§310.15. What are the safeguards and processes that comprehensive Tribal IV-D agencies must have in place to ensure the security and privacy of Computerized Tribal IV-D Systems and Office Automation?
45 C.F.R. § 310.15
Information integrity and security. The comprehensive Tribal IV-D agency must have safeguards on the integrity, accuracy, completeness, access to, and use of data in the Computerized Tribal IV-D System and Office Automation. Computerized Tribal IV-D Systems and Office Automation should be compliant with the Federal Information Security Management Act, and the Privacy Act. The required safeguards must include written policies and procedures concerning the following:
Periodic evaluations of the system for risk of security and privacy breaches;
Procedures to allow Tribal IV-D personnel controlled access and use of IV-D data, including—
Specifying the data which may be used for particular IV-D program purposes, and the personnel permitted access to such data;
Permitting access to and use of data for the purpose of exchanging information with State and Tribal agencies administering programs under titles IV-A, IV-E and XIX of the Act to the extent necessary to carry out the comprehensive Tribal IV-D agency's responsibilities with respect to such programs;
Maintenance and control of application software program data;
Mechanisms to back-up and otherwise protect hardware, software, documents, and other communications; and,
Mechanisms to report breaches or suspected breaches of personally identifiable information to the Department of Homeland Security, and to respond to those breaches.
Monitoring of access. The comprehensive Tribal IV-D agency must monitor routine access to and use of the Computerized Tribal IV-D System and Office Automation through methods such as audit trails and feedback mechanisms to guard against, and promptly identify, unauthorized access or use;
Training and information. The comprehensive Tribal IV-D agency must have procedures to ensure that all personnel, including Tribal IV-D staff and contractors, who may have access to or be required to use confidential program data in the Computerized Tribal IV-D System and Office Automation are adequately trained in security procedures.
Penalties. The comprehensive Tribal IV-D agency must have administrative penalties, including dismissal from employment, for unauthorized access to, disclosure or use of confidential information.
Notes, amendments, and revision history
Authority
Authority: 42 U.S.C. 655(f) and 1302.
Source
Source: 75 FR 8520, Feb. 25, 2010, unless otherwise noted.