2022-19851. Privacy Act of 1974; System of Records

AGENCY:

Administration for Children & Families, Department of Health and Human Services.

ACTION:

Notice of a modified system of records.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS) is modifying an existing system of records maintained by the Administration for Children & Families (ACF), Office of Child Support Enforcement (OCSE): System No. 09-80-0385, “OCSE Federal Case Registry of Child Support Orders, HHS/ACF/OCSE.” Elsewhere in this issue of the Federal Register , HHS/ACF has published a Notice of Proposed Rulemaking (NPRM) proposing to exempt certain records in the system of records from the accounting, access, and amendment requirements of the Privacy Act.

DATES:

Comment on this modified System of Records Notice (SORN) should be submitted on or before November 14, 2022.

ADDRESSES:

The public should address written comments by mail or email to: Anita Alford, Senior Official for Privacy, Administration for Children & Families, 330 C St. SW, Washington, DC 20201, or [e-mail].

FOR FURTHER INFORMATION CONTACT:

General questions about these systems of records should be submitted by mail or email to Linda Boyer, Deputy Commissioner, Office of Child Support Enforcement, at 330 C St. SW, 5th Floor, Washington, DC 20201, or [e-mail].

SUPPLEMENTARY INFORMATION:

I. Explanation of Changes to System of Records 09-80-0385

This system of records covers records about individuals involved in child support cases as provided by state child support registries. This information is regularly compared (matched) to records in the National Directory of New Hires and other federal agencies' databases to assist state child support agencies or other authorized persons in enforcing child support obligations. The following modifications have been made:

• Address information in the System Location and System Manager sections has been updated.
• The Authorities section has been updated to include 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2).
• The Routine Uses section has been updated as follows:

○ The opening paragraph, and routine uses 11 and 13, have been revised to remove an unnecessary statement that disclosures must be compatible with the purpose for which the records were collected (the statement is redundant, because this is how a routine use is defined in 5 U.S.C. 552a(a)(7)).

○ Routine use 10 has been revised to include foreign treaty countries as disclosure recipients, pursuant to 42 U.S.C. 652(n) and 653(c)(5).

○ Routine use 12 has been revised to require that the constituent request, which is the subject of the disclosure, must be a “written” request.

○ The security breach-related routine use which was previously numbered as routine use 15, and which was revised February 14, 2018 (see 83 FR 6591), is now numbered as routine use 15(a); and a second security breach-related routine use which was added in that same notice on February 14, 2018, is now numbered as routine use 15(b).

• The Disclosure to Consumer Reporting Agencies section has been removed (it merely confirmed that such disclosures are not made from this system of records).
• The Policies and Practices for Retention and Disposal of Records section has been updated to identify the applicable NARA-approved disposition schedule, N-1-292-10-3.
• The Administrative, Technical, and Physical Safeguards section has been updated to include information about the use of cloud service providers.
• The procedures for making access, amendment, and notification requests now state that verification of identity “is” (instead of “may be”) required; explain how to provide verification of identity (instead of merely referring individuals to HHS' Privacy Act regulations); and list date of birth and social security number (SSN) as examples of identifying particulars to include for the purpose of distinguishing between records on individuals with the same name.
• The Exemptions Promulgated for the System section has been clarified and corrected to state that the agency is promulgating a regulation to exempt case files marked with the Family Violence Indicator (FVI) from the Privacy Act's accounting, access, and amendment requirements, under subsection “(k)(2)” (not (k)(5)) of the Privacy Act. The section now explains that the exemption, as to case files marked with the FVI, is intended to be consistent with the disclosure prohibition in 42 U.S.C. 653(b)(2), which prohibits disclosure of such records to anyone other than a court or an agent of the court (instead of stating that such files are “de facto exempt” from the Privacy Act's notification, access, and accounting requirements by virtue of that statute). The section also now also includes a reference to 45 CFR 303.21(e), which implements the statutory prohibition in 42 U.S.C. 653(b)(2).

The modified SORN will be applicable when the proposed exemptions are made effective by publication of a final rule, which will not occur until after the 60-day comment period ends and any comments received on the NPRM (or on this SORN) have been addressed. If no comments result in changes to the SORN, the SORN will not be published a second time.

January Contreras,

Assistant Secretary, Administration for Children & Families.

SYSTEM NAME AND NUMBER:

OCSE Federal Case Registry of Child Support Orders (FCR), HHS/ACF/OCSE, 09-80-0385.

SECURITY CLASSIFICATION:

Unclassified

SYSTEM LOCATION:

Office of Child Support Enforcement, Administration for Children & Families, 330 C St. SW, 5th Floor, Washington, DC 20201.

