What the TANF Data System Actually Contains
The subject here is the TANF Data system maintained by the Office of Family Assistance within the Administration for Children and Families. The useful question is not yet who may receive the data under the new routine use; it is what kind of system the modified notice is expanding. By separating the program's reporting relationship, the people covered, the information streams, and the controls around them, we can see why the proposed sharing boundary reaches beyond a single benefits case and beyond a single agency.
The federal-state junction
TANF is organized as a grant program rather than as one centrally administered federal benefits office. The modified Federal Register notice describes states, certain U.S. territories, and Tribal organizations as receiving federal funds and flexibility to develop and run assistance programs. The Office of Family Assistance oversees the block grant, but the grantees make many of the local administrative decisions and collect much of the underlying information.
That division creates a basic two-way relationship. A state or Tribal program determines who receives assistance under its own TANF operation and reports required information to the federal government. ACF receives that information for purposes the notice describes as eligibility oversight, program compliance, reporting to Congress, research, and related administrative work. The federal system is therefore not an independent database assembled from nowhere. It is a repository built from records generated inside programs that are operated by other public entities.
The notice cites 42 U.S.C. 611 as requiring states and 42 U.S.C. 612(h) as requiring federally recognized Tribes administering TANF to collect core data about recipients. Those citations matter for understanding the system's starting point. They show why ACF has a continuing stream of information to maintain and analyze. They do not, by themselves, answer every later question about what additional uses or disclosures the federal government may impose.
This arrangement also explains why the system is a governance junction. A local program may collect information to determine eligibility or deliver cash assistance. Once reported to ACF, the same information can become part of a federal record system used for oversight and research. That change in custody does not automatically change the original purpose of the information, but it makes the federal agency's description of purposes, sources, retrieval, and disclosures consequential for the people and governments that supplied it.
Who falls inside the system
The notice's covered population is wider than “current TANF recipients.” It includes members of families who received assistance in any month and members of families who are no longer receiving assistance. The word family is also defined for reporting purposes rather than limited to the person whose name appears on a payment record. It can include people receiving assistance, noncustodial parents where the rules require their inclusion, parents or caretaker relatives of an assisted child, minor siblings, and people whose income or resources count in deciding eligibility or the amount of assistance.
That scope has a practical consequence: the system can preserve information about a household after assistance ends, and it can contain information about people whose relationship to the benefit is indirect. A former recipient may remain within the category of people covered by the system. A household member may appear because their income or resources affect eligibility even if they are not the person who applies for or receives the grant. A noncustodial parent may be included for a reporting reason that is different from the ordinary picture of a benefits recipient.
Consider a hypothetical household with one adult receiving assistance, a child, another child whose information helps establish the household's composition, and an adult whose income affects eligibility. The notice does not treat those people as interchangeable. Some may be represented in adult-level or child records; some may be represented through family-level information; and the system's definition of the family determines why each record belongs in the reporting picture. This example illustrates the structure described by the notice, not a claim about any particular person's record.
The distinction is important when discussing privacy or data sharing. A narrow description such as “the government has a list of welfare checks” hides the relationships encoded in the system. The notice instead describes a collection that can connect a household's location, size, assistance, identifiers, income, employment, education, and status information. The breadth is a property of the documented categories, not an estimate of how many people or records the system contains.
Two streams, not one
The notice separates data reported by TANF grantees from verification information obtained from other places. That separation is the clearest way to understand the system's interfaces.
The grantee-reported stream begins at the program level. Family-level information can include county of residence, five-digit ZIP Code, household size, type and amount of assistance, and case number. Adult-level information, including information about a minor child who heads a household for reporting purposes, can include a Social Security number, date of birth, citizenship or immigration status, race, employment status, education level, work-activity hours, and income. Child data can include a Social Security number, date of birth, citizenship or immigration status, race, and education level.
These examples serve different administrative functions. Household size and assistance describe the case as a unit. Income, employment, education, and work-activity information describe eligibility or program participation. A date of birth or Social Security number helps identify the person to whom a record belongs. Citizenship or immigration status can be part of the program's eligibility information. The notice presents these as examples, not as a complete technical schema, so it would be misleading to infer that the list captures every field or every local data practice.
The second stream is verification information. Under the modified notice, it may be obtained from the grantee agencies, other HHS records, or other federal or state agencies or entities engaged to assist ACF with program-integrity reviews or projects. The notice gives examples such as Social Security number, date of birth, county of residence, name, address, and detailed immigration-status information, including whether an individual is a refugee, a non-immigrant, has no status, has temporary protected status, or needs additional verification.
The important difference is not simply that the second stream contains sensitive fields. Some of the same identifiers appear in both streams. The difference is that the information can be produced outside the TANF reporting relationship and then brought into the TANF system for a verification purpose. The system thus becomes capable, at least in the notice's description, of holding a program's own report alongside information obtained from another institutional source.
That creates an interface with consequences for decision-making. The grantee is the original reporter of much of the case information. ACF is the federal custodian described in the notice. An outside agency or entity may be a source of verification information or a participant in a program-integrity project. The notice's architecture does not make those actors identical, and it does not say that every source has the same authority, accuracy, or access. Keeping the roles separate prevents a common analytical mistake: treating “in the TANF system” as if it meant “collected directly by TANF administrators” or “available to every partner.”
The interfaces also create a chain of dependencies. Imagine, strictly as an illustration of the documented structure, that a grantee reports a household's case information to ACF and ACF later seeks to verify one person's status using information from another government record system. The first step raises a reporting question: was the original information complete and accurate? The second raises an identity question: does the outside record refer to the same person? The third raises a governance question: is the outside source being used for a purpose and by a recipient covered by the applicable rules? If the verification result is disputed, the person may also need a way to see, correct, or contest the record.
The notice describes pieces of this chain, but it does not answer all of those questions. It gives examples of the data and sources, identifies ACF's system manager, states how records are retrieved, and describes access and amendment procedures. It does not provide a match algorithm, an error rate, an adjudication workflow, or a record of an actual query. The separation between the interfaces is therefore part of the evidence, not a minor technical detail. It tells us where later judgments would have to be made and which actor would own each decision. A grantee's responsibility for reporting does not automatically make it responsible for an outside source's status determination; ACF's custody does not automatically prove that an outside result is accurate; and an outside entity's ability to assist with a project does not, from this description alone, establish unlimited access.
The system's retrieval rules reinforce the interface. The notice says grantee-reported records can be retrieved by Social Security number or case number. Verification information is retrieved by Social Security number. That is an operational fact about how records are located. It shows why an identifier can connect information across record streams, but it does not disclose a matching algorithm, an error threshold, or the result of any particular query.
The diagram shows responsibilities and interfaces, not a complete database design. In particular, “obtained from other sources” does not mean that every outside agency automatically has access, and “reported to ACF” does not mean that a grantee relinquishes every legal or practical interest in how the information is used. Those questions belong to the notice's purpose and routine-use language, and to the legal dispute over whether that language is sufficient.
Custody is not authority
The system model also includes controls. The notice says electronic records are kept in a restricted cloud database or secure files on a restricted network. It describes authorized access using two-factor authentication, encryption, firewalls, and intrusion-detection systems. Personnel, contractors, and grantees with access are expected to preserve confidentiality, sign confidentiality agreements, and receive annual training. Individuals may seek access or amendment, request an accounting of disclosures, and submit sensitive requests through a secure web portal or by mail rather than ordinary email.
Retention adds a time dimension. The notice says data, reports, and tables related to cash-assistance caseloads and characteristics may be cut off at the end of a fiscal year, transferred to the National Archives and Records Administration twenty years after cutoff, and retained permanently because of their research value. Certain administrative supporting documents are described as being destroyed three years after cutoff. These schedules concern different categories and purposes; they should not be simplified into one universal retention period.
Those controls matter, but they answer a different question from the one raised by the modified sharing boundary. Encryption can reduce unauthorized access. An accounting right can make some disclosures more visible. A retention schedule can determine how long a record persists. None of those features, standing alone, decides whether a new purpose fits the agency's statutory authority, whether a particular recipient is permitted, or whether a computer-matching process must satisfy separate requirements.
The same distinction applies to the system's two record streams. Knowing that ACF can retrieve verification information by Social Security number tells us how the notice describes access to the record. It does not tell us that a matching project occurred, that an outside result was accurate, or that a person suffered a particular consequence. Those are implementation and adjudication questions, not properties that can be inferred from the field list.
The baseline is now clear enough to identify what changes in the modified notice. TANF Data is a federal system built from state, territorial, and Tribal reporting; it covers current and former household relationships; it contains identifying, economic, demographic, and status information; and it can include verification information from other sources. The next question is how the notice connects that structure to program-integrity work, a named routine use, and a possible disclosure to an engaged outside entity.