PUBLIC LAW 104-193—AUG. 22, 1996 110 STAT. 2235 (2) AUTOMATED DATA PROCESSING. —Part D of title IV (42 U.S.C. 651-669) is amended by inserting after section 454 the following new section: "SEC.454A. AUTOMATED DATA PROCESSING. 42 USC 654a. "(a) IN GENERAL.—In order for a State to meet the requirements of this section, the State agency administering the State program under this part shall have in operation a single statewide automated data processing and information retrieval system which has the capability to perform the tasks specified in this section with the frequency and in the manner required by or under this part. "(b) PROGRAM MANAGEMENT.— The automated system required by this section shall perform such functions as the Secretary may specify relating to management of the State program under this part, including— "(1) controlling and accounting for use of Federal, State, and local funds in carrying out the program; and "(2) maintaining the data necessary to meet Federal reporting requirements under this part on a timely basis. "(c) CALCULATION OF PERFORMANCE INDICATORS.— In order to enable the Secretary to determine the incentive payments and penalty adjustments required by sections 452(g) and 458, the State agency shall— "(1) use the automated system— "(A) to maintain the requisite data on State performance with respect to paternity establishment and child support enforcement in the State; and "(B) to calculate the paternity establishment percentage for the State for each fiscal year; and "(2) have in place systems controls to ensure the completeness and reliability of, and ready access to, the data described in paragraph (1)(A), and the accuracy of the calculations described in paragraph (1)(B). "(d) INFORMATION INTEGRITY AND SECURITY.— The State agency shall have in effect safeguards on the integrity, accuracy, and completeness of, access to, and use of data in the automated system required by this section, which shall include the following (in addition to such other safeguards as the Secretary may specify in regulations): "(1) POLICIES RESTRICTING ACCESS.— Written poHcies concerning access to data by State agency personnel, and shar- ' ing of data with other persons, which— "(A) permit access to and use of data only to the extent necessary to carry out the State program under this part; and "(B) specify the data which may be used for particular program purposes, and the personnel permitted access to such data. "(2) SYSTEMS CONTROLS.—Systems controls (such as passwords or blocking of fields) to ensure strict adherence to the policies described in paragraph (1). "(3) MONITORING OF ACCESS.—Routine monitoring of access to and use of the automated system, through methods such as audit trails and feedback mechanisms, to guard against and promptly identify unauthorized access or use. "(4) TRAINING AND INFORMATION.— Procedures to ensure that all personnel (including State and local agency staff and
�
