303.21—Safeguarding and disclosure of confidential information.
(a) Definitions—
(1)
Confidential information means any information relating to a specified individual or an individual who can be identified by reference to one or more factors specific to him or her, including but not limited to the individual's Social Security number, residential and mailing addresses, employment information, and financial information.
(2)
Independent verification is the process of acquiring and confirming confidential information through the use of a second source. The information from the second source, which verifies the information about NDNH or FCR data, may be released to those authorized to inspect and use the information as authorized under the regulations or the Act.
(b) Scope.
The requirements of this section apply to the IV-D agency, any other State or local agency or official to whom the IV-D agency delegates any of the functions of the IV-D program, any official with whom a cooperative agreement as described in § 302.34 of this part has been entered into, and any person or private agency from whom the IV-D agency has purchased services pursuant to § 304.22 of this chapter.
(c) General rule.
Except as authorized by the Act and implementing regulations, an entity described in paragraph (b) of this section may not disclose any confidential information, obtained in connection with the performance of IV-D functions, outside the administration of the IV-D program.
(d) Authorized disclosures.
(1)
Upon request, the IV-D agency may, to the extent that it does not interfere with the IV-D agency meeting its own obligations and subject to such requirements as the Office may prescribe, disclose confidential information to State agencies as necessary to carry out State agency functions under plans or programs under title IV (including tribal programs under title IV) and titles XIX, or XXI of the Act, including:
(i)
Any investigation, prosecution or criminal or civil proceeding conducted in connection with the administration of any such plan or program; and
(ii)
Information on known or suspected instances of physical or mental injury, sexual abuse or exploitation, or negligent treatment or maltreatment of a child under circumstances which indicate that the child's health or welfare is threatened.
(2)
Upon request, the IV-D agency may disclose information in the SDNH, pursuant to sections 453A and 1137 of the Act for purposes of income and eligibility verification.
(3)
Authorized disclosures under paragraph (d)(1) and (2) of this section shall not include confidential information from the National Directory of New Hires or the Federal Case Registry, unless authorized under § 307.13 of this Chapter or unless it is independently verified information. No financial institution data match information may be disclosed outside the administration of the IV-D program and no IRS information may be disclosed, unless independently verified or otherwise authorized in Federal statute. States must have safeguards in place as specified in section 454A(d) and (f) of the Act.
(e) Safeguards.
In addition to, and not in lieu of, the safeguards described in § 307.13 of this chapter, which governs computerized support enforcement systems, the IV-D agency shall establish appropriate safeguards to comply with the provisions of this section. These safeguards shall also include prohibitions against the release of information when the State has reasonable evidence of domestic violence or child abuse against a party or a child and that the disclosure of such information could be harmful to the party or the child, as required by section 454(26) of the Act, and shall include use of the family violence indicator required under § 307.11(f)(1)(x) of this chapter.
(f) Penalties for unauthorized disclosure.
Any disclosure or use of confidential information in violation of the Act and implementing regulations shall be subject to any State and Federal statutes that impose legal sanctions for such disclosure.
[73 FR 56444, Sept. 26, 2008]