Privacy Act of 1974; System of Records, 25625-25631 [2024-07668]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Administration for Children and Families

[Federal Register Volume 89, Number 71 (Thursday, April 11, 2024)]
[Notices]
[Pages 25625-25631]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-07668]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Administration for Children and Families


Privacy Act of 1974; System of Records

AGENCY: Administration for Children and Families (ACF), Department of 
Health and Human Services (HHS).

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, as amended, the Department of Health and Human Services (HHS) is 
modifying an existing system of records maintained by the 
Administration for Children and Families (ACF), Office of Child Support 
Services (OCSS): System No. 09-80-0381, ``OCSS National Directory of 
New Hires, HHS/ACF/OCSS.''

DATES: This Notice is applicable April 11, 2024, subject to a 30-day 
period in which to comment on the new and revised routine uses, 
described below. Please submit any comments by May 13, 2024.

ADDRESSES: The public should address written comments by mail or email 
to Anita Alford, Senior Official for Privacy, Administration for 
Children and Families, 330 C St. SW, Washington, DC 20201, or by email 
to [email protected].

FOR FURTHER INFORMATION CONTACT: General questions about these system 
of records should be submitted by mail or email to Venkata Kondapolu, 
Director, Division of Federal Systems, Office of Child Support 
Services, at 330 C St. SW--5th Floor, Washington, DC 20201, or 
[email protected], or by phone at 202-260-4712.

[[Page 25626]]


SUPPLEMENTARY INFORMATION:

