TN 15 (10-24)

GN 03305.003 Consent Documents

A. Introduction to written consent

The Privacy Act and our disclosure regulations require that we have the written consent of an individual before disclosing information about them to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.

B. Consent policy

We have specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent to disclose agency records. We will provide an individual's information to a third party based on the individual’s written, signed consent as long as it meets these requirements. If the consent fails to meet these requirements, we will return it to the requester with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.

1. Preferred Consent Forms

The Form SSA-3288 (Social Security Administration Consent for Release of Information) or the SSA-3288-OP1 (Consent for Disclosure of Records Protected Under the Privacy Act) are our preferred consent forms for program records requests even though we cannot require individuals to use them. The SSA-3288 is available in both paper and electronic fillable formats but must be wet signed; while the SSA-3288-OP1 is signed and submitted electronically on our website, www.ssa.gov/privacy. These forms meet our regulatory requirements for consent (20 CFR 401.100) and our disclosure policy requirements for disclosing non-tax return information (GN 03305.003D in this section).

Form SSA-7050-F4 (Request for Social Security Earnings Information) should be used to obtain consent for the disclosure of tax return information. Other tax information consent forms must be approved by the Office of the General Counsel.

2. Fillable version of Form SSA-3288 (07-2013)

The fillable SSA-3288 (07-2013) requires the consenting individual to provide a wet signature. If an individual’s signature is by mark “X”, two witnesses to the signing of the individual’s mark “X” must also provide wet signatures. Individuals may complete all of the fillable boxes electronically but must download, print, and wet sign the form before sending the form to us for processing.

Individuals may present a written consent document, including the SSA-3288, in person or send it to us by postal mail, facsimile, or approved electronic means, as long as the consent meets our requirements and bears a legible signature. Processing offices must use their own judgment to determine whether to accept and process a consent document. Otherwise, the processing office must return the consent document to the requester if it is unclear, bears an unreadable signature, or appears to have been altered.

3. Earlier versions of the SSA-3288

Do not refuse to accept or process an earlier version of the SSA-3288. If there is no reason to question or return an earlier version of the form (the earlier version meets all of our consent document requirements), accept and process it. If you receive an earlier version of the SSA-3288 that does not meet our consent document requirements, return the form to the requester with an explanation of why we cannot honor it and provide a copy of the latest version of the form as a courtesy.

4. Form SSA-3288-OP1

We will also accept Form SSA-3288-OP1 (Consent for Disclosure of Records Protected Under the Privacy Act) as an individual’s written electronic consent. Form SSA-3288-OP1 must be completed and signed electronically on SSA’s website. See GN 03305.003D in this section for more information on electronic signatures.

5. Informed consent

When we disclose information based on written consent, we must fully understand the specific information an individual is authorizing us to disclose to a third-party recipient. The consenting individual must also fully understand the specific information they are requesting us to disclose. To ensure that the consenting individual has made a decision with informed consent, they must specify in the consent document the information, documents, form number, records or category of records, computer data elements or segments, or pieces of information they want us to disclose.

C. Policy for disclosing queries

We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.

D. Consent requirements for non-tax return information

All consent documents must meet each of the eight requirements listed below. If the consent does not meet these requirements, return the consent document to the requester with an explanation of why we cannot honor it. All consent documents, including the Form SSA-3288 and Form SSA-3288-OP1, must:

  1. 1. 

    Specify the first and last name, Social Security number, and date of birth of the individual who is the subject of the requested record(s);

  2. 2. 

    Include a legible signature or mark “X” for paper consent documents. A legible signature is one that is clearly visible. If an individual signs a paper consent document by marking “X,” two witnesses who do not stand to gain anything from the disclosure must wet sign the consent and provide their full mailing addresses. Electronic consents (i.e., Form SSA-3288-OP1) require a valid electronic signature. See GN 03305.001C;

    NOTE: 

    If there is suspicion that the signature is not the record subject's (due to misspellings, illegibility, apparent post-signature changes, or other factors), the field office (FO) may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

  3. 3. 

    The signature must be below the requested information on the consent document and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005);

  4. 4. 

    Specifically state that the Social Security Administration (SSA) may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;

  5. 5. 

    Specify the first and last name and address of the person or organization to whom we should send the requested information;

  6. 6. 

