Privacy Act of 1974; System of Records, 56055-56059 [2022-19851]

Download as PDF Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices Services (CMS), Jonathan Blum, having reviewed and approved this document, authorizes Evell Barco Holland, who is the Federal Register Liaison, to electronically sign this document for purposes of publication in the Federal Register. Evell Barco Holland, Federal Register Liaison, Centers for Medicare & Medicaid Services. [FR Doc. 2022–19716 Filed 9–12–22; 8:45 am] BILLING CODE 4120–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Administration for Children and Families Proposed Information Collection Activity; Annual Report on State Maintenance-of-Effort (MOE) Programs—ACF–204 (Annual MOE Report) (Office of Management and Budget #: 0970–0248) Office of Family Assistance, Administration for Children and AGENCY: Families, U.S. Department of Health and Human Services. ACTION: Request for public comments. The Administration for Children and Families (ACF) is requesting a 3-year extension of the ACF–204 (Annual MOE Report; OMB #0970–0248, expiration November 30, 2022). There are no changes requested to this information collection. DATES: Comments due within 60 days of publication. In compliance with the requirements of the Paperwork Reduction Act of 1995, ACF is soliciting public comment on the specific aspects of the information collection described above. ADDRESSES: You can obtain copies of the proposed collection of information and submit comments by emailing infocollection@acf.hhs.gov. Identify all requests by the title of the information collection. SUPPLEMENTARY INFORMATION: Description: The Annual MOE Report is used to collect descriptive program characteristics information on the programs operated by states and territories in association with their SUMMARY: 56055 Temporary Assistance for Needy Families (TANF) programs. All state and territory expenditures claimed toward states and territories MOE requirements must be appropriate, i.e., meet all applicable MOE requirements. The Annual MOE Report provides the ability to learn about and to monitor the nature of state and territory expenditures used to meet states and territories MOE requirements, and it is an important source of information about the different ways that states and territories are using their resources to help families attain and maintain self-sufficiency. In addition, the report is used to obtain state and territory program characteristics for ACFs annual report to Congress, and the report serves as a useful resource to use in Congressional hearings about how TANF programs are evolving, in assessing state and the territory MOE expenditures, and in assessing the need for legislative changes. Respondents: The 50 States of the United States, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands. jspears on DSK121TN23PROD with NOTICES ANNUAL BURDEN ESTIMATES Instrument Total number of respondents per year Total number of annual responses per respondent Average burden hours per response Annual burden hours ACF–204; Annual MOE Report ....................................................................... 54 1 118 6,372 Estimated Total Annual Burden Hours: 6,372. Comments: The Department specifically requests comments on (a) whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (b) the accuracy of the agency’s estimate of the burden of the proposed collection of information; (c) the quality, utility, and clarity of the information to be collected; and (d) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or other forms of information technology. Consideration will be given to comments and suggestions submitted within 60 days of this publication. Authority: Section 402 of the Social Security Act (42 U.S.C. 602), as amended by Public Law 104–193, the VerDate Sep<11>2014 18:56 Sep 12, 2022 Jkt 256001 Personal Responsibility and Work Opportunity Reconciliation Act of 1996. Mary B. Jones, ACF/OPRE Certifying Officer. [FR Doc. 2022–19774 Filed 9–12–22; 8:45 am] BILLING CODE 4184–82–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Administration for Children & Families Privacy Act of 1974; System of Records Administration for Children & Families, Department of Health and Human Services. ACTION: Notice of a modified system of records. AGENCY: In accordance with the requirements of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS) is modifying an existing system of records maintained by the Administration for SUMMARY: PO 00000 Frm 00068 Fmt 4703 Sfmt 4703 Children & Families (ACF), Office of Child Support Enforcement (OCSE): System No. 09–80–0385, ‘‘OCSE Federal Case Registry of Child Support Orders, HHS/ACF/OCSE.’’ Elsewhere in this issue of the Federal Register, HHS/ACF has published a Notice of Proposed Rulemaking (NPRM) proposing to exempt certain records in the system of records from the accounting, access, and amendment requirements of the Privacy Act. DATES: Comment on this modified System of Records Notice (SORN) should be submitted on or before November 14, 2022. ADDRESSES: The public should address written comments by mail or email to: Anita Alford, Senior Official for Privacy, Administration for Children & Families, 330 C St. SW, Washington, DC 20201, or anita.alford@acf.hhs.gov. FOR FURTHER INFORMATION CONTACT: General questions about these systems of records should be submitted by mail or email to Linda Boyer, Deputy Commissioner, Office of Child Support E:\FR\FM\13SEN1.SGM 13SEN1 56056 Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices jspears on DSK121TN23PROD with NOTICES Enforcement, at 330 C St. SW, 5th Floor, Washington, DC 20201, or linda.boyer@ acf.hhs.gov. SUPPLEMENTARY INFORMATION: I. Explanation of Changes to System of Records 09–80–0385 This system of records covers records about individuals involved in child support cases as provided by state child support registries. This information is regularly compared (matched) to records in the National Directory of New Hires and other federal agencies’ databases to assist state child support agencies or other authorized persons in enforcing child support obligations. The following modifications have been made: • Address information in the System Location and System Manager sections has been updated. • The Authorities section has been updated to include 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2). • The Routine Uses section has been updated as follows: Æ The opening paragraph, and routine uses 11 and 13, have been revised to remove an unnecessary statement that disclosures must be compatible with the purpose for which the records were collected (the statement is redundant, because this is how a routine use is defined in 5 U.S.C. 552a(a)(7)). Æ Routine use 10 has been revised to include foreign treaty countries as disclosure recipients, pursuant to 42 U.S.C. 652(n) and 653(c)(5). Æ Routine use 12 has been revised to require that the constituent request, which is the subject of the disclosure, must be a ‘‘written’’ request. Æ The security breach-related routine use which was previously numbered as routine use 15, and which was revised February 14, 2018 (see 83 FR 6591), is now numbered as routine use 15(a); and a second security breach-related routine use which was added in that same notice on February 14, 2018, is now numbered as routine use 15(b). • The Disclosure to Consumer Reporting Agencies section has been removed (it merely confirmed that such disclosures are not made from this system of records). • The Policies and Practices for Retention and Disposal of Records section has been updated to identify the applicable NARA-approved disposition schedule, N–1–292–10–3. • The Administrative, Technical, and Physical Safeguards section has been updated to include information about the use of cloud service providers. • The procedures for making access, amendment, and notification requests now state that verification of identity ‘‘is’’ (instead of ‘‘may be’’) required; VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 explain how to provide verification of identity (instead of merely referring individuals to HHS’ Privacy Act regulations); and list date of birth and social security number (SSN) as examples of identifying particulars to include for the purpose of distinguishing between records on individuals with the same