I. Explanation of Changes to System of Records 09-80-0381

    In accordance with 5 U.S.C. 552a(e)(4) and (11), HHS is modifying 
an existing system of records maintained by ACF, OCSS: System No. 09-
80-0381, ``OCSS National Directory of New Hires, HHS/ACF/OCSS.''
    This system of records covers records about newly hired employees, 
including employer, wage, unemployment compensation, and income 
withholding information, maintained for child support program purposes 
(including locating parents, the establishment of parentage, and the 
establishment and enforcement of child support and medical support 
obligations). The System of Records Notice (SORN) has been modified as 
follows:
     The System Name has been changed to ``OCSS National 
Directory of New Hires'' to reflect the name change of the ``Office of 
Support Enforcement'' to the ``Office of Child Support Services.''
     The System Manager section has been revised to change the 
title of the official serving as the System Manager from ``Acting 
Director'' to ``Director'' and to change the office name to ``Office of 
Child Support Services.''
     The Purpose(s) section has been revised to include an 
additional purpose for which OCSS may use NDNH data, i.e., to create 
deidentified or aggregate datasets for reporting purposes or for HHS or 
another agency to use for analysis, and to describe one such example. 
In addition, a list of ``other'' statutorily authorized purposes has 
been clarified to show that those are purposes for which entities other 
than OCSS are authorized to use NDNH data, and that OCSS coordinates 
those entities' use of NDNH data for those purposes.
     The Categories of Individuals section has been revised to:
    [cir] Remove the category of individuals whose information is 
contained within input records furnished for purposes of establishing 
or verifying eligibility of applicants for, or beneficiaries of, 
federal or state benefit programs. This category is redundant because 
these individuals would be covered by the other categories.
    [cir] Add ``individuals about whom information is captured in the 
NDNH other than as described in the preceding categories'' to clarify 
that the last category is not a subset of the other categories.
     The Categories of Records section has been revised as 
follows:
    [cir] In category (1), ``furnished by a State Directory of New 
Hires'' has been omitted, and the citation 42 U.S.C. 653a(g)(2)(A) was 
corrected to read 42 U.S.C. 653a(a)(2)(C).
    [cir] In category (2), ``furnished by a federal department, agency, 
or instrumentality'' has been omitted, and the Department of Defense 
status code has been explained as indicating whether an individual is 
an active duty, civilian, retired/pension, or reserve employee.
    [cir] In category (3), ``furnished by a State Directory of New 
Hires'' has been omitted, and unemployment compensation records are now 
described as consisting of claimant name, Social Security Number (SSN), 
address, benefit amount, and reporting period.
    [cir] Existing category (4) has been broken into two categories, 
now numbered as (4) and (5), and revised as follows:
    [ssquf] In category (4), ``furnished by a federal department, 
agency, or instrumentality'' has been omitted; ``wages paid to 
individuals'' has been changed to ``the amount of quarterly wages paid 
to federal employees''; and quarterly wages are now described as 
including quarterly wage processed date, employee name, federal 
employer identification number (FEIN), employer's state, Department of 
Defense code, employer name, employer address, employee wage amount, 
quarterly wage reporting period, transmitter agency code, transmitter 
state code, and transmitter state or agency name.
    [ssquf] In category (5), ``records obtained pursuant to an 
agreement'' has been omitted; ``wage and unemployment compensation'' 
has been changed to ``wage and unemployment compensation amounts paid 
to individuals, as maintained by or for the Department of Labor''; and 
unemployment compensation records are now described as including 
unemployment insurance processed date, claimant name, claimant address, 
claimant benefit amount, unemployment insurance reporting period, 
transmitter state code, and transmitter state or agency name.
    [cir] In category (6) (formerly category (5)), matching program 
input records are now described as consisting of an individual's name, 
date of birth, and SSN, and an explanation has been added stating that 
``[s]uch input records are included in the NDNH to, e.g., document that 
a SSN has been verified or that a SSN number transposition or SSN/name 
match error has been corrected, or to maintain a record of partial 
information which has not been verified.''
    [cir] In category (7) (formerly category (6)), ``termination date'' 
has been changed to ``employment termination date''; ``contact 
information'' has been changed to ``phone number, home address, email 
address''; examples of employers' third party service providers have 
been included (``e.g., vendors hired by an employer to process payroll 
or medical insurance information''); and ``order information'' has been 
changed to ``child support income withholding order information.''
     The Record Source Categories section has been revised to 
change ``departments, agencies, or instrumentalities of the United 
States or any state'' to ``federal, state, local, territorial, or 
tribal government agencies.''
     The Routine Uses section has been updated as follows:
    [cir] A note at the start of the section stating that HHS may make 
a disclosure under a routine use subject to redisclosure restrictions 
has been revised to state that any such restrictions will be imposed 
pursuant to a Data Use Agreement entered into between HHS and the 
disclosure recipient.
    [cir] Routine use 1 has been reworded at the start to change 
``information'' to ``records'' and to provide examples explaining the 
term ``individual.''
    [cir] Routine use 3 has been revised to include a definition of 
``applicant'' and to update a statutory citation to read ``22 U.S.C. 
9001'' instead of ``42 U.S.C. 11601.''
    [cir] Routine use 4 has been revised to correct a statutory 
citation to read ``42'' U.S.C. 659a instead of ``52'' U.S.C. 659a.
    [cir] Routine use 5 has been revised to include ``upon request'' to 
show that the disclosures are initiated by the disclosure recipient.
    [cir] Routine use 6 has been revised to remove ``of individuals 
about whom information is maintained.''
    [cir] Routine use 7 has been revised to include ``upon request'' to 
show that the disclosures are initiated by the disclosure recipient.
    [cir] Routine use 8 has been revised to change ``the Secretary'' to 
``the Secretary of Health and Human Services.''
    [cir] Routine use 9 has been revised to include ``upon request'' to 
show that the disclosures are initiated by the disclosure recipient.
    [cir] Former routine use 10, which authorized disclosures of data 
``without personal identifiers'' for certain research purposes, has 
been deleted as unnecessary, because data lacking personal identifiers 
would not constitute Privacy Act records. The routine use is also 
unnecessary to the

[[Page 25627]]

