TN 5 (11-15)

A. Introduction to written consent

The Privacy Act and our disclosure regulations require that we have the prior written consent of an individual before disclosing information about him or her to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.

B. Consent policy

SSA has specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent. We will provide information to a third party based on an individual’s signed consent as long as the consent document meets these requirements. If the consent fails to meet these requirements, we will return it to the third party with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.

1. Form SSA-3288

The Form SSA-3288 (Social Security Administration Consent for Release of Information) is our preferred consent form even though we cannot require individuals to use it. The SSA-3288 meets our regulatory requirements for consent (20 CFR 401.100) and our disclosure policy requirements for disclosing non-tax return information (GN 03305.003D in this section) and tax return information (GN 03305.003E in this section). Although the SSA-3288 meets consent requirements for the disclosure of tax return information, the form SSA 7050-F4 (Request for Social Security Earnings Information) is the preferred form.

2. Fillable version of Form SSA-3288 (07-2013)

The fillable SSA-3288 (07-2013) requires the consenting individual to provide a written signature. If an individual’s signature is by mark “X”, two witnesses to the signing of the individual’s mark “X” must also provide written signatures. Individuals may complete all of the fillable boxes electronically but must download, print, and sign the form before sending the form to us for processing.

Individuals may present a consent document, including the SSA-3288, in person or send it to us by postal mail, facsimile, or electronic mail, as long as the consent meets our requirements and bears a legible signature. Processing offices must use their own judgment to determine whether to accept and process a consent document. Otherwise, the processing office must return the consent document to the requester if it is unclear, bears an unreadable signature, or appears to have been altered.

3. Earlier versions of the SSA-3288

Do not refuse to accept or process an earlier version of the SSA-3288. If there is no reason to question or return an earlier version of the form (the earlier version meets all of our consent document requirements), accept and process it. If you receive an earlier version of the SSA-3288 that does not meet our consent document requirements, return the form to the third party with an explanation of why we cannot honor it and provide a copy of the latest version of the form as a courtesy.

4. Informed consent

When we disclose information based on consent, we must fully understand the specific information an individual is authorizing us to disclose to a third party requester. The consenting individual must also fully understand the specific information he or she is requesting us to disclose in response to a third party request. To ensure that the consenting individual has made an informed consent decision, he or she must specify in the consent document the information, documents, form number, records or category of records, computer data elements or segments, or pieces of information he or she wants us to disclose.

C. Policy for disclosing queries

We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.

D. Consent requirements for non-tax return information

All consent documents must meet each of the seven requirements listed below. If the consent does not meet these requirements, return the consent document to the requester with an explanation of why we cannot honor it. All consent documents, including the Form SSA-3288 must:

1. Specify the name, Social Security Number, and date of birth of the individual who is the subject of the requested record(s);

2. Include a legible signature or mark “X” below the requested information and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005). If signed by mark “X,” two witnesses who do not stand to gain anything from the disclosure must sign the consent and provide their full mailing addresses;

3. Specifically state that SSA may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;

4. Specify the name and address of the person or organization to whom we should send the requested information;

5. Describe the requested record(s) in enough detail for us to locate the record(s);

6. Specify the purpose for which the requester will use the information. This helps us ensure the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and

7. Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If a requester wants us to disclose information on an ongoing basis (each month for 6 months, or quarterly, or annually) using the same consent document, he or she must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4.

   NOTE: The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.

E. Consent requirements for tax return information

The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of SSA record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, IRS regulations require individuals to meet two additional requirements before we disclose tax return information:

1. An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid.

   Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent document in this instance would be form SSA 3288 authorizing the release of medical records and form SSA 7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)

2. We must receive the consent document authorizing the disclosure of tax return information within 120 days from the date the individual signs the consent document to meet the IRS time limitation for receipt.

   Use the fee schedule shown on the SSA-7050-F4 to determine the fee for processing requests for detailed earnings information for non-program purposes. The SSA-7050-F4 advises requesters to send the form, together with the appropriate fee, to the address printed on the form. Do not send an SSA-7050-F4 or other request for detailed earnings information for processing without the appropriate fee, unless the request clearly indicates that the requested earnings information is for a program purpose.

Direct individual requests for summary yearly earnings totals to our online application, “My Social Security” at www.socialsecurity.gov/myaccount. For additional information about requests for earnings and disclosing tax return information, see GN 03320.005A and GN 03320.010B.

F. Signature requirements

We will accept a printed signature if the individual indicates that this is his or her usual signature. In addition, we will accept a mark “X” signature in the presence of two witnesses who do not stand to gain anything by the disclosure. Each witness must sign the consent document and provide his or her full mailing address. FOs offices should use current office procedures for acknowledging receipt of and verifying documents.

For further information concerning who may provide consent, see GN 03305.005.

G. Time limitations for the receipt of consent documents

The following time-frame limitations apply to the receipt of a consent document:

1. General records information - 1 year

We will honor a valid consent document authorizing the disclosure of general records (non-medical, non-tax) information, such as claim file information, if we receive the consent document within 1 year from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 1 year has lapsed from the date of the signature and the date we received the request, do not process the request. Follow these steps:

1. Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired; and

2. Ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information to the third party.

2. Medical records information - 90 days

We will honor a valid consent document, authorizing the disclosure of medical records information, if we receive the consent document within 90 days from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 90 days has lapsed from the date of the signature and the date we received the request, do not process the request. Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired. In your letter, ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information.

NOTE: If a consent includes a request for medical and non-medical records and is received more than 90 days (but less than 1 year) after execution but no medical records exist, honor the document as a valid request and disclose the non-medical record information.

