MODULE 3:

Protecting

and

Safeguarding FPLS

and

other

Child Support Information

Training Notes

-   While the primary emphasis of this module is on access to FPLS data,
    the module also deals with all child support data and covers topics
    such as customer service, penalties for misuse of child support
    data, dealing with special cases, and physical precautions that can
    be taken in child support offices to protect the data.

-   Display: Module 3, PowerPoint slide 1

# Protecting and Safeguarding FPLS and other Child Support Information

![](media/image1.wmf)

training notes

-   This module emphasizes that access to FPLS data is governed by
    Sections 453 and 463 of the Social Security Act. These sections
    outline a two-prong test to determine who may have access to FPLS
    data, and for what purposes they may request access to the data. The
    data may be obtained only by authorized users, and then only for
    authorized purposes. Once you have identified an authorized user
    (the who) for an authorized purpose (the why), the [how]{.underline}
    and [what]{.underline} can be determined. The [how]{.underline} is
    almost always that the request for FPLS data must be submitted
    through the State IV-D agency. The [what]{.underline} is associated
    with the type of information that is returned to the requestor based
    on the [who]{.underline} and the [why.]{.underline}

-   It is very important to note the intent of this module is to
    acquaint the participants with §453 and §463 and to emphasize the
    two-prong test. Our intent is to cover the most common requestors
    and reasons to which a child support worker will be exposed. The
    trainer must not fall into the trap of answering participants'
    case-specific questions regarding who constitutes an authorized user
    or what constitutes a valid reason. These questions and the
    interpretation of §453 and §463 can only be addressed by the Policy
    and Planning Division of the Federal Office of Child Support.

-   Display: Module 3, PowerPoint slide 2

-   Discuss learning objectives.

## Module Objectives

The learning objectives for this module are to enable participants to
describe:

-   For the FPLS data, describe:

```{=html}
<!-- -->
```
-   WHO: Identify who is authorized by statute to request information
    from the FPLS

-   WHY: Identify the purposes for which an authorized person may
    request information from the FPLS

-   HOW: Describe how an authorized person may request information from
    the FPLS

-   ![](media/image2.wmf)WHAT: Identify what information is available
    from the FPLS in response to a request from an authorized person for
    an authorized purpose

training notes

-   Display: Module 3, PowerPoint slides 3 and 4

```{=html}
<!-- -->
```
-   Explain the statutory State and federal requirements for
    safeguarding FPLS and other child support information

-   Describe the penalties for unauthorized access to and use of FPLS
    and other child support information

    ![](media/image3.wmf)

-   Discuss some of the confidentiality issues that arise in the context
    of customer service

-   Discuss and list ways to protect child support information

    ![](media/image4.wmf)

TRAINING NOTES

## Introduction

> First, let's talk about security and what it means to the child
> support program. When we talk about security, traditionally, we talk
> about equipment---PC's, printers, and the like. However, we live in an
> era in which the rapid increase in computerized business transactions
> has increased public concern about the security of the personal
> information available to businesses and government.
>
> We have looked at the information that is available, how easy it is to
> access, and how it may affect you. Now, let's explore the safeguards
> against the release of the data.

Training notes

-   Review what the FPLS is:

```{=html}
<!-- -->
```
-   NDNH

-   External locate sources

-   Proactive matching

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 5

## Requests for Information from the FPLS---the Who, Why, How, and What 

![](media/image5.wmf)

The federal government safeguards both the security and privacy of
information contained in the records they access and maintain.

State and local child support agencies are required to understand and
adhere to federal disclosure laws relative to the authorized disclosure
of information.

training notes

-   Display: Module 3, PowerPoint slides 6 and 7

### FPLS Access

Access from the FPLS is a two prong test---Once you determine the Who
and Why then you can move onto the How and What.

-   Who: A request must be from an authorized person and

-   ![](media/image6.wmf)Why: For an authorized purpose

-   How: Requests are made through a State IV-D agency

-   What: The information which is returned is determined by the Who and
    Why

training notes

-   Sections 453 and 463 refer to Sections of the Social Security Act.
    These two pieces of legislation govern access to the FPLS data.

```{=html}
<!-- -->
```
-   You can refer participants to the Appendix, beginning at page 1
    where they will find the text of both Acts.