extent it duplicates the disclosure authorization in 5 U.S.C. 
552a(b)(5), which permits data that is ``not individually 
identifiable'' to be disclosed based on advance adequate written 
assurance from the recipient that the data will be used solely as a 
statistical research or reporting record.
    [cir] Routine use 10 is now a new routine use added to allow HHS to 
disclose to the Secretary of Agriculture information about individuals 
participating in a rural housing program for the purpose of verifying 
the employment and income of the individual, pursuant to 7 U.S.C. 
1981(f).
    [cir] Routine uses 11, 12, and 16 have been revised to remove 
unnecessary wording at the end of each routine use, mentioning that the 
recipients also use data, with personal identifiers removed, to conduct 
analyses. That is now stated in the Purpose(s) section, because the 
recipients receive deidentified datasets from OCSS to use for that 
purpose (they do not create deidentified datasets from identifiable 
data they receive from OCSS). In addition:
    [ssquf] Routine use 11 has been revised to include ``upon request'' 
to show that the disclosures are initiated by the disclosure recipient.
    [ssquf] Routine use 12 has been revised to include ``upon request'' 
to show that the disclosures are initiated by the disclosure recipient.
    [ssquf] Routine use 16 has been revised to reflect that the 
disclosures are for ``veteran employment tracking'' instead of for 
``verifying the employment and income of the individual'' because the 
applicable disclosure provision in Title 42, United States Code, is now 
42 U.S.C. 653a(h)(4) (added by Pub. L. 116-315, Jan. 5, 2021), which 
permits the Veterans Administration to access ``information reported by 
employers . . . for purposes of tracking employment of veterans.'' (The 
former disclosure provision, 42 U.S.C. 653(j)(11), expired Mar. 29, 
2014; see 42 U.S.C. 653(j)(11)(G)(ii).). This routine use has also been 
revised to include ``upon request'' to show that the disclosures are 
initiated by the disclosure recipient.
    [cir] Routine use 13 has been revised to include ``upon request'' 
to show that the disclosures are initiated by the disclosure recipient.
    [cir] Routine use 14 has been revised to include ``upon request'' 
to show that the disclosures are initiated by the disclosure recipient. 
In addition, the words ``which has been referred to the Secretary of 
the Treasury for collection'' have been added.
    [cir] Routine use 15 has been revised to include ``upon request'' 
to show that the disclosures are initiated by the disclosure recipient.
    [cir] Routine use 17 has been revised to change ``information'' to 
``records,'' and to include ``upon request'' to show that the 
disclosures are initiated by the disclosure recipient.
    [cir] Routine use 19 has been revised to change ``individual'' to 
``subject individual.''
    [cir] A note at the end of the Routine Uses section has been 
revised. It explains that most disclosures the Privacy Act authorizes 
to be made without the data subject's consent are not, in fact, 
permissible for NDNH data, based on the restrictions contained in 
NDNH's authorizing statute at 42 U.S.C. 653(l)(1). The revised note 
also explains that, notwithstanding the restrictions in NDNH's 
authorizing statute, HHS may lawfully disclose NDNH data, upon request, 
to the following federal agencies without the data subject's consent, 
as such disclosures are authorized in 5 U.S.C. 552a(b)(10) and (b)(1), 
respectively, and are required by the Comptroller General and Inspector 
General statutes cited below: (a) the Comptroller General under 31 
U.S.C. 721; and (b) the HHS Inspector General under 5 U.S.C. Appendix 
3, section 6(a)(1).
     The Retention and Disposal section has been revised to 
explain that the ``order identifier'' is an ``alternate state case 
identifier.''
     The Record Access Procedures section has been revised to 
change ``the request should include'' to ``the request must include.''

Venkata Kondapolu,
Director, Division of Federal Systems.

SYSTEM NAME AND NUMBER:
    OCSS National Directory of New Hires, HHS/ACF/OCSS, 09-80-0381.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    Office of Child Support Services, Administration for Children and 
Families, 330 C St. SW--5th Floor, Washington, DC 20201.

SYSTEM MANAGER(S):
    Director, Division of Federal Systems, Office of Child Support 
Services, Administration for Children and Families, Department of 
Health and Human Services, 330 C St. SW, 5th Floor, Washington, DC 
20201, or [email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    42 U.S.C. 652(a)(9), 652(n), 653(a)(1) and (2), 653(c)(5), 653(i), 
and 659a(c)(2).

PURPOSE(S) OF THE SYSTEM:
    The Office of Child Support Services (OCSS) uses the NDNH primarily 
to assist states and Indian tribes or tribal organizations to locate 
parents; establish paternity and child support orders, including the 
establishment of medical support; and enforce child support and medical 
support orders. States and other entities are specifically authorized 
by statute to use NDNH data in their programs for specific purposes, 
and OCSS coordinates their access to the data for those purposes. These 
purposes include: (a) to support the following programs, as specified 
in 42 U.S.C. 653 and 663: the Temporary Assistance for Needy Families 
(TANF) program, child and family services programs, and foster care and 
adoption assistance programs; (b) to establish or verify the 
eligibility of applicants for, or beneficiaries of, federal and state 
benefit programs, including through the use of matching programs; (c) 
to recoup payments or delinquent debts under benefit programs and non-
tax debts owed to the Federal Government; (d) to administer the tax 
code; and (e) to conduct research likely to contribute to achieving the 
purposes of the TANF program or the federal/state/tribal child support 
program, as authorized under 42 U.S.C. 653(j)(5). OCSS may also use 
NDNH data to create deidentified or aggregate datasets for its 
reporting purposes, or for use by HHS or another agency for analysis. 
For example, OCSS provides deidentified NDNH data about rural housing 
program participants to the Secretary of Housing and Urban Development 
to support analysis regarding employment and income reporting.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    (1) Individuals who are newly hired ``employees'' within the 
meaning of chapter 24 of the Internal Revenue Code of 1986, 26 U.S.C. 
3401, whose employers have furnished the information specified under 42 
U.S.C. 653a(b)(1)(A) to a State Directory of New Hires which, in turn, 
has furnished such information to the NDNH pursuant to 42 U.S.C. 
653a(g)(2)(A).
    (2) Individuals who are Federal Government employees whose 
employers have furnished specified information to the NDNH pursuant to 
42 U.S.C. 653(n) and 653a(b)(1)(c). This category does not include 
individuals who are employees of a department, agency, or 
instrumentality performing intelligence or counterintelligence 
functions, if the head of such department, agency, or instrumentality 
has determined that filing such a report