For additional requirements regarding access to and disclosure of medical records information, see GN 03340.035.

3. Tax return information - 120 days

We will honor a valid SSA-7050-F4 (or equivalent) consent document, authorizing the disclosure of tax return information, if we receive the consent document within 120 days from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 120 days has lapsed from the date of the signature and the date we received the request, do not process the request. Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired. In the letter, ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information.

For the specific IRS and SSA requirements for disclosing tax return information, see GN 03305.003E in this section.

H. Acceptable consent documents

We prefer that consenting individuals use the current version of the SSA-3288. However, we will accept equivalent consent documents if they meet all of the consent requirements described in GN 03305.003D and GN 03305.003E in this section, as applicable. For example, we will accept the following types of consent documents that meet the agency’s requirements:

1. All versions of the SSA-3288 are acceptable if they meet all of the consent requirements for disclosure, as applicable. Return any other consent document that does not meet our requirements to the third party with an explanation of why we cannot honor it. If you return an earlier version of the SSA-3288 to the requester because it is not completed correctly, also provide the most current version of the form.

   NOTE: The address and telephone number of the consenting individual are annotated as required fields on the SSA-3288, but they are not mandatory on this form or other consent forms for the consent to be acceptable. This information assists SSA in contacting the consenting individual if there are questions about the form, but if it is missing from the SSA-3288 or other acceptable consent forms, accept the form anyway.

2. Fill-in forms are acceptable only if they meet all of the consent requirements, as applicable;

3. Photocopies and faxed copies of consent documents, including the SSA-3288, are acceptable if they bear the consenting individual’s written signature and do not appear altered or otherwise suspicious (offices must use their own judgment in these instances);

4. A consent document patterned after the SSA-3288 or an imitation copy of the SSA-3288 is acceptable if it contains all of the consent requirements, as applicable;

5. A power of attorney document for the disclosure of non-tax return information is acceptable only when the power of attorney document bears the signature of the consenting individual and contains all of the consent requirements, as applicable;

6. A consent document received within one year from the date of the consenting individual’s signature for non-tax return and non-medical records information is acceptable as described in subsection GN 03305.003D in this section;

7. A consent document that specifies the time frame for which we may disclose information is acceptable. If using the SSA-3288, the consenting individual may indicate specific time frames in the space allotted for the purpose; and

8. A consent document that adequately describes all or any part of the information for release above the consenting individual’s signature is acceptable.

I. Unacceptable consent documents

Consent documents are unacceptable when the following conditions exist:

1. The SSA 3288 is unacceptable if the form number (SSA-3288) or the OMB control number (OMB No. 0960-0566) is missing, or it appears altered or suspicious (offices must use their own judgment in these instances), or it does not meet the consent requirements, as applicable;

2. The SSA-3288 is unacceptable if the list of SSA records information on the form appears altered, replaced, or deleted (offices must use their own judgment in these instances);

3. A consent document is unacceptable if the requested information does not appear above the written signature or mark (X) of the consenting individual. However, we may provide any part of the requested records appearing above the consenting individual’s signature if the consent documents satisfies the rest of the requirements in GN 03305.003D and GN 03305.003E in this section;

4. A consent document is unacceptable if the consenting individual’s (or witnesses’) signature and date of signature, or both are missing, unrecognizable, unclear, illegible, appears traced or otherwise suspicious (offices must use their own judgment in these instances);

5. A consent document is unacceptable if the individual indicates “any and all records,” “my entire file,” “all my records” or similarly worded phrases. All requesters must specifically indicate the form number or title of the specific record or information for disclosure or describe the requested information in enough detail to enable us to locate the requested information. If the consent document specifies certain records or information for disclosure and also indicates “my entire record” or similar wording, disclose only the specific information that was requested;

6. A consent document is unacceptable if the overall general appearance of the document appears suspicious (offices must use their own judgment in these instances); and

7. A consent document is unacceptable if the time frame for disclosing the particular type of information has expired. For the time limitations that apply to the receipt of consent documents, see GN 03305.003G in this section.

If any of these conditions exist, return the consent document to the third party with a written explanation of why we cannot honor it. We will accept a new consent document from the same requester for the same information once we receive a consent that meets our consent requirements in GN 03305.003D or GN 03305.003E in this section, as applicable. For subpoenas and court orders, with or without consent, see GN 03330.015.

J. Disclosing medical records

An individual may submit an SSA-3288 (or equivalent) to request the release of his or her medical records to a third party. However, the Privacy Act and our related disclosure regulations permit us to develop special procedures for the disclosure of medical records, including psychological records, pertaining to an individual.

1. Minor’s medical records

A parent or legal guardian, even when acting on behalf of the minor child, may not consent to disclose his or her medical records to a third party (20 CFR 401.100(d)). For more information, see subsection GN 03305.005C.4.

2. ADAP records

Medical records relating to alcoholism and drug abuse patients (ADAP) are subject to the Public Health Service regulations that require different handling. For processing consent-based requests for ADAP records, see GN 03305.030.

3. HIPAA records

The Health Insurance Portability and Accountability Act (HIPAA) allows a medical health provider to accept an individual’s request for the release of medical evidence and specifically permits authorization to disclose medical information. We can accept a HIPAA-compliant authorization only if it also meets the requirements listed in GN 03305.003D in this section. If a HIPAA authorization does not meet our consent requirements, return it to the requester with an explanation of why we cannot honor it. If you return a request, enclose a current SSA-3288.