The Privacy Act and our disclosure regulations require that we have the prior written consent of an individual before disclosing information about him or her to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.
SSA has specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent. We will provide information to a third party based on an individual’s signed consent as long as the consent document meets these requirements. If the consent fails to meet these requirements, we will return it to the third party with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.
The Form SSA-3288 (Social Security Administration Consent for Release of Information) is our preferred consent form even though we cannot require individuals to use it. The SSA-3288 meets our regulatory requirements for consent (20 CFR 401.100) and our disclosure policy requirements for disclosing non-tax return information (GN 03305.003D in this section). Form SSA 7050-F4 (Request for Social Security Earnings Information) should be used to obtain consent for the disclosure of tax return information.
The fillable SSA-3288 (07-2013) requires the consenting individual to provide a written signature. If an individual’s signature is by mark “X”, two witnesses to the signing of the individual’s mark “X” must also provide written signatures. Individuals may complete all of the fillable boxes electronically but must download, print, and sign the form before sending the form to us for processing. Individuals may present a consent document, including the SSA-3288, in person or send it to us by postal mail, facsimile, or electronic mail, as long as the consent meets our requirements and bears a legible signature. Processing offices must use their own judgment to determine whether to accept and process a consent document. Otherwise, the processing office must return the consent document to the requester if it is unclear, bears an unreadable signature, or appears to have been altered.
Do not refuse to accept or process an earlier version of the SSA-3288. If there is no reason to question or return an earlier version of the form (the earlier version meets all of our consent document requirements), accept and process it. If you receive an earlier version of the SSA-3288 that does not meet our consent document requirements, return the form to the third party with an explanation of why we cannot honor it and provide a copy of the latest version of the form as a courtesy.
When we disclose information based on consent, we must fully understand the specific information an individual is authorizing us to disclose to a third party requester. The consenting individual must also fully understand the specific information they are requesting us to disclose in response to a third party request. To ensure that the consenting individual has made an informed consent decision, they must specify in the consent document the information, documents, form number, records or category of records, computer data elements or segments, or pieces of information they want us to disclose.
We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.
Specify the first and last name, Social Security Number, and date of birth of the individual who is the subject of the requested record(s);
Include a legible signature or mark “X” below the requested information and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005). If signed by mark “X,” two witnesses who do not stand to gain anything from the disclosure must sign the consent and provide their full mailing addresses;
Specifically state that SSA may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;
Specify the first and last name and address of the person or organization to whom we should send the requested information;
Describe the requested record(s) in enough detail for us to locate the record(s);Specify the purpose for which the requester will use the information. This helps us ensure the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and
Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If a requester wants us to disclose information on an ongoing basis (each month for 6 months, or quarterly, or annually) using the same consent document, they must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4. NOTE: The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.
The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of SSA record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, IRS regulations require individuals to meet two additional requirements before we disclose tax return information:
An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid. Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent documents in this instance would be form SSA 3288 authorizing the release of medical records and form SSA 7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)