Secure, Accessible, and Lawful Are Different Properties
The TANF Data system illustrates a distinction that public arguments often blur: a record can be securely stored, retrievable by authorized users, and subject to access rights while the legality of a new purpose or recipient remains disputed. This chapter applies that distinction to the safeguards, retention rules, and accountability procedures in the modified SORN. The goal is a TANF-specific judgment about what the controls do, what they cannot do, and what evidence is still needed before a stronger conclusion about sharing is warranted.
What the notice says is protected
The modified Federal Register notice describes electronic TANF records as stored in a restricted cloud database or in secure files on a restricted computer network. It says access is limited to authorized users through log-in controls and two-factor authentication, supported by encryption, firewalls, and intrusion-detection systems. In plain terms, the notice describes layers intended to keep an unauthorized person from reaching the records and to limit access to people who are approved to use the system.
The notice also assigns duties to people who handle the information. Agency personnel, contractors, and grantees with access must maintain confidentiality, keep case records in a safe environment, sign confidentiality agreements, and receive annual training on records management, cybersecurity, privacy, and client confidentiality. The stated controls are not limited to the central database; they extend to the institutions and workers who handle records as part of TANF administration or related activities.
Individuals have several stated routes for exercising control over records about them. They may request access, ask to amend information they believe is inaccurate or incomplete, and request an accounting of disclosures. The notice directs people to use a secure web portal or mail for sensitive requests and says ordinary email is not sufficiently secure for transmitting sensitive information. These procedures do not promise that every dispute will be resolved in the requester's favor. They create ways to ask what the system contains, challenge a record, and seek visibility into disclosures.
Retention makes the protection question more complicated. The notice says records related to cash-assistance caseloads, work participation, and caseload characteristics are cut off at the end of a fiscal year and transferred to the National Archives and Records Administration twenty years after cutoff for permanent retention because of their research value. It separately says certain administrative supporting documents for match reports and submitted program reports are destroyed three years after cutoff. The two schedules apply to different categories; there is no single “TANF data retention period” that describes everything.
Permanent preservation can serve accountability and research. It can also mean that information remains part of the institutional record long after a person has stopped receiving assistance. The notice's covered population already includes former recipients and relevant household members, so the time dimension matters to the same boundary question as the sharing rule. A record can leave active program administration without disappearing from the federal system.
These controls establish a meaningful custody model. They show how the agency says it protects information at rest, limits access, supports individual requests, and manages persistence. They do not independently verify that every control works as described.