Mass. Gen. Laws ch. 119A § 5A
Before disclosing personal data pursuant to this section, the IV-D agency may require the person or agency requesting such data to verify that such data is required for a purpose permitted by this section and that such data will be used solely for such purpose. The IV-D agency shall limit disclosure to the specific data required by the person or agency to carry out a purpose permitted by this chapter. For the purposes of this chapter, "personal data" shall have the same meaning as provided in section 1 of chapter 66A.
If the IV-D agency is provided with reasonable evidence of a risk of harm, the IV-D agency, its employees and its contractors shall not disclose any personal data that could otherwise be disclosed pursuant to subsection (a) about the location of a parent or child, including residential address, telephone number, and name, address and telephone number of employer, and shall not disclose the social security number of a parent or child; provided, however, that such personal data may be shared by and between employees of the IV-D agency and its contractors; provided further that the IV-D agency may disclose such personal data to the Federal Parent Locator Service, to a court or agent of a court that is authorized to receive information from the Federal Parent Locator Service established pursuant to Title IV, Part D of the Social Security Act, to the department of transitional assistance, to the department of children and families for purposes directly connected with an investigation under section 51B of chapter 119 or proceedings related to termination of parental rights or adoption, to a person authorized to receive such personal data by the parent or, in the case of the child, by the custodial parent or legal guardian of the child; provided further, that the IV-D agency may disclose personal data for purposes directly connected to obtaining health care coverage for a parent or child receiving IV-D services to an employer or provider of health care coverage and to the division of medical assistance.
If the IV-D agency is provided with reasonable evidence of a risk of harm pursuant to this section, the IV-D agency shall notify the Federal Parent Locator Service established pursuant to Title IV, Part D of the Social Security Act that a risk of harm exists. Upon written request by a court or agent of a court authorized to receive information from the Federal Parent Locator Service, the IV-D agency shall release personal data, which may include location information and social security numbers, to such court or agent, as required by said Title IV, Part D of the Social Security Act; provided, however, that if the IV-D agency has been provided with reasonable evidence of a risk of harm, the IV-D agency shall notify the court or agent that the IV-D agency has received such information and that pursuant to section 5B, before making any disclosure of such personal data, the court is required to determine whether such disclosure to any other person could be harmful to the parent or child. A person or agency seeking disclosure of personal data which the IV-D agency is prohibited from disclosing because of a risk of harm, but which could otherwise be disclosed pursuant to subsection (a), may file a petition with the probate and family court pursuant to section 5B to request disclosure of such personal data.
The willful inspection or disclosure of personal data, except as authorized by this section or section 5B, by any employee of the IV-D agency, its contractors, or any person obtaining unauthorized access to such data, including data stored in a computer system or computer files, while such data are in the custody of the commissioner of revenue or in the custody of any employee of the IV-D agency or its contractors is prohibited. Personal data may be inspected, and shared by and between employees of the IV-D agency in the performance of their official duties as provided in this chapter. Authorized employees of the department of revenue may disclose personal data to any employee of a contractor of the IV-D agency to the extent necessary for performance of the contracted duties of the employee. Personal data properly disclosed by employees of the IV-D agency may be inspected and shared by and between employees of a contractor of the IV-D agency in performance of their contracted duties and for the purpose for which such data was disclosed. Any violation of this section by an employee of the IV-D agency, its contractors or an officer, director or employee thereof, a person obtaining unauthorized access to personal data, or any other individual shall be punished by a fine of not more than $1,000 with respect to each person concerning whom information has been disclosed or inspected or by imprisonment for not more than one year, or both, and by disqualification from holding office in the commonwealth for such period, not exceeding three years, as the court determines. The determination by the commissioner of revenue that an employee of the IV-D agency, or the determination by another agency head that an employee of such other agency, has made a disclosure or willful inspection of personal data that was not authorized by this section and not protected by the good faith provision of subsection (d) shall be grounds for dismissal of such employee. A violation, as determined by the commissioner of revenue, of this section by an officer, director or employee of any contractor of the commonwealth shall be grounds for prohibiting such officer, director or employee from working on a contract between the contractor and the commonwealth. A violation, as determined by the commissioner of revenue, of this section by any contractor of the commonwealth, or any officer, director or employee thereof, shall also be cause for terminating any current contract between such contractor and the commonwealth and for prohibiting such contractor from entering into any future contract with the commonwealth.
Mass. Gen. Laws ch. 119A, § 5A