§ 15-22-4. Personal data - Purposes for which disclosure permitted - Safeguards - Exceptions - Unauthorized inspection or disclosure - Penalties. (a)(1) Personal data collected and maintained by the agency created pursuant to title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq., (subsequently referred to as the IV-D agency) shall not be a public record and access to this data shall be available only to employees of the IV-D agency and/or its contractors, and only to the extent reasonably necessary for the performance of the employees or contractors duties. The IV-D agency may disclose personal data for purposes connected with establishing paternity, establishing, modifying or enforcing child support and medical obligations pursuant to this chapter and title IV, part D of the Social Security Act. The IV-D agency may disclose personal data:

(i) To any state or federal public assistance program or to the IV-D agency of another state for purposes connected with the administration of the program or of the child support enforcement program, as authorized by title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq., and by the secretary of the federal department of health and human services;

(ii) To persons authorized to receive information from the Federal Parent Locator Service established pursuant to title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq.;

(iii) To the director of the department of human services or his or her agent for purposes directly connected with detecting and preventing fraud in any assistance program administered by the department;

(iv) To the department of children, youth and families for purposes directly connected with an investigation or proceedings related to termination of parental rights, adoption, or foster care parental support actions;

(v) To a person authorized in writing by the parent or, in the case of the child, by the custodial parent or legal guardian of the child, to receive personal data;

(vi) For purposes directly connected to obtaining health care coverage for a child receiving services pursuant to title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq., to an employer or provider of health care coverage or to the obligor;

(vii) In the case of personal data about an individual parent, to that parent or, in the case of personal data about the child, to the custodial parent or legal guardian of the child; or

(viii) To any other individual, business or entity for the purposes of administering the child support enforcement program or otherwise provided by federal or state law.

(2) Before disclosing personal data pursuant to this section, the IV-D agency shall require the person or agency requesting the data to verify in writing, in a form provided by child support enforcement that the data is required for a purpose permitted by this section and that the data will be used solely for this purpose. The IV-D agency shall limit disclosure to the specific data required by the person or agency to carry out a purpose permitted by this chapter.

(b)(1) The IV-D agency shall safeguard personal data if the IV-D agency is provided with reasonable evidence of a history of domestic violence. A state agency, court, IV-D agency of another state, obligor, obligee, and any other persons or entities that the IV-D agency may specify may provide the IV-D agency with reasonable evidence of a history of domestic violence in any manner that the IV-D agency may require. The IV-D agency shall continue to safeguard personal data until the time that the individual contacts this agency in writing to advise that his or her personal data need not be safeguarded. For the purposes of this section, a "history of domestic violence" means that an individual has been subjected to:

(i) Physical acts that resulted in, or threatened to result in, physical injury to the individual;

(ii) Sexual abuse;

(iii) Sexual activity involving a dependent child;

(iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities;

(v) Threats of, or attempts at, physical or sexual abuse;

(vi) Mental abuse; or

(vii) Neglect or deprivation of medical care.

(2) If the IV-D agency is provided with reasonable evidence of a history of domestic violence, the IV-D agency, its employees, and its contractors shall indicate this fact to the federal registry and shall not disclose any personal data that could otherwise be disclosed pursuant to subsection (a) of this section about the location of a parent or child, including residential address, telephone number, and name, address and telephone number of employer, and shall not disclose the social security number of a parent or child. However, the IV-D agency may disclose such personal data to:

(i) The Federal Parent Locator Service;

(ii) A court or agency of a court that is authorized to receive information pursuant to court order from the Federal Parent Locator Service established pursuant to title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq.;

(iii) The department of human services;

(iv) The department of children, youth and families for purposes directly connected with an investigation of proceedings related to termination of parental rights, adoption or parental support action; or

(v) A person authorized to receive personal data by the parent or, in the case of the child, by the custodial parent or legal guardian of the child.

(3) The IV-D agency may disclose the social security number of a child receiving IV-D services for purposes directly connected to obtaining health care coverage for the child to an employer or provider of health care coverage.