[[Page 25628]]

could endanger the safety of the employee or compromise an ongoing 
investigation or intelligence mission.
    (3) Individuals to whom unemployment compensation or wages have 
been paid, and about whom the State Directory of New Hires has 
furnished such information to the NDNH pursuant to 42 U.S.C. 653(e)(3) 
and 653a(g)(2)(B). Such individuals may include independent 
contractors, in accordance with state law.
    (4) Individuals about whom information is captured in the NDNH 
other than as described in the preceding categories, including 
individuals involved in child support cases whose information is 
collected from and disseminated to employers (and other payers of 
income) and state or Tribal IV-D child support enforcement agencies, 
courts, and other authorized entities for enforcement of child support 
orders by withholding of income.

CATEGORIES OF RECORDS IN THE SYSTEM:
    (1) Records pertaining to newly hired employees as defined by 42 
U.S.C. 653a(a)(2)(C). Records in the system are the name, address, 
Social Security Number (SSN) or Taxpayer Identification Number (TIN), 
and date of hire of the employee; the name, address, and federal 
identification number of the employer of such employee; and, at the 
option of the state, the date of birth or state of hire of the 
employee.
    (2) Records pertaining to newly hired federal employees pursuant to 
42 U.S.C. 653a(b)(1)(C), including the name, address, SSN (or TIN), and 
date of hire of the employee; the name, address, and employer 
identification number (EIN) of the employer, and, where available, a 
Department of Defense status code, indicating whether an individual is 
an active duty, civilian, retired/pension, or reserve employee.
    (3) Records pertaining to wages and unemployment compensation paid 
to individuals pursuant to 42 U.S.C. 653a(g)(2)(B). Unemployment 
compensation records include claimant name, SSN, address, benefit 
amount, and reporting period. Such records may also pertain to 
independent contractors, in accordance with state law.
    (4) Records pertaining to the quarterly wages paid to federal 
employees pursuant to 42 U.S.C. 653(n). Quarterly wage records include 
the date quarterly wages were processed, employee name, federal 
employer identification number (FEIN), employer's state, Department of 
Defense code, employer name, employer address, employee wage amount, 
quarterly wage reporting period, transmitter agency code, transmitter 
state code, and transmitter state or agency name.
    (5) Records pertaining to quarterly wage and unemployment 
compensation amounts paid to individuals, as maintained by or for the 
Department of Labor pursuant to 42 U.S.C. 653(e)(3). Unemployment 
compensation records include unemployment insurance processed date, 
claimant name, claimant address, claimant benefit amount, unemployment 
insurance reporting period, transmitter state code, and transmitter 
state or agency name.
    (6) Input records, consisting of an individual's name, date of 
birth, and SSN, furnished by a state or federal agency or other entity 
for authorized matching with the NDNH. Such input records are included 
in the NDNH to, e.g., document that an SSN has been verified or that an 
SSN number transposition or SSN/name match error has been corrected, or 
to maintain a record of partial information that has not been verified.
    (7) Records collected from employers and other income sources 
pertaining to income withholding and medical support such as: 
employment termination date, final payment date and amount, phone 
number, home address, email address, names of children, health care 
coverage provider information (such as provider and contact name, FEIN, 
address, phone and fax numbers), information about any third-party 
service providers (e.g., vendors hired by an employer to process 
payroll or medical insurance information), information about any 
professional employer organizations (if the employer outsourced 
employee management functions), pension plan provider information, lump 
sum income information, child support income withholding order 
information, past due child support information, amounts to withhold, 
and instructions for withholding.