-   Display: Module 3, PowerPoint slide 8

-   Tell participants that Action Transmittal AT-99-09 in the Appendix,
    page 3, deals with requests for information from the FPLS pursuant
    to Section 453 and 463 requests.

```{=html}
<!-- -->
```
-   ![](media/image8.wmf)Two laws govern requests for information from
    the FPLS:

```{=html}
<!-- -->
```
-   Social Security Act Section 453

-   Social Security Act Section 463

training notes

-   Display: Module 3, PowerPoint slides 9 and 10

```{=html}
<!-- -->
```
-   §453 of the Social Security Act governs requests for child support
    purposes

    ![](media/image9.wmf)

-   §463 of the Social Security Acts governs requests for custody and
    visitation purposes, or in matters of a parental kidnapping

    ![](media/image10.wmf)

training notes

-   We're going to take a look at Section §453 first. It deals with
    access to FPLS information for child support purposes.

-   45 CFR §303.70 deals with requests by the State Parent Locator
    Service (SPLS) for information from the FPLS. Refer to the Appendix,
    page t view 45 CFR §303.70.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 11

## §453 Request---Requests for Child Support Purposes

§453 Request---§453 of the Social Security Act governs requests for
child support purposes

### Who may request FPLS information for a child support purpose?

IV-D agency

A court or an agent of a court with authority over child support matters

The "resident parent" (i.e., custodial parent), legal guardian,
attorney, or agent of a child not receiving TANF

A State foster care or child welfare agency

IV-B and IV-E agencies have access to administer such programs through
requests to the SPLS in accordance with 45 CFR §303.70.

![](media/image11.wmf)

training notes

-   Display: Module 3, PowerPoint slide 12

```{=html}
<!-- -->
```
-   Now that we've looked at the authorized users under Section §453,
    let's look at the authorized purposes.

### For what purposes may an authorized person request FPLS information under §453? For the purpose of:

Establishing parentage

Establishing, setting the amount of, modifying, or enforcing a child
support obligation

> ![](media/image12.wmf)

training notes

-   Now let's look at how the request must be made.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 13. Emphasize the request must
    go through the IV-D agency. Explain that there is an annual
    certification that each State IV-D Director submits to the FPLS.

### If an authorized person is requesting FPLS information for an authorized purpose under §453, how must the request be made?

All requests for information from the FPLS should be sent through the
State Parent Locator Service (SPLS) at the State Child Support Agency
pursuant to 45 CFR §303.70

Annually the State IV-D Directors submit a certification indicating that
all the cases being submitted to FPLS are for a statutorily authorized
purpose and will be safeguarded and treated confidentially

![](media/image13.wmf)

training notes

-   Display: Module 3, PowerPoint slide 14

-   Do not dwell on this. Basically the FPLS will return whatever
    information is available to the requestor.

-   Asset information is currently available from the IRS and provisions
    of the Internal Revenue Code restrict this information to IV-D
    agencies.

-   While the Act provides for debt information, this information is not
    currently being provided.

```{=html}
<!-- -->
```
-   Are there any questions on §453 requests?

```{=html}
<!-- -->
```
-   If there are no questions introduce §463 by saying that it governs
    requests for FPLS information for reasons other than child support.

### What information is available from the FPLS in response to a request under §453?

Location information

SSN

Address

Employer's name, address, and Federal Employer Identification Number
(FEIN)

Wage and employment information

Asset information

![](media/image14.wmf)

training notes

-   Display: Module 3, PowerPoint slide 15 and explain bullet points.

```{=html}
<!-- -->
```
-   Now let's take a look at who is an authorized user under §463.

## §463 request---Request for Custody, Visitation, and Parental Kidnapping Purposes

§463 Request---For purposes of custody and visitation orders, or in a
case of parental kidnapping

![](media/image15.wmf)

training notes

-   Display: Module 3, PowerPoint slide 16 and explain bullet points.

### Who may request FPLS information under §463? 

An agent or attorney of a State who has the authority under the law of
the State to enforce a child custody or visitation determination

A court with jurisdiction to make or enforce a child custody or
visitation determination, or any agent of such court

Any agent or attorney of the United States, or of a State who has the
duty or authority to investigate, enforce, or bring prosecution with
respect to the unlawful taking or restraint of a child (referred to as
parental kidnapping cases)

![](media/image16.wmf)

training notes

-   Now let's see what the authorized purposes are under §463.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 17 and explain the bullet
    points.

### Why may an authorized person request FPLS information under §463? For the purposes of:

Enforcing any State or federal law with respect to the unlawful taking
or restraint of a child

Making or enforcing a child custody or visitation determination

![](media/image17.wmf)

training notes

-   Display: Module 3, PowerPoint slide 18.

```{=html}
<!-- -->
```
-   Notice that it is identical to how requests must be submitted under
    §453.

### If an authorized person is requesting FPLS information under §463, how must the request be made?

All requests for information from FPLS should be sent through the State
Parent Locator Service at the State Child Support Agency pursuant to 45
CFR §303.70

Annually the IV-D Directors submit an annual certification indicating
that all the cases being submitted to FPLS are for a statutorily
authorized purpose and will safeguarded and treated confidentially

![](media/image18.wmf)

training notes

-   Let's look at what data is returned for §463 requests.

```{=html}
<!-- -->
```
-   Display: Module 2, PowerPoint slide 19

### What information is available from the FPLS in response to a request under §463?

Most recent address

Place of employment

![](media/image19.wmf)

training notes

-   Display: Module 2, PowerPoint slide 20. Review the two-prong test.
    Emphasize:

```{=html}
<!-- -->
```
-   The who's and why's cannot be mixed or matched from §453 and §463 to
    create a valid request. For example, a valid [who]{.underline} from
    §453---a child support worker---could not request FPLS data for the
    purpose of enforcing a child custody order---a valid
    [why]{.underline} under §463.

-   §453 and §463 govern access to FPLS data only. However, the
    two-pronged approach is a good rule-of-thumb to keep in mind for
    requests for access to any child support information.

```{=html}
<!-- -->
```
-   It is important at this point to discuss the following point. As
    more and more States automate the integration of FPLS data returned
    from the NDNH and FCR through proactive matching, it will be more
    difficult for the average child support worker to discern the source
    of the data in their cases. For this reason, child support workers
    will need to apply the two-prong test to requests to the case data
    on an ever-increasing basis.

-   Ask if there are any questions regarding access to FPLS data, §453,
    or §463. If not, turn off the overhead projector or projection
    system and set up for the review exercises.

## Summary of Requesting Information from the FPLS

So the "Who, Why, How and What" are critical factors in the determining
who may request FPLS information.

![](media/image20.wmf)

training notes

-   Refer participants to the independent Case Scenario Activity in the
    Appendix, page **.**

-   Allow about 15 minutes to complete this exercise. While the
    participants are completing this exercise, set up for the flannel
    board exercise. See directions on page o the Appendix.

-   Solicit answers from the participants. The correct answers are:

```{=html}
<!-- -->
```
-   \# 1 = No. A police officer is not an authorized person under the
    statute.

-   \# 2 =Yes. §453

-   #3 = Yes. §453

-   #4 = No. A Grandmother is not an authorized person under the
    statute.

-   #5 = No. This is not an authorized purpose for which a social worker
    may request this information under either statute.

-   #6 = No. A private attorney is not an authorized person under
    statute.

## Case Studies

Your trainer will guide you through this exercise designed to test your
knowledge of Sections 453 and 463.

### Independent Activity

When instructed by your trainer, turn to page i the Appendix, for the
Case Scenario Exercise. Read through each scenario and answer the
questions appropriately. When finished, your trainer will review and
discuss the answers.

Take about 15 minutes to complete this exercise independently.

training notes

-   Directions for the flannel board exercise start on page o the
    Appendix.

