(a) Allowable computerized support enforcement systems for a Comprehensive Tribal IV-D agency. A comprehensive Tribal IV-D agency may have in effect an operational computerized support enforcement system that meets Federal requirements under this part.

(b) Computerized Tribal IV-D Systems. A Computerized Tribal IV-D System must be one of the design options listed below. A comprehensive Tribal IV-D program may automate its case processing and recordkeeping processes through:

(1) Installation, operation, maintenance, or enhancement of the Model Tribal IV-D System designed by OCSE to address the program requirements defined in a Tribal IV-D plan in accordance with § 309.65(a) of this chapter and the functional requirements in § 310.10 of this part;

(2) Establishment of Intergovernmental Service Agreements with a State or another comprehensive Tribal IV-D agency for access to that agency's existing automated data processing computer system to support comprehensive Tribal IV-D program operations.

(c) Office Automation. A comprehensive Tribal IV-D agency may opt to conduct automated data processing and recordkeeping activities through Office Automation. Allowable activities under this paragraph include procurement, installation, operation and maintenance of essential Office Automation capability as defined in § 310.1 of this part.

(d) Alternative to Computerized Tribal IV-D Systems and Office Automation. A comprehensive Tribal IV-D agency may design, develop, procure, or enhance an automated data processing system funded entirely with Tribal funds.

A Model Tribal IV-D System must:

(a) Accept, maintain and process the actions in the support collection and paternity determination processes under the Tribal IV-D plan, including:

(1) Identifying information such as Social Security numbers, names, dates of birth, home addresses and mailing addresses (including postal zip codes) on individuals against whom paternity and support obligations are sought to be established or enforced and on individuals to whom support obligations are owed, and other data as may be requested by OCSE;

(2) Verifying information on individuals referred to in paragraph (a)(1) of this section with Tribal, Federal, State and local agencies, both intra-tribal and intergovernmental;

(3) Maintaining information pertaining to:

(i) Applications and referrals for Tribal IV-D services, including:

(A) Case record;

(B) Referral to the appropriate processing unit (i.e., locate or paternity establishment);

(C) Caseworker notification;

(D) Case Identification Number; and

(E) Participant Identification Number;

(ii) Delinquency and enforcement activities;

(iii) Intra-tribal, intergovernmental, and Federal location of the putative father and noncustodial parents;

(iv) The establishment of paternity;

(v) The establishment of support obligations;

(vi) The payment and status of current support obligations;

(vii) The payment and status of arrearage accounts;

(4) Maintaining data on case actions administered by both the initiating and responding jurisdictions in intergovernmental cases;

(b) Update, maintain and manage all IV-D cases under the Tribal IV-D plan from initial application or referral through collection and enforcement, including any events, transactions, or actions taken therein;

(c) Record and report any fees collected, either directly or by interfacing with State or Tribal financial management and expenditure information;

(d) Distribute current support and arrearage collections in accordance with Federal regulations at § 309.115 of this chapter and Tribal laws;

(e) Maintain, process and monitor accounts receivable on all amounts owed, collected, and distributed with regard to:

(1) Detailed payment histories that include the following:

(i) Amount of each payment;

(ii) Date of each collection;

(iii) Method of payment;

(iv) Distribution of payments; and

(v) Date of each disbursement;

(2) Automated income withholding activities such as:

(i) Recording and maintaining any date the noncustodial parent defaults on payment of the support obligation in an amount equal to the support payable for one month;

(ii) Generating the Standard Federal Income Withholding Form; and

(iii) Allocating amounts received by income withholding according to §§ 309.110 and 309.115 of this chapter.

(f) Maintain and automatically generate data necessary to meet Federal reporting requirements on a timely basis as prescribed by OCSE. At a minimum this must include:

(1) Yearly notices on support collected, which are itemized by month of collection and provided to families receiving services under the comprehensive Tribal IV-D program as required in § 309.75(c) of this chapter, to all case participants regarding support collections; and

(2) Reports submitted to OCSE for program monitoring and program performance as required in § 309.170 of this chapter;

(g) Provide automated processes to enable OCSE to monitor Tribal IV-D program operations and to assess program performance through the audit of financial and statistical data maintained by the system; and

(h) Provide security to prevent unauthorized access to, or use of, the data in the system as detailed in § 310.15 of this part.

(a) Information integrity and security. The comprehensive Tribal IV-D agency must have safeguards on the integrity, accuracy, completeness, access to, and use of data in the Computerized Tribal IV-D System and Office Automation. Computerized Tribal IV-D Systems and Office Automation should be compliant with the Federal Information Security Management Act, and the Privacy Act. The required safeguards must include written policies and procedures concerning the following:

(1) Periodic evaluations of the system for risk of security and privacy breaches;

(2) Procedures to allow Tribal IV-D personnel controlled access and use of IV-D data, including:

(i) Specifying the data which may be used for particular IV-D program purposes, and the personnel permitted access to such data;

(ii) Permitting access to and use of data for the purpose of exchanging information with State and Tribal agencies administering programs under titles IV-A, IV-E and XIX of the Act to the extent necessary to carry out the comprehensive Tribal IV-D agency's responsibilities with respect to such programs;

(3) Maintenance and control of application software program data;

(4) Mechanisms to back-up and otherwise protect hardware, software, documents, and other communications; and,

(5) Mechanisms to report breaches or suspected breaches of personally identifiable information to the Department of Homeland Security, and to respond to those breaches.

(b) Monitoring of access. The comprehensive Tribal IV-D agency must monitor routine access to and use of the Computerized Tribal IV-D System and Office Automation through methods such as audit trails and feedback mechanisms to guard against, and promptly identify, unauthorized access or use;

(c) Training and information. The comprehensive Tribal IV-D agency must have procedures to ensure that all personnel, including Tribal IV-D staff and contractors, who may have access to or be required to use confidential program data in the Computerized Tribal IV-D System and Office Automation are adequately trained in security procedures.

(d) Penalties. The comprehensive Tribal IV-D agency must have administrative penalties, including dismissal from employment, for unauthorized access to, disclosure or use of confidential information.