibiting the State PLS in non-IV-D requests from disclosing information from the computerized support system because 42 U.S.C. 654(8) mandates that States use “all sources of information and available records” to locate parents regardless of whether they are involved in a IV-D case. The State could not defend such a policy to its judges and asks why such a prohibition in this rule i