### Group Activity

Flannel board exercise

Interactive, instructor-led exercise

training notes

-   While §453 and §463 govern access to child support information
    provided by the FPLS, there is a lot of information which is
    acquired through State and local sources.

-   What legislation or rules apply to this information?

```{=html}
<!-- -->
```
-   It might be beneficial to review (ask participants to provide) the
    list of State agencies that provide locate information and what data
    they provide. Note that some agencies have their own laws,
    regulations, and disclosure statements, which govern access to their
    information. Ask participants for some examples.

```{=html}
<!-- -->
```
-   Briefly discuss with participants the laws that govern access to
    their child support information in their individual States. If
    training workers from a specific State, you should research this
    topic prior to the training and provide the necessary information to
    the participants.

## Persons Authorized to Obtain Information for Authorized Purposes---State Requirements

> Child support agencies are required to understand and adhere to
> federal and State disclosure laws relative to the authorized
> disclosure of information.
>
> ![](media/image21.wmf)Each State may have established laws and rules
> which govern the protection of confidential information, who can
> access it, and for what purposes.

training notes

-   Display: Module 3, PowerPoint slide 22

```{=html}
<!-- -->
```
-   So, now we know who, why, how, and what. What happens when we
    violate this and provide information to an unauthorized person?

```{=html}
<!-- -->
```
-   Ask participants to indicate any other penalties for unauthorized
    disclosure.

```{=html}
<!-- -->
```
-   How does your State train employees on security, privacy, and
    confidentiality of data?

## What are the penalties for wrongfully disclosing State-acquired information?

For most child support workers, violation of the rules governing
security would be a civil or criminal offense, resulting in suspension
or loss of employment, the imposition of fines or jail time, and the
potential for personal financial liability.

-   Do you know what penalties you and/or your State would suffer if you
    provided information to inappropriate personnel?

    ![](media/image22.wmf)

training notes

-   On the next page are some examples of State penalties. Ask
    participants if they have other examples or stories they can share
    with the class.

-   Display: Module 3, PowerPoint slide 23

### Examples of State penalties

Any employee or other person who has access to records in an official
capacity and violates the safeguarding provisions commits a misdemeanor.
The offense is punishable by fine, imprisonment, or both.

Failure to comply with the guidelines on confidentiality, or any
unauthorized accessing of tax or child support information, will result
in the imposition of progressive discipline. However, should the
particular facts and circumstances warrant it, discipline for a
first-time violation may begin at a higher level, up to and including
termination.

Any unauthorized disclosure of State or federal tax returns or return
information may subject employees to criminal penalties.

Unauthorized disclosure of child support data is prohibited; any
violation is punishable by a fine of \$1,000 or by imprisonment or both
and by disqualification from holding office in the Commonwealth for such
a period as the court determines, not exceeding three years.

Prohibits disclosure of any information, which was obtained to identify
or locate a NCP, or to evaluate his or her ability to pay support.
Violation of this section is punishable by a fine of \$100 and
administrative disciplinary proceedings.

![](media/image23.wmf)

training notes

-   We've looked at the Federal laws governing FPLS data. What other
    Federal laws or guidelines are States expected to obey with regard
    to all child support information?

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 24 and explain bullet points.

## What the federal government requires of the States 

### Section 454(26) of the Social Security Act

States must have in effect safeguards, applicable to all confidential
information, that are designed to protect the privacy rights of the
parties and should include:

-   Safeguards against unauthorized disclosure of information

-   ![](media/image24.wmf)Prohibitions against the release of
    information on the whereabouts of one party to another against whom
    a protective order has been entered

training notes

-   Display: Module 3, PowerPoint slide 25 and explain bullet points.

```{=html}
<!-- -->
```
-   The Family Violence Indicator (FVI) is set by each State to prohibit
    information from the FPLS be released on cases in which there is
    evidence of family violence. Each State determines if the case
    should have an FVI. If the FVI is in place when the FPLS conducts
    proactive matching, OCSE will send no data back to the State(s). For
    a locate request, the answer from the FPLS will be "Disclosure
    Prohibited---DP Code".