RECORD SOURCE CATEGORIES:
    NDNH records are obtained from federal, state, local, territorial, 
or tribal government agencies; from entities authorized to match to 
receive NDNH information; and from health plan administrators, 
employers, and other income sources.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    These routine uses specify circumstances under which HHS may 
disclose records from this system of records without the consent of the 
data subject. Each proposed disclosure under any of these routine uses 
will be evaluated to ensure that the disclosure is legally permissible. 
When HHS makes a disclosure under a routine use and is required by law 
to, or chooses to, prohibit redisclosures or permit only certain 
redisclosures, HHS will make the disclosure pursuant to a Data Use 
Agreement that imposes the pertinent use, reuse, and re-disclosure 
restrictions on the recipient. Any information defined as ``return'' or 
``return information'' under 26 U.S.C. 6103 (Internal Revenue Code) 
will not be disclosed under a routine use unless authorized by a 
statute, the Internal Revenue Service (IRS), or IRS regulations.

    (1) Disclosure for Child Support Purposes

    Pursuant to 42 U.S.C. 653(a)(2), 653(b)(1)(A), and 653(c), records 
of the location of an individual (e.g., a child support obligor, a 
child support obligee, or an individual who has, or may have, parental 
rights to a child), or records that would facilitate the discovery of 
the location of an individual or that would identify an individual for 
the purpose of establishing parentage or establishing, setting the 
amount of, modifying, or enforcing child support obligations may be 
disclosed to ``authorized persons.'' Other information that may be 
disclosed in accordance with an applicable law and this routine use 
would include information about an individual's wages (or other income) 
from, and other benefits derived from, employment or other income and 
benefit sources, and information on the type, status, location, and 
amount of any assets of, or debts owed by or to, the individual. An 
``authorized person'' is defined under 42 U.S.C. 653(c) as follows: (1) 
any agent or attorney of any state or Indian Tribe or Tribal 
organization (as defined in 25 U.S.C. 5304(e) and (l)), having in 
effect a plan approved under title IV-D of the Social Security Act who 
has the duty or authority under such plans to seek, or to recover any 
amounts owed as child and spousal support (including, when authorized 
under the state plan, any official of a political subdivision); (2) the 
court that has authority to issue an order, or to serve as the 
initiating court in an action to seek an order against a noncustodial 
parent for the support and maintenance of a child, or any agent of such 
court; (3) the resident parent, legal guardian, attorney, or agent of a 
child (other than a child receiving assistance under a state program 
funded under part A of title IV of the Social Security Act [42 U.S.C. 
601 et seq.]) (as determined by regulations prescribed by the 
Secretary; currently, such regulations are contained in 45 CFR parts 
302 and

[[Page 25629]]

303) without regard to the existence of a court order against a 
noncustodial parent who has a duty to support and maintain any such 
child; (4) a state agency that is administering a program operated 
under a state plan under subpart 1 of part B of title IV of the Social 
Security Act (42 U.S.C. 620 et seq.), or a state plan approved under 
subpart 2 of part B of title IV of the Social Security Act (42 U.S.C. 
629 et seq.) or under part E of title IV of the Social Security Act (42 
U.S.C. 670 et seq.); and (5) an entity designated as a Central 
Authority for child support enforcement in a foreign reciprocating 
country or a foreign treaty country for purposes specified in section 
459A(c)(2) of the Social Security Act (42 U.S.C. 659a(c)(2)).
    (2) Disclosure for Purposes Related to the Unlawful Taking or 
Restraint of a Child or Child Custody or Visitation.
    Pursuant to 42 U.S.C. 653(b)(1), upon request of an ``authorized 
person,'' as defined in 42 U.S.C. 663(d)(2), information as to the most 
recent address and place of employment of a parent or child may be 
disclosed for the purpose of enforcing any state or federal law with 
respect to the unlawful taking or restraint of a child or making or 
enforcing a child custody or visitation determination.
    (3) Disclosure to Department of State Under International Child 
Abduction Remedies Act.
    Pursuant to 42 U.S.C. 653(b)(1) and 663(e), the most recent address 
and place of employment of a parent or child may be disclosed upon 
request to the Department of State, in its capacity as the Central 
Authority designated in accordance with section 7 of the International 
Child Abduction Remedies Act, 22 U.S.C. 9001 et seq., for the purpose 
of locating the parent or child on behalf of an applicant. An applicant 
includes ``any person who, pursuant to the [Hague] Convention, files an 
application with the United States Central Authority or a Central 
Authority of any other party to the Convention for the return of a 
child alleged to have been wrongfully removed or retained or for 
arrangements for organizing or securing the effective exercise of 
rights of access pursuant to the Convention'' (22 U.S.C. 9002(1)).
    (4) Disclosure to a Foreign Reciprocating Country and Foreign 
Treaty Country for Child Support Purposes.
    Pursuant to 42 U.S.C. 652(n), 653(a)(2), 653(c)(5), and 659a(c)(2), 
information on the state of residence of an individual sought for 
support enforcement purposes in cases involving residents of the United 
States and residents of foreign treaty countries or foreign countries 
that are the subject of a declaration under 42 U.S.C. 659a may be 
disclosed to the foreign country.
    (5) Disclosure to the Treasury for Tax Administration Purposes.
    Pursuant to 42 U.S.C. 653(i)(3), information may be disclosed to 
the Secretary of the Treasury, upon request, for purposes of 
administering 26 U.S.C. 32 (earned income tax credit), administering 26 
U.S.C. 3507 (advance payment of earned income tax credit), and 
verifying a claim with respect to employment in a tax return.
    (6) Disclosure to the Social Security Administration for 
Verification.
    Pursuant to 42 U.S.C. 653(j)(1), HHS may disclose names, SSNs, and 
birth dates to the Social Security Administration to the extent 
necessary for verification by the Social Security Administration.
    (7) Disclosure for Locating an Individual for Paternity 
Establishment or in Connection with a Support Order.
    Pursuant to 42 U.S.C. 653(j)(2), the results of a comparison 
between records in this system and the Federal Case Registry of Child 
Support Orders may be disclosed, upon request, to the state or tribal 
IV-D child support enforcement agency responsible for the case for the 
purpose of locating an individual in a paternity establishment case or 
a case involving the establishment, modification, or enforcement of a 
support order.
    (8) Disclosure to State Agencies Operating Specified Programs.
    Pursuant to 42 U.S.C. 653(j)(3), information may be disclosed to a 
state to the extent and with the frequency that the Secretary of Health 
and Human Services determines to be effective in assisting the state to 
carry out its responsibilities under child support programs operated 
under 42 U.S.C. 651 through 669b (Title IV-D of the Social Security 
Act, Child Support and Establishment of Paternity), child and family 
services programs operated under 42 U.S.C. 621 through 629m (Title IV-B 
of the Social Security Act), Foster Care and Adoption Assistance 
programs operated under 42 U.S.C. 670 through 679c (Title IV-E of the 
Social Security Act), and assistance programs funded under 42 U.S.C. 
601 through 619 (Title IV-A of the Social Security Act, Temporary 
Assistance for Needy Families).
    (9) Disclosure to the Commissioner of Social Security.
    Pursuant to 42 U.S.C. 653(j)(4), information may be disclosed to 
the Commissioner of Social Security, upon request, for the purpose of 
verifying eligibility for the Social Security Administration's programs 
and the administration of such programs, and for the administration of 
the Ticket to Work program.
    (10) Disclosure to the Secretary of Agriculture for Verification 
Purposes.
    Pursuant to 7 U.S.C. 1981(f), information may be disclosed, upon 
request, to the Secretary of Agriculture for the purpose of verifying 
the employment and income of individuals participating in a rural 
housing program (United States Housing Act of 1949 (42 U.S.C. 1472, 
1474, 1490a, and 1490r)).
    (11) Disclosure to Secretary of Education for Collection of 
Defaulted Student Loans.
    Pursuant to 42 U.S.C. 653(j)(6), the results of a comparison of 
information in this system with information in the custody of the 
Secretary of Education may be disclosed, upon request, to the Secretary 
of Education for the purpose of collection of debts owed on defaulted 
student loans, or refunds on overpayments of grants, made under title 
IV of the Higher Education Act of 1965 (20 U.S.C. 1070 et seq. and 42 
U.S.C. 2751 et seq.).
    (12) Disclosure to Secretary of Housing and Urban Development for 
Verification Purposes.
    Pursuant to 42 U.S.C. 653(j)(7), information regarding an 
individual participating in a housing assistance program (United States 
Housing Act of 1937 (42 U.S.C. 1437 et seq.); 12 U.S.C. 1701s, 1701q, 
1715l(d)(3), 1715l(d)(5), 1715z-1; or 42 U.S.C. 8013) may be disclosed, 
upon request, to the Secretary of Housing and Urban Development for the 
purpose of verifying the employment and income of the individual.
    (13) Disclosure to State Unemployment Compensation Agency for 
Program Purposes.
    Pursuant to 42 U.S.C. 653(j)(8), the employment, address, and 
income records of an individual whose name and SSN are furnished to HHS 
by a state agency administering an unemployment compensation program 
under federal or state law may be disclosed, upon request, to the state 
agency for the purposes of administering the unemployment compensation 
program.
    (14) Disclosure to Secretary of the Treasury for Debt Collection 
Purposes.
    Pursuant to 42 U.S.C. 653(j)(9), information pertaining to a person 
who owes the United States delinquent non-tax debt and whose debt has 
been referred to the Secretary of the Treasury in accordance with 31 
U.S.C. 3711(g) may be disclosed, upon request, to the Secretary of the 
Treasury for purposes of collecting the debt.