name. • The Exemptions Promulgated for the System section has been clarified and corrected to state that the agency is promulgating a regulation to exempt case files marked with the Family Violence Indicator (FVI) from the Privacy Act’s accounting, access, and amendment requirements, under subsection ‘‘(k)(2)’’ (not (k)(5)) of the Privacy Act. The section now explains that the exemption, as to case files marked with the FVI, is intended to be consistent with the disclosure prohibition in 42 U.S.C. 653(b)(2), which prohibits disclosure of such records to anyone other than a court or an agent of the court (instead of stating that such files are ‘‘de facto exempt’’ from the Privacy Act’s notification, access, and accounting requirements by virtue of that statute). The section also now also includes a reference to 45 CFR 303.21(e), which implements the statutory prohibition in 42 U.S.C. 653(b)(2). The modified SORN will be applicable when the proposed exemptions are made effective by publication of a final rule, which will not occur until after the 60-day comment period ends and any comments received on the NPRM (or on this SORN) have been addressed. If no comments result in changes to the SORN, the SORN will not be published a second time. January Contreras, Assistant Secretary, Administration for Children & Families. SYSTEM NAME AND NUMBER: OCSE Federal Case Registry of Child Support Orders (FCR), HHS/ACF/OCSE, 09–80–0385. SECURITY CLASSIFICATION: Unclassified SYSTEM LOCATION: Office of Child Support Enforcement, Administration for Children & Families, 330 C St. SW, 5th Floor, Washington, DC 20201. SYSTEM MANAGER(S): Deputy Commissioner, Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services, 330 C St. PO 00000 Frm 00069 Fmt 4703 Sfmt 4703 SW, 5th Floor, Washington, DC 20201, or linda.boyer@acf.hhs.gov. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 42 U.S.C. 652(a)(7) and (9), 652(n), 653(a)(1) and (2), 653(c)(5), 653(h), 653(j)(3), and 659a(c)(2). PURPOSE(S) OF THE SYSTEM: The Office of Child Support Enforcement (OCSE) uses the FCR primarily to assist states in administering programs under 42 U.S.C. 651 to 669b (Title IV–D of the Social Security Act, Child Support and Establishment of Paternity) and programs funded under 42 U.S.C. 601 to 619 (Title IV–A of the Social Security Act, Temporary Assistance for Needy Families). Additional purposes are specified in sections 453 and 463 of the Social Security Act. (42 U.S.C. 653, 663). CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: Individuals involved in child support cases in which services are being provided by the state IV–D child support agencies, and/or individuals who are subject to child support orders established or modified on or after October 1, 1998, and the children of such individuals. Individuals whose information is collected and/or disseminated through the system, as part of authorized technical assistance or matching, including but not limited to individuals involved in a child and family services’ program provided by the state IV–B agency, and individuals involved in a state IV–E foster care and adoption assistance program and programs administered by other authorized agencies and entities specified in the routine uses of records maintained in this system. CATEGORIES OF RECORDS IN THE SYSTEM: The FCR maintains, collects, and disseminates several categories of records. The FCR collects and maintains records provided by state child support registries. These records include abstracts of support orders and information from child support cases. The records may include the following information: Name, Social Security number (SSN), state case identification number, state Federal Information Processing Standard (FIPS) code, county code, case type (cases in which services are being provided by the state child support agencies under Title IV–D of the Social Security Act and those cases in which services are not being provided by the state child support agencies), sex, date of birth, mother’s maiden name, father’s name, participant type (custodial party, non- E:\FR\FM\13SEN1.SGM 13SEN1 jspears on DSK121TN23PROD with NOTICES Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices custodial parent, putative father, child), family violence indicator (domestic violence or child abuse), order indicator, locate request type, and requested locate source. These records are maintained within the FCR and are regularly compared (matched) to the National Directory of New Hires (NDNH) and other federal agencies’ databases to locate information for the state child support agencies or other authorized persons. State child support agencies and other authorized persons can directly request information (referred to as locate requests) from the Federal Parent Locator Service (FPLS), which includes the FCR system of records, and the NDNH system of records. The FPLS must seek the requested information from other federal agencies. When state child support agencies or other authorized persons request information from the FPLS, the request is transmitted to the FPLS via the FCR. Upon receipt of such requests, or as a result of the regular comparisons of the FCR with the NDNH and other agencies’ databases, the records located pertaining to the requests are disseminated to the requestor via the FCR. The records collected and disseminated, depending upon the requestor’s specific authority, may include information retrieved from the FCR, from the NDNH, or from other federal or state agencies. Records from the NDNH and other agencies disseminated through the FCR may include categories of information such as name, SSN (or TIN), address, phone number, employer, employment status and wages, retirement status and pay, assets, military status and pay, federal benefits status and amount, representative payees, unemployment status and amount, children’s health insurance, incarceration status, financial institution accounts, assets, and date of death. The FCR also contains information related to those categories of records; for example, the date of receipt of federal benefits. Additional categories of information include those contained in the following documents: judicial or administrative orders pertaining to child support and medical support; an administrative subpoena; an affidavit in support of establishing paternity; a financial statement; a medical support notice; a notice of a lien; and an income withholding notice. The FCR also maintains: (1) Records (logs) of transactions involving the receipt of requests and the dissemination of requested information; (2) copies of the disseminated information for audit purposes; and (3) copies of certain disseminated information for the VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 purpose of electronically filtering and suppressing the transmission of redundant information. RECORD SOURCE CATEGORIES: Records maintained within the FCR are furnished by state child support enforcement agencies. Records disseminated from the FCR for the purpose of providing locate information from the NDNH and other federal agencies are furnished by departments, agencies, or instrumentalities of the United States or any state, employers, financial institutions, and insurers or their agents. ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSE OF SUCH USES: These routine uses specify circumstances under which ACF may disclose information from this system of records without the consent of the data subject. Each proposed disclosure of information under these routine uses will be evaluated to ensure that the disclosure is legally permissible. If any record contains a ‘‘family violence indicator’’ associated to the record by state child support agencies, if there is reasonable evidence of domestic violence or child abuse and disclosure could be harmful to the party or the child, the record may only be disclosed as determined by a court as provided in 42 U.S.C. 653(b)(2). Any information defined as ‘‘return’’ or ‘‘return information’’ under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed unless authorized by a statute, the Internal Revenue Service (IRS) or IRS regulations. (1) Disclosure for Child Support Purposes. Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653(c), information about the location of an individual or information that would facilitate the discovery of the location of an individual may be disclosed, upon request filed in accordance with law, to an ‘‘authorized person,’’ as defined in 42 U.S.C. 653(c), for the purpose of establishing parentage or establishing, setting the amount of, modifying or enforcing child support obligations. Information disclosed may include information about an individual’s wages (or other income) from, and benefits of, employment, and information on the type, status, location, and amount of any assets of, or debts owed by or to, the individual. (2) Disclosure to any Department, Agency, or Instrumentality of the United States or of any State to Locate an Individual or Information Pertaining to an Individual. PO 00000 Frm 00070 Fmt 4703 Sfmt 4703 56057 Pursuant to 42 U.S.C. 653(e)(1), information from the FCR (names and SSNs) may be disclosed to any department, agency, or instrumentality of the United States or of any state in order to obtain information for an ‘‘authorized person’’ as defined in 42 U.S.C. 653(c) which pertains to an individual’s location, wages (or other income) from, and benefits of, employment (including rights to or enrollment in group health care coverage); or the type, status, location, and amount of any assets of, or debts owed by or to, the individual. (3) Disclosure for Purposes Related to the Unlawful Taking or Restraint of a Child or Child Custody or Visitation. Pursuant to 42 U.S.C. 653(b)(1)(A), upon request of an ‘‘authorized person,’’ as defined in 42 U.S.C. 663(d)(2), or upon request of the Department of Justice, Office of Juvenile Justice and Delinquency Prevention, pursuant to 42 U.S.C. 663(f), information as to the most recent address and place of employment of a parent or child may be disclosed for the purpose of enforcing any state or federal law with respect to the unlawful taking or restraint of a child or making or enforcing a child custody or visitation determination. (4) Disclosure to the Social Security Administration for Verification. Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates of individuals about who information is maintained may be disclosed to the Social Security Administration to the extent necessary for verification of the information by the Social Security Administration. (5) Disclosure for Locating an Individual for Paternity Establishment or in Connection with a Support Order. Pursuant to 42 U.S.C. 653(j)(2)(B), the results of a comparison between records in this system and the NDNH may be disclosed to the state IV–D child support enforcement agency responsible for the case for the purpose of locating an individual in a paternity establishment case or a case involving the establishment, modification, or enforcement of a support order. (6) Disclosure to State Agencies Operating Specified Programs. Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a state to the extent and with the frequency that the Secretary determines to be effective in assisting the state to carry out its responsibilities under child support programs operated under 42 U.S.C. 651 through 669b (Title IV–D of the Social Security Act, Child Support and Establishment of Paternity), child and family services programs operated under 42 U.S.C. 621 through 629m E:\FR\FM\13SEN1.SGM 13SEN1 jspears on DSK121TN23PROD with NOTICES 56058 Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices (Title IV–B of the Social Security Act), Foster Care and Adoption Assistance programs operated under 42 U.S.C. 670 through 679c (Title IV–E of the Social Security Act) and assistance programs funded under 42 U.S.C. 601 through 619 (Title IV–A of the Social Security Act, Temporary Assistance for Needy Families). (7) Disclosure to Department of State under International Child Abduction Remedies Act. Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address and place of employment of a parent or child may be disclosed upon request to the Department of State, in its capacity as the Central Authority designated in accordance with section 7 of the International Child Abduction Remedies Act, 42 U.S.C. 11601 et seq., for the purpose of locating the parent or child on behalf of an applicant. (8) Disclosure to Secretary of the Treasury for Certain Tax Purposes. Pursuant to 42 U.S.C. 653(h)(3), information may be disclosed to the Secretary of Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children. (9) Disclosure for Authorized Research Purposes. Pursuant to 42 U.S.C. 653(j)(5), data in the FCR may be disclosed, without personal identifiers, for research purposes found by the Secretary to be likely to contribute to achieving the purposes of 42 U.S.C. 651 through 669b (Title IV–D of the Social Security Act, Child Support and Establishment of Paternity) and 42 U.S.C. 601 through 619 (Title IV–A of the Social Security Act, Temporary Assistance for Needy Families). (10) Disclosure to a Foreign Reciprocating Country and Foreign Treaty Country for Child Support Purposes. Pursuant to 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2), information on the state of residence of an individual sought for support enforcement purposes in cases involving residents of the United States and residents of foreign treaty countries or foreign countries that are the subject of a declaration under 42 U.S.C. 659a may be disclosed to the foreign country. (11) Disclosure for Law Enforcement Purpose. Information may be disclosed to the appropriate federal, state, local, Tribal, or foreign agency responsible for identifying, investigating, and prosecuting noncustodial parents who knowingly fail to pay their support obligations and meet the criteria for VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 federal prosecution under 18 U.S.C. 228. The information must be relevant to the violation of criminal nonsupport, as stated in the Deadbeat Parents Punishment Act, 18 U.S.C. 228. (12) Disclosure to Congressional Office. Information may be disclosed to a congressional office from the record of an individual in response to a written inquiry from the congressional office made at the written request of the individual. (13) Disclosure to Department of Justice or in Proceedings. Information may be disclosed to support the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which HHS is authorized to appear, when: • HHS, or any component thereof; or • Any employee of HHS in his or her official capacity; or • Any employee of HHS in his or her individual capacity where the Department of Justice or HHS has agreed to represent the employee; or • The United States, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the court or adjudicative body is deemed by HHS to be relevant and necessary to the litigation. (14) Disclosure to Contractor to Perform Duties. Information may be disclosed to a contractor performing or working on a contract for HHS and who has a need to have access to the information in the performance of its duties or activities for HHS in accordance with law and with the contract. (15) Disclosure in the Event of a Security Breach. (a) Information may be disclosed to appropriate agencies, entities, and persons when (1) HHS suspects or has confirmed that there has been a breach of the system of records; (2) HHS has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HHS (including its information systems, programs, and operations), the federal government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HHS’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm. (b) Information may be disclosed to another federal agency or federal entity, when HHS determines that information from this system of records is reasonably necessary to assist the PO 00000 Frm 00071 Fmt 4703 Sfmt 4703 recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the federal government, or national security, resulting from a suspected or confirmed breach. POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Records are stored electronically at the Social Security Administration’s National Support Center and the OCSE Data Center. Historical logs and system backups are stored offsite at an alternate location. POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: Records are retrieved by an identification number assigned to a child support case by the state child support enforcement agency, an SSN or TIN of an individual, a transaction