{"data":{"id":"us/45-cfr-310.15","jurisdiction":"us","citation":"45 CFR 310.15","heading":"What are the safeguards and processes that comprehensive Tribal IV-D agencies must have in place to ensure the security and privacy of Computerized Tribal IV-D Systems and Office Automation?","body":"(a) Information integrity and security. The comprehensive Tribal IV-D agency must have safeguards on the integrity, accuracy, completeness, access to, and use of data in the Computerized Tribal IV-D System and Office Automation. Computerized Tribal IV-D Systems and Office Automation should be compliant with the Federal Information Security Management Act, and the Privacy Act. The required safeguards must include written policies and procedures concerning the following:\n(1) Periodic evaluations of the system for risk of security and privacy breaches;\n(2) Procedures to allow Tribal IV-D personnel controlled access and use of IV-D data, including:\n(i) Specifying the data which may be used for particular IV-D program purposes, and the personnel permitted access to such data;\n(ii) Permitting access to and use of data for the purpose of exchanging information with State and Tribal agencies administering programs under titles IV-A, IV-E and XIX of the Act to the extent necessary to carry out the comprehensive Tribal IV-D agency's responsibilities with respect to such programs;\n(3) Maintenance and control of application software program data;\n(4) Mechanisms to back-up and otherwise protect hardware, software, documents, and other communications; and,\n(5) Mechanisms to report breaches or suspected breaches of personally identifiable information to the Department of Homeland Security, and to respond to those breaches.\n(b) Monitoring of access. The comprehensive Tribal IV-D agency must monitor routine access to and use of the Computerized Tribal IV-D System and Office Automation through methods such as audit trails and feedback mechanisms to guard against, and promptly identify, unauthorized access or use;\n(c) Training and information. The comprehensive Tribal IV-D agency must have procedures to ensure that all personnel, including Tribal IV-D staff and contractors, who may have access to or be required to use confidential program data in the Computerized Tribal IV-D System and Office Automation are adequately trained in security procedures.\n(d) Penalties. The comprehensive Tribal IV-D agency must have administrative penalties, including dismissal from employment, for unauthorized access to, disclosure or use of confidential information.","path":["Title 45—Public Welfare","Subtitle B—Regulations Relating to Public Welfare","CHAPTER III—OFFICE OF CHILD SUPPORT SERVICES, ADMINISTRATION OF FAMILIES AND SERVICES, DEPARTMENT OF HEALTH AND HUMAN SERVICES","PART 310—COMPUTERIZED TRIBAL IV-D SYSTEMS AND OFFICE AUTOMATION","Subpart B—Requirements for Computerized Tribal IV-D Systems and Office Automation"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-45.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:26:21Z","sha256":"168671c2bef172ae47092539751b7d4c92af0c378e684af1c5e6db8c8cac7acd","source_id":"us-cfr","stale":true,"prev":"us/45-cfr-310.10","next":"us/45-cfr-310.20"},"notice":"GroundRules: Original legal text. Not legal advice."}