[[Page 25630]]

    (15) Disclosure to State Agency for Supplemental Nutrition 
Assistance Program Purposes.
    Pursuant to 42 U.S.C. 653(j)(10), an individual's employment, 
address, and income records may be disclosed, upon request, to a state 
agency responsible for administering a supplemental nutrition 
assistance program under the Food and Nutrition Act of 2008 (7 U.S.C. 
2011 et seq.) for the purposes of administering the program.
    (16) Disclosure to the Secretary of Veterans Affairs for Veteran 
Employment Tracking Purposes.
    Pursuant to 42 U.S.C. 653a(h)(4), information may be disclosed, 
upon request, to the Secretary of Veterans Affairs for the purpose of 
tracking the employment of the individual.
    (17) Disclosure for Law Enforcement Purpose.
    Records may be disclosed, upon request, to the appropriate federal, 
state, local, tribal, or foreign agency responsible for identifying, 
investigating, and prosecuting noncustodial parents who knowingly fail 
to pay their child support obligations and meet the criteria for 
federal prosecution under 18 U.S.C. 228. The records must be relevant 
to the violation of criminal nonsupport, as stated in the Deadbeat 
Parents Punishment Act, 18 U.S.C. 228.
    (18) Disclosure to Department of Justice or in Proceedings.
    Records may be disclosed to the Department of Justice (DOJ) or to a 
court or other adjudicative body in litigation or other proceedings 
when HHS or any of its components, or any employee of HHS in his or her 
official capacity, or any employee of HHS in his or her individual 
capacity where the DOJ or HHS has agreed to represent the employee, or 
the United States, is a party to the proceedings or has an interest in 
the proceedings and, by careful review, HHS determines that the records 
are both relevant and necessary to the proceedings.
    (19) Disclosure to Congressional Office.
    Records may be disclosed to a congressional office in response to a 
written inquiry from the congressional office made at the written 
request of the subject individual.
    (20) Disclosure to Contractor to Perform Duties.
    Records may be disclosed to a contractor performing or working on a 
contract for HHS who has a need for the records in the performance of 
its duties or activities in accordance with law and with the contract.
    (21) Disclosure in the Event of a Security Breach.
    (a) Records may be disclosed to appropriate agencies, entities, and 
persons when (1) HHS suspects or has confirmed that there has been a 
breach of the system of records; (2) HHS has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, HHS (including its information systems, programs, and 
operations), the Federal Government, or national security; and (3) the 
disclosure made to such agencies, entities, and persons is reasonably 
necessary to assist in connection with HHS's efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.
    (b) Records may be disclosed to another federal agency or federal 
entity when HHS determines that records from this system of records are 
reasonably necessary to assist in (1) responding to a suspected or 
confirmed breach; or (2) preventing, minimizing, or remedying the risk 
of harm to individuals, the recipient agency or entity (including its 
information systems, programs, and operations), the Federal Government, 
or national security, resulting from a suspected or confirmed breach.
    In addition to the above routine use disclosures published pursuant 
to the Privacy Act at 5 U.S.C. 552a(b)(3), the Privacy Act permits an 
agency to make other disclosures described at 5 U.S.C. 552a(b) without 
the data subject's consent and without publishing a routine use. Most 
of those standardized disclosures are not, in fact, permissible for 
NDNH data due to restrictions in NDNH's authorizing statute at 42 
U.S.C. 653(l)(1). Notwithstanding the restrictions in the NDNH statute, 
HHS may lawfully disclose NDNH data upon request to the following 
federal agencies without the data subject's consent, as authorized in 5 
U.S.C. 552a(b)(10) and (b)(1), respectively, and required by the 
Comptroller General and Inspector General statutes cited below:
    (a) the Comptroller General under 31 U.S.C. 721; and
    (b) the HHS Inspector General under 5 U.S.C. Appendix 3, section 
6(a)(1).