serial number, or by a name and date of birth of an individual. POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: FCR records are retained and disposed of in accordance with the applicable NARA-approved disposition schedule, N1–292–10–3. (1) Records provided from state child support agencies: (a) Electronic records furnished by the state child support agency containing child support case and order information (input files) are retained for 60 days and then deleted. (b) State agency records (as posted to the FCR) remain within the FCR until removed, upon notification by the state agency that the case is closed, provided that, upon request, a sample may be retained for research purposes found by OCSE to be likely to contribute to achieving the purposes of child support programs or the TANF program, but without personal identifiers. (c) Records pertaining to closed cases are archived on the fiscal year basis and retained for two years. Family violence indicators are removed from the individual’s record, upon request by the state that initiated the indicator. (2) Locate requests and match results: (a) Locate requests submitted by state child support agencies and other authorized persons and match results are retained for 60 days and are then deleted. (b) Audit trail records of locate requests and disclosures of match results pursuant to those requests, which include indications of which federal agencies were contacted for E:\FR\FM\13SEN1.SGM 13SEN1 Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices locate information, whether information was located, and the type(s) of information returned to the requesting entity, are archived once a year based on the fiscal year. The records are retained for two completed fiscal years and then destroyed. These records indicate the type of information located for the authorized user, not the information itself. (3) Match results generated as a result of FCR-to-FCR comparisons which locate individuals who are participants in child support cases or orders in more than one state are transmitted to the relevant states. Copies of FCR-to-FCR match results are retained for 60 days and then deleted. (4) Any record relating or potentially relating to a fraud or abuse investigation or a pending or ongoing legal action, including a class action, is retained until conclusion of the investigation or legal action. (5) Copies of the FCR records transmitted to the Secretary of the Treasury for the purpose of administering sections of the Internal Revenue Code which grant tax benefits based on support or residence of children (routine use 8) are retained for one year and then deleted. (6) Records collected or disseminated for technical assistance to child support agencies or other authorized agencies or entities are retained for 60 days to five years, and audit data is retained for a period of up to two years. jspears on DSK121TN23PROD with NOTICES ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: The system leverages cloud service providers that maintain an authority to operate in accordance with applicable laws, rules, and policies, including Federal Risk and Authorization Management Program (FedRAMP) requirements. Specific administrative, technical, and physical controls are in place to ensure that the records collected and maintained in the FCR are secure from unauthorized access. Access to the records is restricted to authorized personnel who are advised of the confidentiality of the records and the civil and criminal penalties for misuse and who sign a nondisclosure oath to that effect. Personnel are provided privacy and security training before being granted access to the records and annually thereafter. Logical access controls are in place to limit access to the records to authorized personnel and to prevent browsing. The records are processed and stored in a secure environment. All records are stored in an area that is physically safe from access by unauthorized persons at all times. VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 Safeguards conform to the HHS Information Security and Privacy Program, which may be found at https:// www.hhs.gov/ocio/securityprivacy/ index.html. RECORD ACCESS PROCEDURES: To request access to a record about you, submit a written request to the System Manager, in accordance with the Department’s Privacy Act implementation regulations in 45 CFR. The request should include your name, telephone number and/or email address, current address, and signature, and sufficient particulars (such as, date of birth or SSN) to enable the System Manager to distinguish between records on subject individuals with the same name. To verify your identity, your signature must be notarized or your request must include your signed, written certification that you are the individual who you claim to be and that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a fine of up to $5,000. CONTESTING RECORD PROCEDURES: To request correction of a record about you in this system of records, submit a written amendment request to the System Manager, in accordance with the Department’s Privacy Act implementation regulations in 45 CFR. The request must contain the same information required for an access request and include verification of your identity in the same manner required for an access request. In addition, the request must reasonably identify the record and specify the information contested; the corrective action sought; and the reasons for requesting the correction; and should include supporting justification or documentation to show how the record is inaccurate, incomplete, untimely, or irrelevant. records to the list of exempt systems of records in HHS regulations implementing the Privacy Act (45 CFR 5b, at 5b.11), and that exemption will be effective upon publication of a Final Rule. The Final Rule will, pursuant to 5 U.S.C. 552a(k)(2), exempt case files marked with the Family Violence Indicator (FVI), which constitute investigatory material compiled for law enforcement purposes, from the accounting, access, and amendment requirements in subsections (c)(3) and (d)(1) through (4) of the Privacy Act (5 U.S.C. 552a(c)(3) and (d)(1) through (4)), subject to the limitation set forth in subsection (k)(2). With respect to case files marked ‘‘FVI,’’ the exemption is intended to be consistent with the disclosure prohibition in section 453(b)(2) of the Social Security Act (42 U.S.C. 653(b)(2)) which prohibits disclosure of case records containing reasonable evidence of domestic violence or child abuse, disclosure of which could be harmful to the custodial parent or the child of such parent, to anyone other than a court or an agent of the court. See also 45 CFR 303.21(e) (describing safeguarding requirements for records marked with the FVI). HISTORY: 80 FR 17912 (Apr. 2, 2015), updated 83 FR 6591 (Feb. 14, 2018). [FR Doc. 2022–19851 Filed 9–12–22; 8:45 am] BILLING CODE 4184–42–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration [Docket No. FDA–2022–D–0795] Computer Software Assurance for Production and Quality System Software; Draft Guidance for Industry and Food and Drug Administration Staff; Availability NOTIFICATION PROCEDURES: AGENCY: To find out if this system of records contains a record about you, submit a written notification request to the System Manager, in accordance with the Department’s Privacy Act implementation regulations in 45 CFR. The request must identify this system of records, contain the same information required for an access request, and include verification of your identity in the same manner required for an access request. HHS. EXEMPTIONS PROMULGATED FOR THE SYSTEM: A notice of proposed rulemaking has been published to add this system of PO 00000 Frm 00072 Fmt 4703 Sfmt 4703 56059 ACTION: Food and Drug Administration, Notice of availability. The Food and Drug Administration (FDA or Agency) is announcing the availability of the draft guidance entitled ‘‘Computer Software Assurance for Production and Quality System Software.’’ FDA is issuing this draft guidance to provide recommendations on computer software assurance for computers and automated data processing systems used as part of medical device production or the quality system. FDA believes that these recommendations will help foster the SUMMARY: E:\FR\FM\13SEN1.SGM 13SEN1

Agencies

[Federal Register Volume 87, Number 176 (Tuesday, September 13, 2022)]
[Notices]
[Pages 56055-56059]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-19851]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Administration for Children & Families


Privacy Act of 1974; System of Records

AGENCY: Administration for Children & Families, Department of Health 
and Human Services.

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, as amended, the Department of Health and Human Services (HHS) is 
modifying an existing system of records maintained by the 
Administration for Children & Families (ACF), Office of Child Support 
Enforcement (OCSE): System No. 09-80-0385, ``OCSE Federal Case Registry 
of Child Support Orders, HHS/ACF/OCSE.'' Elsewhere in this issue of the 
Federal Register, HHS/ACF has published a Notice of Proposed Rulemaking 
(NPRM) proposing to exempt certain records in the system of records 
from the accounting, access, and amendment requirements of the Privacy 
Act.

DATES: Comment on this modified System of Records Notice (SORN) should 
be submitted on or before November 14, 2022.

ADDRESSES: The public should address written comments by mail or email 
to: Anita Alford, Senior Official for Privacy, Administration for 
Children & Families, 330 C St. SW, Washington, DC 20201, or 
[email protected].

FOR FURTHER INFORMATION CONTACT: General questions about these systems 
of records should be submitted by mail or email to Linda Boyer, Deputy 
Commissioner, Office of Child Support

[[Page 56056]]

Enforcement, at 330 C St. SW, 5th Floor, Washington, DC 20201, or 
[email protected].

SUPPLEMENTARY INFORMATION:

I. Explanation of Changes to System of Records 09-80-0385

    This system of records covers records about individuals involved in 
child support cases as provided by state child support registries. This 
information is regularly compared (matched) to records in the National 
Directory of New Hires and other federal agencies' databases to assist 
state child support agencies or other authorized persons in enforcing 
child support obligations. The following modifications have been made:
     Address information in the System Location and System 
Manager sections has been updated.
     The Authorities section has been updated to include 42 
U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2).
     The Routine Uses section has been updated as follows:
    [cir] The opening paragraph, and routine uses 11 and 13, have been 
revised to remove an unnecessary statement that disclosures must be 
compatible with the purpose for which the records were collected (the 
statement is redundant, because this is how a routine use is defined in 
5 U.S.C. 552a(a)(7)).
    [cir] Routine use 10 has been revised to include foreign treaty 
countries as disclosure recipients, pursuant to 42 U.S.C. 652(n) and 
653(c)(5).
    [cir] Routine use 12 has been revised to require that the 
constituent request, which is the subject of the disclosure, must be a 
``written'' request.
    [cir] The security breach-related routine use which was previously 
numbered as routine use 15, and which was revised February 14, 2018 
(see 83 FR 6591), is now numbered as routine use 15(a); and a second 
security breach-related routine use which was added in that same notice 
on February 14, 2018, is now numbered as routine use 15(b).
     The Disclosure to Consumer Reporting Agencies section has 
been removed (it merely confirmed that such disclosures are not made 
from this system of records).
     The Policies and Practices for Retention and Disposal of 
Records section has been updated to identify the applicable NARA-
approved disposition schedule, N-1-292-10-3.
     The Administrative, Technical, and Physical Safeguards 
section has been updated to include information about the use of cloud 
service providers.
     The procedures for making access, amendment, and 
notification requests now state that verification of identity ``is'' 
(instead of ``may be'') required; explain how to provide verification 
of identity (instead of merely referring individuals to HHS' Privacy 
Act regulations); and list date of birth and social security number 
(SSN) as examples of identifying particulars to include for the purpose 
of distinguishing between records on individuals with the same name.
     The Exemptions Promulgated for the System section has been 
clarified and corrected to state that the agency is promulgating a 
regulation to exempt case files marked with the Family Violence 
Indicator (FVI) from the Privacy Act's accounting, access, and 
amendment requirements, under subsection ``(k)(2)'' (not (k)(5)) of the 
Privacy Act. The section now explains that the exemption, as to case 
files marked with the FVI, is intended to be consistent with the 
disclosure prohibition in 42 U.S.C. 653(b)(2), which prohibits 
disclosure of such records to anyone other than a court or an agent of 
the court (instead of stating that such files are ``de facto exempt'' 
from the Privacy Act's notification, access, and accounting 
requirements by virtue of that statute). The section also now also 
includes a reference to 45 CFR 303.21(e), which implements the 
statutory prohibition in 42 U.S.C. 653(b)(2).
    The modified SORN will be applicable when the proposed exemptions 
are made effective by publication of a final rule, which will not occur 
until after the 60-day comment period ends and any comments received on 
the NPRM (or on this SORN) have been addressed. If no comments result 
in changes to the SORN, the SORN will not be published a second time.

January Contreras,
Assistant Secretary, Administration for Children & Families.

SYSTEM NAME AND NUMBER:
    OCSE Federal Case Registry of Child Support Orders (FCR), HHS/ACF/
OCSE, 09-80-0385.

SECURITY CLASSIFICATION:
    Unclassified

SYSTEM LOCATION:
    Office of Child Support Enforcement, Administration for Children & 
Families, 330 C St. SW, 5th Floor, Washington, DC 20201.

SYSTEM MANAGER(S):
    Deputy Commissioner, Office of Child Support Enforcement, 
Administration for Children and Families, Department of Health and 
Human Services, 330 C St. SW, 5th Floor, Washington, DC 20201, or 
[email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    42 U.S.C. 652(a)(7) and (9), 652(n), 653(a)(1) and (2), 653(c)(5), 
653(h), 653(j)(3), and 659a(c)(2).

PURPOSE(S) OF THE SYSTEM:
    The Office of Child Support Enforcement (OCSE) uses the FCR 
primarily to assist states in administering programs under 42 U.S.C. 
651 to 669b (Title IV-D of the Social Security Act, Child Support and 
Establishment of Paternity) and programs funded under 42 U.S.C. 601 to 
619 (Title IV-A of the Social Security Act, Temporary Assistance for 
Needy Families). Additional purposes are specified in sections 453 and 
463 of the Social Security Act. (42 U.S.C. 653, 663).

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Individuals involved in child support cases in which services are 
being provided by the state IV-D child support agencies, and/or 
individuals who are subject to child support orders established or 
modified on or after October 1, 1998, and the children of such 
individuals. Individuals whose information is collected and/or 
disseminated through the system, as part of authorized technical 
assistance or matching, including but not limited to individuals 
involved in a child and family services' program provided by the state 
IV-B agency, and individuals involved in a state IV-E foster care and 
adoption assistance program and programs administered by other 
authorized agencies and entities specified in the routine uses of 
records maintained in this system.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The FCR maintains, collects, and disseminates several categories of 
records. The FCR collects and maintains records provided by state child 
support registries. These records include abstracts of support orders 
and information from child support cases.
    The records may include the following information: Name, Social 
Security number (SSN), state case identification number, state Federal 
Information Processing Standard (FIPS) code, county code, case type 
(cases in which services are being provided by the state child support 
agencies under Title IV-D of the Social Security Act and those cases in 
which services are not being provided by the state child support 
agencies), sex, date of birth, mother's maiden name, father's name, 
participant type (custodial party, non-

[[Page 56057]]

custodial parent, putative father, child), family violence indicator 
(domestic violence or child abuse), order indicator, locate request 
type, and requested locate source. These records are maintained within 
the FCR and are regularly compared (matched) to the National Directory 
of New Hires (NDNH) and other federal agencies' databases to locate 
information for the state child support agencies or other authorized 
persons.
    State child support agencies and other authorized persons can 
directly request information (referred to as locate requests) from the 
Federal Parent Locator Service (FPLS), which includes the FCR system of 
records, and the NDNH system of records. The FPLS must seek the 
requested information from other federal agencies. When state child 
support agencies or other authorized persons request information from 
the FPLS, the request is transmitted to the FPLS via the FCR. Upon 
receipt of such requests, or as a result of the regular comparisons of 
the FCR with the NDNH and other agencies' databases, the records 
located pertaining to the requests are disseminated to the requestor 
via the FCR. The records collected and disseminated, depending upon the 
requestor's specific authority, may include information retrieved from 
the FCR, from the NDNH, or from other federal or state agencies. 
Records from the NDNH and other agencies disseminated through the FCR 
may include categories of information such as name, SSN (or TIN), 
address, phone number, employer, employment status and wages, 
retirement status and pay, assets, military status and pay, federal 
benefits status and amount, representative payees, unemployment status 
and amount, children's health insurance, incarceration status, 
financial institution accounts, assets, and date of death. The FCR also 
contains information related to those categories of records; for 
example, the date of receipt of federal benefits.
    Additional categories of information include those contained in the 
following documents: judicial or administrative orders pertaining to 
child support and medical support; an administrative subpoena; an 
affidavit in support of establishing paternity; a financial statement; 
a medical support notice; a notice of a lien; and an income withholding 
notice. The FCR also maintains: (1) Records (logs) of transactions 
involving the receipt of requests and the dissemination of requested 
information; (2) copies of the disseminated information for audit 
purposes; and (3) copies of certain disseminated information for the 
purpose of electronically filtering and suppressing the transmission of 
redundant information.

RECORD SOURCE CATEGORIES:
    Records maintained within the FCR are furnished by state child 
support enforcement agencies. Records disseminated from the FCR for the 
purpose of providing locate information from the NDNH and other federal 
agencies are furnished by departments, agencies, or instrumentalities 
of the United States or any state, employers, financial institutions, 
and insurers or their agents.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSE OF SUCH USES:
    These routine uses specify circumstances under which ACF may 
disclose information from this system of records without the consent of 
the data subject. Each proposed disclosure of information under these 
routine uses will be evaluated to ensure that the disclosure is legally 
permissible. If any record contains a ``family violence indicator'' 
associated to the record by state child support agencies, if there is 
reasonable evidence of domestic violence or child abuse and disclosure 
could be harmful to the party or the child, the record may only be 
disclosed as determined by a court as provided in 42 U.S.C. 653(b)(2).
    Any information defined as ``return'' or ``return information'' 
under 26 U.S.C. 6103 (Internal Revenue Code) will not be disclosed 
unless authorized by a statute, the Internal Revenue Service (IRS) or 
IRS regulations.
    (1) Disclosure for Child Support Purposes.
    Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653(c), 
information about the location of an individual or information that 
would facilitate the discovery of the location of an individual may be 
disclosed, upon request filed in accordance with law, to an 
``authorized person,'' as defined in 42 U.S.C. 653(c), for the purpose 
of establishing parentage or establishing, setting the amount of, 
modifying or enforcing child support obligations. Information disclosed 
may include information about an individual's wages (or other income) 
from, and benefits of, employment, and information on the type, status, 
location, and amount of any assets of, or debts owed by or to, the 
individual.
    (2) Disclosure to any Department, Agency, or Instrumentality of the 
United States or of any State to Locate an Individual or Information 
Pertaining to an Individual.
    Pursuant to 42 U.S.C. 653(e)(1), information from the FCR (names 
and SSNs) may be disclosed to any department, agency, or 
instrumentality of the United States or of any state in order to obtain 
information for an ``authorized person'' as defined in 42 U.S.C. 653(c) 
which pertains to an individual's location, wages (or other income) 
from, and benefits of, employment (including rights to or enrollment in 
group health care coverage); or the type, status, location, and amount 
of any assets of, or debts owed by or to, the individual.
    (3) Disclosure for Purposes Related to the Unlawful Taking or 
Restraint of a Child or Child Custody or Visitation.
    Pursuant to 42 U.S.C. 653(b)(1)(A), upon request of an ``authorized 
person,'' as defined in 42 U.S.C. 663(d)(2), or upon request of the 
Department of Justice, Office of Juvenile Justice and Delinquency 
Prevention, pursuant to 42 U.S.C. 663(f), information as to the most 
recent address and place of employment of a parent or child may be 
disclosed for the purpose of enforcing any state or federal law with 
respect to the unlawful taking or restraint of a child or making or 
enforcing a child custody or visitation determination.
    (4) Disclosure to the Social Security Administration for 
Verification.
    Pursuant to 42 U.S.C. 653(j)(1), the names, SSNs, and birth dates 
of individuals about who information is maintained may be disclosed to 
the Social Security Administration to the extent necessary for 
verification of the information by the Social Security Administration.
    (5) Disclosure for Locating an Individual for Paternity 
Establishment or in Connection with a Support Order.
    Pursuant to 42 U.S.C. 653(j)(2)(B), the results of a comparison 
between records in this system and the NDNH may be disclosed to the 
state IV-D child support enforcement agency responsible for the case 
for the purpose of locating an individual in a paternity establishment 
case or a case involving the establishment, modification, or 
enforcement of a support order.
    (6) Disclosure to State Agencies Operating Specified Programs.
    Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a 
state to the extent and with the frequency that the Secretary 
determines to be effective in assisting the state to carry out its 
responsibilities under child support programs operated under 42 U.S.C. 
651 through 669b (Title IV-D of the Social Security Act, Child Support 
and Establishment of Paternity), child and family services programs 
operated under 42 U.S.C. 621 through 629m