SYSTEM MANAGER(S):

Deputy Commissioner, Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services, 330 C St. SW, 5th Floor, Washington, DC 20201, or [e-mail].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

42 U.S.C. 652(a)(7) and (9), 652(n), 653(a)(1) and (2), 653(c)(5), 653(h), 653(j)(3), and 659a(c)(2).

PURPOSE(S) OF THE SYSTEM:

The Office of Child Support Enforcement (OCSE) uses the FCR primarily to assist states in administering programs under 42 U.S.C. 651 to 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and programs funded under 42 U.S.C. 601 to 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families). Additional purposes are specified in sections 453 and 463 of the Social Security Act. (42 U.S.C. 653, 663).

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals involved in child support cases in which services are being provided by the state IV-D child support agencies, and/or individuals who are subject to child support orders established or modified on or after October 1, 1998, and the children of such individuals. Individuals whose information is collected and/or disseminated through the system, as part of authorized technical assistance or matching, including but not limited to individuals involved in a child and family services' program provided by the state IV-B agency, and individuals involved in a state IV-E foster care and adoption assistance program and programs administered by other authorized agencies and entities specified in the routine uses of records maintained in this system.

CATEGORIES OF RECORDS IN THE SYSTEM:

The FCR maintains, collects, and disseminates several categories of records. The FCR collects and maintains records provided by state child support registries. These records include abstracts of support orders and information from child support cases.

The records may include the following information: Name, Social Security number (SSN), state case identification number, state Federal Information Processing Standard (FIPS) code, county code, case type (cases in which services are being provided by the state child support agencies under Title IV-D of the Social Security Act and those cases in which services are not being provided by the state child support agencies), sex, date of birth, mother's maiden name, father's name, participant type (custodial party, non- custodial parent, putative father, child), family violence indicator (domestic violence or child abuse), order indicator, locate request type, and requested locate source. These records are maintained within the FCR and are regularly compared (matched) to the National Directory of New Hires (NDNH) and other federal agencies' databases to locate information for the state child support agencies or other authorized persons.

State child support agencies and other authorized persons can directly request information (referred to as locate requests) from the Federal Parent Locator Service (FPLS), which includes the FCR system of records, and the NDNH system of records. The FPLS must seek the requested information from other federal agencies. When state child support agencies or other authorized persons request information from the FPLS, the request is transmitted to the FPLS via the FCR. Upon receipt of such requests, or as a result of the regular comparisons of the FCR with the NDNH and other agencies' databases, the records located pertaining to the requests are disseminated to the requestor via the FCR. The records collected and disseminated, depending upon the requestor's specific authority, may include information retrieved from the FCR, from the NDNH, or from other federal or state agencies. Records from the NDNH and other agencies disseminated through the FCR may include categories of information such as name, SSN (or TIN), address, phone number, employer, employment status and wages, retirement status and pay, assets, military status and pay, federal benefits status and amount, representative payees, unemployment status and amount, children's health insurance, incarceration status, financial institution accounts, assets, and date of death. The FCR also contains information related to those categories of records; for example, the date of receipt of federal benefits.

Additional categories of information include those contained in the following documents: judicial or administrative orders pertaining to child support and medical support; an administrative subpoena; an affidavit in support of establishing paternity; a financial statement; a medical support notice; a notice of a lien; and an income withholding notice. The FCR also maintains: (1) Records (logs) of transactions involving the receipt of requests and the dissemination of requested information; (2) copies of the disseminated information for audit purposes; and (3) copies of certain disseminated information for the purpose of electronically filtering and suppressing the transmission of redundant information.

RECORD SOURCE CATEGORIES:

Records maintained within the FCR are furnished by state child support enforcement agencies. Records disseminated from the FCR for the purpose of providing locate information from the NDNH and other federal agencies are furnished by departments, agencies, or instrumentalities of the United States or any state, employers, financial institutions, and insurers or their agents.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES:

These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible. If any record contains a “family violence indicator” associated to the record by state child support agencies, if there is reasonable evidence of domestic violence or child abuse and disclosure could be harmful to the party or the child, the record may only be disclosed as determined by a court as provided in 42 U.S.C. 653(b)(2).

Any information defined as “return” or “return information” under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations.

(1) Disclosure for Child Support Purposes.

Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653(c), information about the location of an individual or information that would facilitate the discovery of the location of an individual may be disclosed, upon request filed in accordance with law, to an “authorized person,” as defined in 42 U.S.C. 653(c), for the purpose of establishing parentage or establishing, setting the amount of, modifying or enforcing child support obligations. Information disclosed may include information about an individual's wages (or other income) from, and benefits of, employment, and information on the type, status, location, and amount of any assets of, or debts owed by or to, the individual.