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records in the NDNH are stored electronically at the Social 
Security Administration's National Support Center and the OCSS Data 
Center. Historical logs and system backups are stored off-site at an 
alternate location.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records maintained in the NDNH are retrieved by the SSN (or TIN) of 
the individual to whom the record pertains. Records collected and 
disseminated from employers and other income sources are retrieved by 
state Federal Information Processing Standard (FIPS) codes and employer 
identification numbers, and records collected and disseminated from 
state IV-D child support enforcement agencies are retrieved by state 
FIPS codes.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records maintained in the NDNH are retained for 24 months after the 
date of entry and then are deleted from the database pursuant to 42 
U.S.C. 653(i)(2)(A) and the National Archives and Records 
Administration (NARA) approved disposition schedule, N1-292-10-2. In 
accordance with 42 U.S.C. 653(i)(2)(B), OCSS will not have access, for 
child support enforcement purposes, to quarterly wage and unemployment 
insurance records in the NDNH if 12 months have elapsed since the 
information was provided by a State Directory of New Hires pursuant to 
42 U.S.C. 653A(g)(2)(B) and there has not been a match resulting from 
the use of such records in any information comparison authorized under 
42 U.S.C. 653(i). Input records for authorized matching to obtain NDNH 
information and records pertaining to income withholding collected and 
disseminated by OCSS are retained for 60 days. Audit logs, including 
information such as employer identification numbers, FIPS code numbers, 
document tracking numbers, case identification numbers and order 
identifier (alternate state case identifier), are retained up to 5 
years.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    The system leverages cloud service providers that maintain an 
authority to operate in accordance with applicable laws, rules, and 
policies, including Federal Risk and Authorization Management Program 
(FedRAMP) requirements. Specific administrative, technical, and 
physical controls are in place to ensure that the records collected and 
maintained in the NDNH are secure from unauthorized access. Access to 
the records is restricted to authorized personnel who are advised of 
the confidentiality of the records and the civil and criminal penalties 
for misuse and who sign a nondisclosure oath to that effect. Personnel 
are provided privacy and security training before being granted access 
to the records and annually thereafter.
    Logical access controls are in place to limit access to the records 
to authorized personnel, to limit their access based on

[[Page 25631]]

their roles, and to prevent browsing. The records are processed and 
stored in a secure environment. All records are stored in an area that 
is always physically safe from unauthorized access. Safeguards conform 
to the HHS Information Security and Privacy Program, which may be found 
at https://www.hhs.gov/ocio/securityprivacy/.

RECORD ACCESS PROCEDURES:
    To request access to a record about you in this system of records, 
submit a written access request to the System Manager. The request must 
include your name, telephone number or email address, current address, 
signature, and sufficient particulars (such as date of birth or SSN) to 
enable the System Manager to distinguish between records on subject 
individuals with the same name. To verify your identity, your signature 
must be notarized, or your request must include your written 
certification that you are the individual who you claim to be and that 
you understand that the knowing and willful request for, or acquisition 
of, a record pertaining to an individual under false pretenses is a 
criminal offense subject to a fine of up to $5,000.

CONTESTING RECORD PROCEDURES:
    To request correction of a record about you in this system of 
records, submit a written amendment request to the System Manager. The 
request must contain the same information required for an access 
request and include verification of your identity in the same manner 
required for an access request. In addition, the request must 
reasonably identify the record and specify the information contested, 
the corrective action sought, and the reasons for requesting the 
correction; it should include supporting information to show how the 
record is inaccurate, incomplete, untimely, or irrelevant.

NOTIFICATION PROCEDURES:
    To find out if this system of records contains a record about you, 
submit a written notification request to the System Manager. The 
request must identify this system of records, contain the same 
information required for an access request, and include verification of 
your identity in the same manner required for an access request.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    87 FR 3553 (Jan. 24, 2022).
[FR Doc. 2024-07668 Filed 4-10-24; 8:45 am]
BILLING CODE 4184-42-P