(4) If the IV-D agency is provided with reasonable evidence of a history of domestic violence pursuant to this section, the IV-D agency shall notify the Federal Parent Locator Service established pursuant to title IV, part D of the Social Security Act, 42 U.S.C. § 651 et seq., that a risk of harm exists. A person or agency seeking disclosure of personal data which the IV-D agency is prohibited from disclosing because of reasonable evidence of a history of domestic violence, but which could otherwise be disclosed pursuant to subsection (a) of this section, may file a petition with the family court pursuant to § 15-22-5 to request disclosure of the personal data. Upon written request by a court or agent of a court authorized to receive information from the Federal Parent Locator Service, the IV-D agency shall release personal data, which may include location information and social security numbers, to the court or agent, as required by title IV, part D of the Social Security Act; provided, that if the IV-D agency has been provided with reasonable evidence of a history of domestic violence, the IV-D agency shall notify the court or agent that the IV-D agency has received this information and that, pursuant to section (b) of this section, before the IV-D agency may make any disclosure of personal data under this section, the court is required to determine whether the disclosure to any other person could be harmful to the parent or child and issue a court order to that effect.

(c)(1) The IV-D agency shall have in effect safeguards to ensure the integrity, accuracy, and completeness of, access to, and use of data, including personal data and data in the automated system which shall include:

(i) Written policies concerning access to data by IV-D agency personnel and its contractors, and sharing of data with other individuals, businesses, or entities, which permit access to and use of data only to the extent necessary to carry out the purposes of the child support enforcement program and which specify the data which may be used for particular program purpose, and the personnel permitted access to the data;

(ii) Systems controls to ensure strict adherence to the policies;

(iii) Routine monitoring of access to and use of the automated system, through methods such as audit trails, to guard against and promptly identify unauthorized access or use;

(iv) Procedures to ensure that all personnel, including employees of the IV-D agency and its contractors, who may have or had access to or who may be or were required to use confidential program data and personal data, are informed of applicable requirements and penalties, including those in this section, § 6103 of the Internal Revenue Code of 1986, 26 U.S.C. § 6103, and are adequately trained in security procedures;

(v) Penalties, as provided in this section, for willful inspection or disclosure of, or unauthorized access to, personal data; and

(vi) Any other safeguards that the commissioner of revenue and the secretary of the federal department of health and human services may specify in regulations.

(2) The willful inspection or disclosure of personal data, except as authorized by subsection (b) of this section, by any employee of the IV-D agency, its contractors, or any person obtaining unauthorized access to the data, including data stored in a computer system or computer files, while the data is in the custody of the division of taxation, child support enforcement, or in the custody of any employee of the IV-D agency or its contractors, is prohibited. Personal data may be inspected and shared by and between employees of the IV-D agency in the performance of their official duties as provided in this chapter. Authorized employees of the division of taxation, child support enforcement, may disclose personal data to any employee of a contractor of the IV-D agency to the extent necessary for performance of the contracted duties of the employee. Any violation of this section by an employee of the IV-D agency, its contractors or an officer, director or employee of its contractors, a person obtaining unauthorized access to personal data, or any other individual shall be punished by a fine of not more than one thousand dollars ($1,000), or by imprisonment for not more than six (6) months, or both, with respect to each person concerning whom information has been disclosed or inspected. The determination by child support enforcement that an employee of the IV-D agency, or the determination of another agency head that an employee of any other agency, has made a disclosure or willful inspection of personal data that was not authorized by this section and not protected by the good faith provision of subsection (d) of this section shall be grounds for dismissal of that employee. A violation, as determined by child support enforcement, of this section by an officer, director, or employee of any contractor of the state, or any officer, director or employee of the state, shall also be cause for terminating any current contract between that contractor and the state and for prohibiting that contractor from entering into any future contract with the state.

(d) Any unauthorized disclosure or unauthorized inspection made in a good faith effort to comply with this section shall not be considered a violation of this section.

History of Section. (P.L. 2000, ch. 149, § 1; P.L. 2000, ch. 272, § 1.)