## Family violence indicator

Prohibitions against the release of information on the whereabouts of
one party to another if the State has reason to believe the release may
result in physical or emotional harm to the other party.

-   The Family Violence Indicator (FVI) is a data element that is set in
    the SCR and transmitted to the FCR

-   Federal law forbids the FPLS from disclosing data to any person when
    a State has reasonable evidence of domestic violence or child abuse.

-   State criteria for determining when to use the FVI:

```{=html}
<!-- -->
```
-   Protection Orders

-   Good Cause (TANF)

-   Self Reports

-   Child Abuse Reports/Cases

-   ![](media/image25.wmf)Worker Knowledge

training notes

-   Display: Module 3, PowerPoint slide 26 and explain the bullet
    points.

## Subsection 454A(16) of the Social Security Act

Requires the State IV-D agency to have safeguards in the automated
system ensuring the integrity and accuracy of the data. These safeguards
shall include:

-   Written policies concerning access to data by State agency personnel
    and sharing of data with other persons

-   System controls (such as passwords or blocking of fields) to ensure
    direct adherence to the policies

-   ![](media/image26.wmf)Routine monitoring of access to and use of the
    automated system

Training notes

-   Display: Module 3, PowerPoint slide 27 and explain the bullet
    points.

```{=html}
<!-- -->
```
-   Procedures to ensure that all personnel who may have access to or be
    required to use confidential program data are informed of applicable
    requirements and penalties and are adequately trained in security
    procedures

-   Administrative penalties (up to and including dismissal from
    employment) for unauthorized access to, or disclosure of,
    confidential data

    ![](media/image27.wmf)

training notes

-   Display: Module 3, PowerPoint slide 28

## Disclosure Restrictions

### Release of IRS information 

Internal Revenue Code (IRC 6103(1)(6))

![](media/image29.wmf){width="0.7in" height="0.7in"}

training notes

-   Let's talk about the misuse of data. First, let's define misuse.

```{=html}
<!-- -->
```
-   Go over the definition of misuse as stated on the page.

-   Display: Module 3, PowerPoint slide 29

## misuse of data

### What is misuse? 

Knowingly and willfully requesting or obtaining any information under
false pretenses for unauthorized purposes

![](media/image30.wmf)

training notes

-   How does your State or office handle incidences of misuse of data?

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 30

-   Discuss why the activity---regardless of its seeming innocence---is
    not allowed and could result in harm. Is the activity, although not
    for criminal use, still a violation?

```{=html}
<!-- -->
```
-   Name some other seemingly "innocent" misuses of data.

```{=html}
<!-- -->
```
-   Remind participants that there is no innocent misuse of data.

### Reporting Misuse

Does your State have clear regulations on what constitutes misuse of
data? Reporting requirements?

Does your State have written policies and procedures to follow if
someone is suspected of misusing data? For example, administrative leave
with/without pay, suspension, etc.

State examples:

-   Each person who uses child support related information is
    responsible for reporting violations or suspected violations.

-   Any violations of the federal or State disclosure statutes should be
    referred to the Office of Internal Affairs. (Can be anonymous)

![](media/image31.wmf)

training notes

-   In almost every child support office there are certain "special"
    cases. These include celebrity cases, politicians, IV-D employee
    cases, etc.

```{=html}
<!-- -->
```
-   Ask participants if they have any stories to share regarding
    "special cases."

```{=html}
<!-- -->
```
-   OCSE has access to the Social Security Administration (SSA)
    database. At SSA there are restrictions against employees accessing
    celebrity files. An SSA worker cannot routinely access files on
    celebrities (for example The President, high profile politicians,
    movie stars, etc). An OCSE employee wondered if OCSE had the same
    restrictions about accessing these celebrity files. She remembered
    reading that day in the newspaper that it was former President
    Reagan's seventieth birthday. So she did the calculations and
    figured out his birth date and tried to access his SSA file. The
    access was denied, so the worker just concluded that OCSE was also
    prohibited from accessing the celebrity files. The next day, several
    black cars pulled up to OCSE and the Secret Service came to OCSE
    demanding to see the worker. SSA not only had the celebrity files
    blocked but also knew [exactly]{.underline} who had tried to access
    the file. Needless to say the OCSE worker was in a little bit of hot
    water.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 31

```{=html}
<!-- -->
```
-   What kind of measures does your State take to secure "confidential"
    files?