[[Page 56058]]

(Title IV-B of the Social Security Act), Foster Care and Adoption 
Assistance programs operated under 42 U.S.C. 670 through 679c (Title 
IV-E of the Social Security Act) and assistance programs funded under 
42 U.S.C. 601 through 619 (Title IV-A of the Social Security Act, 
Temporary Assistance for Needy Families).
    (7) Disclosure to Department of State under International Child 
Abduction Remedies Act.
    Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address 
and place of employment of a parent or child may be disclosed upon 
request to the Department of State, in its capacity as the Central 
Authority designated in accordance with section 7 of the International 
Child Abduction Remedies Act, 42 U.S.C. 11601 et seq., for the purpose 
of locating the parent or child on behalf of an applicant.
    (8) Disclosure to Secretary of the Treasury for Certain Tax 
Purposes.
    Pursuant to 42 U.S.C. 653(h)(3), information may be disclosed to 
the Secretary of Treasury for the purpose of administering sections of 
the Internal Revenue Code which grant tax benefits based on support or 
residence of children.
    (9) Disclosure for Authorized Research Purposes.
    Pursuant to 42 U.S.C. 653(j)(5), data in the FCR may be disclosed, 
without personal identifiers, for research purposes found by the 
Secretary to be likely to contribute to achieving the purposes of 42 
U.S.C. 651 through 669b (Title IV-D of the Social Security Act, Child 
Support and Establishment of Paternity) and 42 U.S.C. 601 through 619 
(Title IV-A of the Social Security Act, Temporary Assistance for Needy 
Families).
    (10) Disclosure to a Foreign Reciprocating Country and Foreign 
Treaty Country for Child Support Purposes.
    Pursuant to 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2), 
information on the state of residence of an individual sought for 
support enforcement purposes in cases involving residents of the United 
States and residents of foreign treaty countries or foreign countries 
that are the subject of a declaration under 42 U.S.C. 659a may be 
disclosed to the foreign country.
    (11) Disclosure for Law Enforcement Purpose.
    Information may be disclosed to the appropriate federal, state, 
local, Tribal, or foreign agency responsible for identifying, 
investigating, and prosecuting noncustodial parents who knowingly fail 
to pay their support obligations and meet the criteria for federal 
prosecution under 18 U.S.C. 228. The information must be relevant to 
the violation of criminal nonsupport, as stated in the Deadbeat Parents 
Punishment Act, 18 U.S.C. 228.
    (12) Disclosure to Congressional Office.
    Information may be disclosed to a congressional office from the 
record of an individual in response to a written inquiry from the 
congressional office made at the written request of the individual.
    (13) Disclosure to Department of Justice or in Proceedings.
    Information may be disclosed to support the Department of Justice, 
or in a proceeding before a court, adjudicative body, or other 
administrative body before which HHS is authorized to appear, when:
     HHS, or any component thereof; or
     Any employee of HHS in his or her official capacity; or
     Any employee of HHS in his or her individual capacity 
where the Department of Justice or HHS has agreed to represent the 
employee; or
     The United States, is a party to litigation or has an 
interest in such litigation, and the use of such records by the 
Department of Justice or the court or adjudicative body is deemed by 
HHS to be relevant and necessary to the litigation.
    (14) Disclosure to Contractor to Perform Duties.
    Information may be disclosed to a contractor performing or working 
on a contract for HHS and who has a need to have access to the 
information in the performance of its duties or activities for HHS in 
accordance with law and with the contract.
    (15) Disclosure in the Event of a Security Breach.
    (a) Information may be disclosed to appropriate agencies, entities, 
and persons when (1) HHS suspects or has confirmed that there has been 
a breach of the system of records; (2) HHS has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, HHS (including its information systems, programs, and 
operations), the federal government, or national security; and (3) the 
disclosure made to such agencies, entities, and persons is reasonably 
necessary to assist in connection with HHS's efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.
    (b) Information may be disclosed to another federal agency or 
federal entity, when HHS determines that information from this system 
of records is reasonably necessary to assist the recipient agency or 
entity in (1) responding to a suspected or confirmed breach or (2) 
preventing, minimizing, or remedying the risk of harm to individuals, 
the recipient agency or entity (including its information systems, 
programs, and operations), the federal government, or national 
security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored electronically at the Social Security 
Administration's National Support Center and the OCSE Data Center. 
Historical logs and system backups are stored offsite at an alternate 
location.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by an identification number assigned to a 
child support case by the state child support enforcement agency, an 
SSN or TIN of an individual, a transaction serial number, or by a name 
and date of birth of an individual.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    FCR records are retained and disposed of in accordance with the 
applicable NARA-approved disposition schedule, N1-292-10-3.
    (1) Records provided from state child support agencies:
    (a) Electronic records furnished by the state child support agency 
containing child support case and order information (input files) are 
retained for 60 days and then deleted.
    (b) State agency records (as posted to the FCR) remain within the 
FCR until removed, upon notification by the state agency that the case 
is closed, provided that, upon request, a sample may be retained for 
research purposes found by OCSE to be likely to contribute to achieving 
the purposes of child support programs or the TANF program, but without 
personal identifiers.
    (c) Records pertaining to closed cases are archived on the fiscal 
year basis and retained for two years. Family violence indicators are 
removed from the individual's record, upon request by the state that 
initiated the indicator.
    (2) Locate requests and match results:
    (a) Locate requests submitted by state child support agencies and 
other authorized persons and match results are retained for 60 days and 
are then deleted.
    (b) Audit trail records of locate requests and disclosures of match 
results pursuant to those requests, which include indications of which 
federal agencies were contacted for