(2) Disclosure to any Department, Agency, or Instrumentality of the United States or of any State to Locate an Individual or Information Pertaining to an Individual.

Pursuant to 42 U.S.C. 653(e)(1), information from the FCR (names and SSNs) may be disclosed to any department, agency, or instrumentality of the United States or of any state in order to obtain information for an “authorized person” as defined in 42 U.S.C. 653(c) which pertains to an individual's location, wages (or other income) from, and benefits of, employment (including rights to or enrollment in group health care coverage); or the type, status, location, and amount of any assets of, or debts owed by or to, the individual.

(3) Disclosure for Purposes Related to the Unlawful Taking or Restraint of a Child or Child Custody or Visitation.

Pursuant to 42 U.S.C. 653(b)(1)(A), upon request of an “authorized person,” as defined in 42 U.S.C. 663(d)(2), or upon request of the Department of Justice, Office of Juvenile Justice and Delinquency Prevention, pursuant to 42 U.S.C. 663(f), information as to the most recent address and place of employment of a parent or child may be disclosed for the purpose of enforcing any state or federal law with respect to the unlawful taking or restraint of a child or making or enforcing a child custody or visitation determination.

(4) Disclosure to the Social Security Administration for Verification.

Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates of individuals about who information is maintained may be disclosed to the Social Security Administration to the extent necessary for verification of the information by the Social Security Administration.

(5) Disclosure for Locating an Individual for Paternity Establishment or in Connection with a Support Order.

Pursuant to 42 U.S.C. 653(j)(2)(B), the results of a comparison between records in this system and the NDNH may be disclosed to the state IV-D child support enforcement agency responsible for the case for the purpose of locating an individual in a paternity establishment case or a case involving the establishment, modification, or enforcement of a support order.

(6) Disclosure to State Agencies Operating Specified Programs.

Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a state to the extent and with the frequency that the Secretary determines to be effective in assisting the state to carry out its responsibilities under child support programs operated under 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity), child and family services programs operated under 42 U.S.C. 621 through 629m (Title IV-B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679c (Title IV-E of the Social Security Act) and assistance programs funded under 42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families).

(7) Disclosure to Department of State under International Child Abduction Remedies Act.

Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address and place of employment of a parent or child may be disclosed upon request to the Department of State, in its capacity as the Central Authority designated in accordance with section 7 of the International Child Abduction Remedies Act, 42 U.S.C. 11601 et seq., for the purpose of locating the parent or child on behalf of an applicant.

(8) Disclosure to Secretary of the Treasury for Certain Tax Purposes.

Pursuant to 42 U.S.C. 653(h)(3), information may be disclosed to the Secretary of Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children.

(9) Disclosure for Authorized Research Purposes.

Pursuant to 42 U.S.C. 653(j)(5), data in the FCR may be disclosed, without personal identifiers, for research purposes found by the Secretary to be likely to contribute to achieving the purposes of 42 U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child Support and Establishment of Paternity) and 42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, Temporary Assistance for Needy Families).

(10) Disclosure to a Foreign Reciprocating Country and Foreign Treaty Country for Child Support Purposes.

Pursuant to 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2), information on the state of residence of an individual sought for support enforcement purposes in cases involving residents of the United States and residents of foreign treaty countries or foreign countries that are the subject of a declaration under 42 U.S.C. 659a may be disclosed to the foreign country.

(11) Disclosure for Law Enforcement Purpose.

Information may be disclosed to the appropriate federal, state, local, Tribal, or foreign agency responsible for identifying, investigating, and prosecuting noncustodial parents who knowingly fail to pay their support obligations and meet the criteria for federal prosecution under 18 U.S.C. 228. The information must be relevant to the violation of criminal nonsupport, as stated in the Deadbeat Parents Punishment Act, 18 U.S.C. 228.

(12) Disclosure to Congressional Office.

Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual.

(13) Disclosure to Department of Justice or in Proceedings.

Information may be disclosed to support the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when:

• HHS, or any component thereof; or
• Any employee of HHS in his or her official capacity; or
• Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or
• The United States, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the court or adjudicative body is deemed by HHS to be relevant and necessary to the litigation.

(14) Disclosure to Contractor to Perform Duties.

Information may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract.

(15) Disclosure in the Event of a Security Breach.

(a) Information may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(b) Information may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored electronically at the Social Security Administration's National Support Center and the OCSE Data Center. Historical logs and system backups are stored offsite at an alternate location.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by an identification number assigned to a child support case by the state child support enforcement agency, an SSN or TIN of an individual, a transaction serial number, or by a name and date of birth of an individual.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

FCR records are retained and disposed of in accordance with the applicable NARA-approved disposition schedule, N1-292-10-3.