## What kinds of security measures are in place to prevent employees from reviewing "special" cases?

### Consider keeping cases separate (physically and automatedly secure)

Employees' cases

Domestic violence cases

Celebrity cases

### Example from States:

Counties may establish processes in which specific case records are
worked only by a supervisor or worked manually. Any employee with a
personal interest in a case shall not engage in any child support
enforcement work activity related to that case

Employees are given access only to certain counties and screens. Through
software in the statewide automated system, employees can be prevented
from seeing sensitive cases on the automated system. This is to prevent
access to cases in which an employee has a personal interest

![](media/image32.wmf)

training notes

-   Display: Module 3, PowerPoint slide 32

```{=html}
<!-- -->
```
-   One of the dilemmas that we, as child support workers, face is that
    of balancing customer service with the right to privacy. We want to
    be as helpful to our clients as possible, but we can't disclose more
    than we are allowed. We saw this depicted in our video.

```{=html}
<!-- -->
```
-   The customer service area may not have clear-cut procedures, laws,
    or regulations in many of the newer ways of communication. Ask
    participants for their State procedures. Flip chart for "best
    practices" from each State.

-   Ask participants: Has your office had discussion in this area? Write
    input on flipchart

## Customer Service

How do we balance customer service (the right to know) with privacy and
security?

Customer service is a critical function in the child support program.
Each day, thousands of child support employees across the country access
various data sources in order to serve the needs of the public. However,
if an individual employee violates the privacy of the people served, he
or she jeopardizes the reputation of the child support agency, as well
as destroys the trust of the people we serve.

![](media/image33.wmf)

training notes

-   Display: Module 3, PowerPoint slide 33 and discuss bullet points.

### Phone Contacts

Do you know with whom you are talking? What measures do you take to make
sure it is appropriate to disclose information to the caller?

-   Suggestion: Verify requestor's identity. Ask for unique identifying
    information such as SSN, court case number, IV-D case number and/or
    birth dates for children.

```{=html}
<!-- -->
```
-   Do you know what information is appropriate to disclose to the
    caller?

-   ![](media/image34.wmf)Third party request. Do you know if it is
    appropriate to disclose information to a third party? For example,
    would you release information to the custodial parent's current
    spouse? Mother?

training notes

-   Display: Module 3, PowerPoint slide 34

```{=html}
<!-- -->
```
-   Is your email as a "public" employee archived and available as a
    public document to any requestor?

-   Do you have procedures in place that address what is appropriate to
    send via e-mail? Think about the information you may put in an
    e-mail--- name, social security number, address, and date of birth.
    Is there sufficient information if that email fell into the wrong
    hands that someone could become the victim of identity theft?

### E-mail

![](media/image35.wmf)

-   What information is appropriate to send to a customer via e-mail?
    Who is the recipient or requestor? How do you verify?

-   What kind of information is appropriate to send via "Quick Locate"
    requests from one State to another State? How do you know to whom
    you are talking? How do you know who is receiving the request?

```{=html}
<!-- -->
```
-   [Suggestion]{.underline}: The requestor's identity should be
    verified by a photo ID. In addition, the requestor should specify
    for what purpose the information is requested. Information should
    not be released until the requestor's identity has been verified.

training notes

-   Display: Module 3, PowerPoint slide 35

```{=html}
<!-- -->
```
-   Think about your fax procedures. How many people have access to the
    fax on the receiver's end? Do you verify transmission and receipt?

```{=html}
<!-- -->
```
-   Refer to page i the Appendix: "Warming Up to a Security Blanket; If
    You Think Encryption Isn't Important To You, Think
    Again"---Washington Post

## FACSIMILES

![](media/image36.wmf)What information is appropriate to send to a
customer via facsimile? Do you verify that the facsimile has been
received? How long before it is transmitted and who has access to the
facsimile machine?

training notes

-   Let's talk about what kind of precautions you can take.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 36 and discuss bullet points.

