Privacy and Security Law Blog : Privacy & Security Law Blog : Davis Wright Tremaine LLP : Seattle, Los Angeles, Washington D.C., New York, San Francisco, Shanghai, Portland and Anchorage Law Firm

The NPRM "prescribe[s] requirements for: State Parent Locator Service responses to authorized location requests; and State IV-D agency safeguarding of confidential information and authorized disclosures of this information. The proposed rule would restrict the use of confidential data and information to child support purposes, with exceptions for certain disclosures permitted by statute." HHS has proposed these rules because "[c]urrent Federal regulations governing the IV-D program offer minimal guidance on the role of the State PLS." Although the current regulations address the circumstances in which State PLS can obtain information from the Federal PLS, it "is silent about information obtained by the State PLS from State sources."

HHS has proposed changes to 45 C.F.R. ㋔ 302.35 ("State Parent Locator Service") to clarify "that the State may use the State PLS for locating either parent for IV-D purposes." It also prohibits State PLS from accessing "IRS information or financial institution data match information" in non-IV-D requests, and specifies that "[t]he State PLS would be used only in conjunction with a request for information from the Federal PLS in non-IV-D requests." The proposed changes would also address from whom State PLS will accept locate requests.

The Groups have asked HHS to consider adding a subsection to ㋔ 302.35 to require State PLS to maintain audit logs of State employees who access the PLS database. The Groups' suggestion is based on part on a report from United States Attorneys' Office for the Western District of Missouri that an employee with Missouri's Center for Medicaid Services, who was moonlighting as a prostitute, was using her access to LexisNexis to confirm that none of her Johns were police officers.

HHS has also proposed adding a new 45 C.F.R. ㋔ 303.21 to address the following questions:

�? What information is covered by the safeguarding requirements?

�? Who is subject to the regulations?

�? What general rule applies to the information and the agencies and entities subject to the regulations?

�? What exceptions are there?

�? What safeguards are required?

�? What penalties apply if the regulation is violated?

The NPRM also addresses 45 C.F.R. ㋔ 307.13 ("Security and Confidentiality of Computerized Support Enforcement Systems in Operation After October 1, 1997"). The changes would address the authority of State IV-D agencies to share information with other title IV programs and the State Children's Health Insurance Program, as well as requiring "written policies that permit disclosure of noncustodial parent names, addresses, telephone numbers and identifying IV-A case numbers to Workforce Investment Boards . . . that receive welfare-to-work grants . . . ."

The Groups have suggested that HHS include heightened standards for State agencies to verify the accuracy of the data they receive from commercial data brokers. The Groups made this suggestion in response to studies showing that demographic data provided by commercial data brokers are often inaccurate, and an ABC7 News report in San Francisco that a San Mateo man has been mistakenly identified as a "deadbeat dad" four times over seven year period. The Groups also "strongly urge [HHS] to disclose to the public what tools and data sources are going to be employed to locate individuals. [The Groups] suggest that these tools and data sources be disclosed in the Federal Register, giving individuals time to comment on the accuracy and reliability of tools used."