(1) Records provided from state child support agencies:

(a) Electronic records furnished by the state child support agency containing child support case and order information (input files) are retained for 60 days and then deleted.

(b) State agency records (as posted to the FCR) remain within the FCR until removed, upon notification by the state agency that the case is closed, provided that, upon request, a sample may be retained for research purposes found by OCSE to be likely to contribute to achieving the purposes of child support programs or the TANF program, but without personal identifiers.

(c) Records pertaining to closed cases are archived on the fiscal year basis and retained for two years. Family violence indicators are removed from the individual's record, upon request by the state that initiated the indicator.

(2) Locate requests and match results:

(a) Locate requests submitted by state child support agencies and other authorized persons and match results are retained for 60 days and are then deleted.

(b) Audit trail records of locate requests and disclosures of match results pursuant to those requests, which include indications of which federal agencies were contacted for locate information, whether information was located, and the type(s) of information returned to the requesting entity, are archived once a year based on the fiscal year. The records are retained for two completed fiscal years and then destroyed. These records indicate the type of information located for the authorized user, not the information itself.

(3) Match results generated as a result of FCR-to-FCR comparisons which locate individuals who are participants in child support cases or orders in more than one state are transmitted to the relevant states. Copies of FCR-to-FCR match results are retained for 60 days and then deleted.

(4) Any record relating or potentially relating to a fraud or abuse investigation or a pending or ongoing legal action, including a class action, is retained until conclusion of the investigation or legal action.

(5) Copies of the FCR records transmitted to the Secretary of the Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children (routine use 8) are retained for one year and then deleted.

(6) Records collected or disseminated for technical assistance to child support agencies or other authorized agencies or entities are retained for 60 days to five years, and audit data is retained for a period of up to two years.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The system leverages cloud service providers that maintain an authority to operate in accordance with applicable laws, rules, and policies, including Federal Risk and Authorization Management Program (FedRAMP) requirements. Specific administrative, technical, and physical controls are in place to ensure that the records collected and maintained in the FCR are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter. Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. All records are stored in an area that is physically safe from access by unauthorized persons at all times.

Safeguards conform to the HHS Information Security and Privacy Program, which may be found at https://www.hhs.gov/​ocio/​securityprivacy/​index.html.

RECORD ACCESS PROCEDURES:

To request access to a record about you, submit a written request to the System Manager, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request should include your name, telephone number and/or email address, current address, and signature, and sufficient particulars (such as, date of birth or SSN) to enable the System Manager to distinguish between records on subject individuals with the same name. To verify your identity, your signature must be notarized or your request must include your signed, written certification that you are the individual who you claim to be and that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000.

CONTESTING RECORD PROCEDURES:

To request correction of a record about you in this system of records, submit a written amendment request to the System Manager, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request must contain the same information required for an access request and include verification of your identity in the same manner required for an access request. In addition, the request must reasonably identify the record and specify the information contested; the corrective action sought; and the reasons for requesting the correction; and should include supporting justification or documentation to show how the record is inaccurate, incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:

To find out if this system of records contains a record about you, submit a written notification request to the System Manager, in accordance with the Department's Privacy Act implementation regulations in 45 CFR. The request must identify this system of records, contain the same information required for an access request, and include verification of your identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

A notice of proposed rulemaking has been published to add this system of records to the list of exempt systems of records in HHS regulations implementing the Privacy Act (45 CFR 5b, at 5b.11), and that exemption will be effective upon publication of a Final Rule. The Final Rule will, pursuant to 5 U.S.C. 552a(k)(2), exempt case files marked with the Family Violence Indicator (FVI), which constitute investigatory material compiled for law enforcement purposes, from the accounting, access, and amendment requirements in subsections (c)(3) and (d)(1) through (4) of the Privacy Act (5 U.S.C. 552a(c)(3) and (d)(1) through (4)), subject to the limitation set forth in subsection (k)(2).

With respect to case files marked “FVI,” the exemption is intended to be consistent with the disclosure prohibition in section 453(b)(2) of the Social Security Act (42 U.S.C. 653(b)(2)) which prohibits disclosure of case records containing reasonable evidence of domestic violence or child abuse, disclosure of which could be harmful to the custodial parent or the child of such parent, to anyone other than a court or an agent of the court. See also 45 CFR 303.21(e) (describing safeguarding requirements for records marked with the FVI).

HISTORY:

80 FR 17912 (Apr. 2, 2015), updated 83 FR 6591 (Feb. 14, 2018).