### Precautions

What kind of precautions can you take to ensure you are disclosing
information to the appropriate party?

-   Written waivers

-   Are the terminals open to client access?

-   "PIN" numbers

    ![](media/image37.wmf)

training notes

-   Sometimes IV-A staff has access to the CSE system.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 37 and discuss bullet points.

### IV-A staff 

What kind of training on security and confidentiality of the child
support information have they had?

-   Have they signed a Confidential/Privacy/Security non-disclosure
    document?

-   ![](media/image38.wmf)What about the terminal the IV-A worker
    uses---is the CSE system open to customer scrutiny?

    .

training notes

-   Does your office have an Automated Voice Response (AVR) System?

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 38 and discuss bullet points.

```{=html}
<!-- -->
```
-   Solicit participants to discuss their local AVR systems noting what
    information is given out.

### Automated Voice Response Systems (AVR)

What kind of information does your State's AVR give out?

What security and confidentiality is built into the AVR to avoid
disclosing information to an unauthorized person?

![](media/image39.wmf)

training notes

-   How do you handle requests when the answer is "no way"?

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slide 39 and discuss bullet points.

### Just Say 'No" to Unauthorized Requests for Access to FPLS information

Do not be intimidated. Be firm in denying access to unauthorized
requests for FPLS information

Be courteous and polite and firmly deny requests.

![](media/image40.wmf)If the requestor persists, you can forward to your
supervisor.

training notes

-   Advocacy groups are concerned with privacy issues and are watching
    the child support agencies' broad access to personal data for
    clients and non-clients. We need to take every precaution available
    to ensure that our offices and the child support information
    contained within are not easy targets for misuse, theft, or
    unauthorized access.

```{=html}
<!-- -->
```
-   Display: Module 3, PowerPoint slides 40 and 41

## Physical Precautions

Why is it important to protect child support data?

Think about your office. What might be out in the open and subject to
unauthorized access?

![](media/image41.wmf)

### Data security

Screen savers. Do you have a screen saver on the computer? Is the data
on your screen accessible to anyone in the office, walking by or through
the window?

![](media/image42.wmf)Diskettes. Do you have case information on
diskette? Are your diskettes in an easily accessible place?

training notes

-   Display: Module 3, PowerPoint slide 42 and discuss the bullets.

```{=html}
<!-- -->
```
-   Refer to the Appendix, page , Password Checklist, which provides
    some important information on protection of and setting your
    password such as:

```{=html}
<!-- -->
```
-   *Never let anyone use your password*

-   *Create a password that contains a combination of numbers and
    letters*

-   *Continue to change your password frequently*

```{=html}
<!-- -->
```
-   Refer to the Appendix, page **,** Computer Security Checklist, which
    will provide participants with some helpful information to think
    about in keeping their office and data secure.

-   Remind participants as we discuss protection of child support
    information: this could be **your** personal information we are
    talking about!

```{=html}
<!-- -->
```
-   If the janitor were to walk into your office right now while you are
    in training, what would he have access to? Do you have any files on
    your desk? Computer printouts? NCP or CP data in the trash can?

### Computer Security

How to protect the data

-   Passwords

-   Password Security

-   ![](media/image43.wmf)Screen saver password

training notes

-   Display: Module 3, PowerPoint slide 43 and discuss bullet points.

### Summary

Protecting child support data in the "Information Age" brings about the
need for tighter security and controls.

We have talked about how technology can have a positive and negative
impact on us personally.

We have talked about the child support program and the enviable position
we are in with our resources.

We have talked about who we can give access to and for what purpose.

How does this all fit together? We have access to valuable information
that we are responsible for safeguarding. Data in the wrong hands leads
to identity theft and fraud. Do we want to be responsible for being the
cause of identity theft for an NCP or CP? How about ourselves? Do we
want to lose access to our valuable resources for failing to safeguard
them?

In the next module we will explore ways to safeguard our environment and
protect you, the child support worker.

![](media/image44.wmf)