[[Page 56059]]

locate information, whether information was located, and the type(s) of 
information returned to the requesting entity, are archived once a year 
based on the fiscal year. The records are retained for two completed 
fiscal years and then destroyed. These records indicate the type of 
information located for the authorized user, not the information 
itself.
    (3) Match results generated as a result of FCR-to-FCR comparisons 
which locate individuals who are participants in child support cases or 
orders in more than one state are transmitted to the relevant states. 
Copies of FCR-to-FCR match results are retained for 60 days and then 
deleted.
    (4) Any record relating or potentially relating to a fraud or abuse 
investigation or a pending or ongoing legal action, including a class 
action, is retained until conclusion of the investigation or legal 
action.
    (5) Copies of the FCR records transmitted to the Secretary of the 
Treasury for the purpose of administering sections of the Internal 
Revenue Code which grant tax benefits based on support or residence of 
children (routine use 8) are retained for one year and then deleted.
    (6) Records collected or disseminated for technical assistance to 
child support agencies or other authorized agencies or entities are 
retained for 60 days to five years, and audit data is retained for a 
period of up to two years.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    The system leverages cloud service providers that maintain an 
authority to operate in accordance with applicable laws, rules, and 
policies, including Federal Risk and Authorization Management Program 
(FedRAMP) requirements. Specific administrative, technical, and 
physical controls are in place to ensure that the records collected and 
maintained in the FCR are secure from unauthorized access. Access to 
the records is restricted to authorized personnel who are advised of 
the confidentiality of the records and the civil and criminal penalties 
for misuse and who sign a nondisclosure oath to that effect. Personnel 
are provided privacy and security training before being granted access 
to the records and annually thereafter. Logical access controls are in 
place to limit access to the records to authorized personnel and to 
prevent browsing. The records are processed and stored in a secure 
environment. All records are stored in an area that is physically safe 
from access by unauthorized persons at all times.
    Safeguards conform to the HHS Information Security and Privacy 
Program, which may be found at https://www.hhs.gov/ocio/securityprivacy/.

RECORD ACCESS PROCEDURES:
    To request access to a record about you, submit a written request 
to the System Manager, in accordance with the Department's Privacy Act 
implementation regulations in 45 CFR. The request should include your 
name, telephone number and/or email address, current address, and 
signature, and sufficient particulars (such as, date of birth or SSN) 
to enable the System Manager to distinguish between records on subject 
individuals with the same name. To verify your identity, your signature 
must be notarized or your request must include your signed, written 
certification that you are the individual who you claim to be and that 
you understand that the knowing and willful request for or acquisition 
of a record pertaining to an individual under false pretenses is a 
criminal offense subject to a fine of up to $5,000.

CONTESTING RECORD PROCEDURES:
    To request correction of a record about you in this system of 
records, submit a written amendment request to the System Manager, in 
accordance with the Department's Privacy Act implementation regulations 
in 45 CFR. The request must contain the same information required for 
an access request and include verification of your identity in the same 
manner required for an access request. In addition, the request must 
reasonably identify the record and specify the information contested; 
the corrective action sought; and the reasons for requesting the 
correction; and should include supporting justification or 
documentation to show how the record is inaccurate, incomplete, 
untimely, or irrelevant.

NOTIFICATION PROCEDURES:
    To find out if this system of records contains a record about you, 
submit a written notification request to the System Manager, in 
accordance with the Department's Privacy Act implementation regulations 
in 45 CFR. The request must identify this system of records, contain 
the same information required for an access request, and include 
verification of your identity in the same manner required for an access 
request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    A notice of proposed rulemaking has been published to add this 
system of records to the list of exempt systems of records in HHS 
regulations implementing the Privacy Act (45 CFR 5b, at 5b.11), and 
that exemption will be effective upon publication of a Final Rule. The 
Final Rule will, pursuant to 5 U.S.C. 552a(k)(2), exempt case files 
marked with the Family Violence Indicator (FVI), which constitute 
investigatory material compiled for law enforcement purposes, from the 
accounting, access, and amendment requirements in subsections (c)(3) 
and (d)(1) through (4) of the Privacy Act (5 U.S.C. 552a(c)(3) and 
(d)(1) through (4)), subject to the limitation set forth in subsection 
(k)(2).
    With respect to case files marked ``FVI,'' the exemption is 
intended to be consistent with the disclosure prohibition in section 
453(b)(2) of the Social Security Act (42 U.S.C. 653(b)(2)) which 
prohibits disclosure of case records containing reasonable evidence of 
domestic violence or child abuse, disclosure of which could be harmful 
to the custodial parent or the child of such parent, to anyone other 
than a court or an agent of the court. See also 45 CFR 303.21(e) 
(describing safeguarding requirements for records marked with the FVI).

HISTORY:
    80 FR 17912 (Apr. 2, 2015), updated 83 FR 6591 (Feb. 14, 2018).

[FR Doc. 2022-19851 Filed 9-12-22; 8:45 am]
BILLING CODE 4184-42-P


This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.