    Describe the requested record(s) in enough detail for us to locate the record(s);

  7. 7. 

    Specify the purpose for which the requester will use the information. This helps us ensure that the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and

  8. 8. 

    Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If an individual wants us to disclose information on an ongoing basis (e.g., each month for 6 months, or quarterly, or annually) using the same consent document, they must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4. The Form SSA-3288-OP1 can only be used for a one-time consent to disclose.

    NOTE: 

    The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.

E. Consent requirements for tax return information

The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of our record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, Internal Revenue Service (IRS) regulations require individuals to meet two additional requirements before we disclose tax return information:

  1. 1. 

    An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid.

    Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent documents in this instance would be Form SSA-3288 or Form SSA-3288-OP1 authorizing the release of medical records and Form SSA-7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)

  2. 2. 

    The consent document must include:

    • The taxpayer's identity;

    • Identity of the person to whom disclosure is to be made;

    • Type of return information;

    • Taxable period; and

    • Signature of taxpayer and the date the authorization was signed.

  3. 3. 

    We must receive the consent document authorizing the disclosure of tax return information within 120 days from the date the individual signs the consent document to meet the IRS time limitation for receipt. Use the fee schedule shown on the SSA-7050-F4 to determine the fee for processing requests for detailed earnings information for non-program purposes. The SSA-7050-F4 advises requesters to send the form, together with the appropriate fee, to the address printed on the form. Do not send an SSA-7050-F4 or other request for detailed earnings information for processing without the appropriate fee, unless the request clearly indicates that the requested earnings information is for a program purpose.

Direct individual requests for summary yearly earnings totals to our online application "my Social Security". For additional information about requests for earnings and disclosing tax return information, see GN 03320.005A and GN 03320.010B.

F. Signature requirements for Privacy Consents

For the purpose of this policy, "Privacy Consents" means consents to disclose SSA records protected under the Privacy Act of 1974 and consents to disclose Federal tax return information.

  1. 1. 

    A "wet" signature (sometimes also referred to as a "pen and ink" signature) is an individual's handwritten signature that has been physically (not electronically) signed. A wet signature is the only signature that we will accept on a paper consent document. See GN 03305.003H for additional guidance.

    We will accept a wet signature, in the form of a wet printed name (versus a cursive signed name) with additional verification. In addition, we will accept a wet “X” marked signature when made in the presence of two witnesses who do not stand to gain anything by the disclosure. Each witness must wet sign the consent document and provide their full mailing address. FOs should use current office procedures for acknowledging receipt of and verifying documents.

    NOTE: 

    If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

    For further information concerning who may provide consent, see GN 03305.005.

  2. 2. 

    We will only accept electronic signatures on the Form SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act. Other means of electronic signature on privacy consents must be approved by OGC for acceptance. In determining the requirements for electronic signature on tax return information consents, we follow the policies or requirements of the Internal Revenue Service.

G. Time limitations for the receipt of consent documents

The following time-frame limitations apply to the receipt of a consent document:

NOTE: 

The Form SSA-3288-OP1 includes these same time-frame limitations; however, the agency receives the Form SSA-3288-OP1 at the same time that the electronic signature is applied.

1. General records information - 1 year

We will honor a valid consent document authorizing the disclosure of agency records that are non-medical and non-tax information (such as claim file information), if we receive the consent document within 1 year from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 1 year has lapsed from the date of the signature and the date we received the request, do not process the request. Follow these steps:

  1. a. 

    Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired; and

  2. b. 

    Ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information to the third party.

2. Medical records information - 90 days

We will honor a valid consent document authorizing the disclosure of medical records information from agency records if we receive the consent document within 90 days from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 90 days has lapsed from the date of the signature and the date we received the request, do not process the request. Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired. In your letter, ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information only.

NOTE: 

If a consent includes a request for medical and non-medical records and is received more than 90 days (but less than 1 year) after execution but no medical records exist, honor the document as a valid request and disclose the non-medical record information only.

For additional requirements regarding access to and disclosure of medical records information, see GN 03340.035.

3. Tax return information - 120 days

We will honor a valid SSA-7050-F4 (or equivalent) consent document authorizing the disclosure of tax return information if we receive the consent document within 120 days from the date of the consenting individual’s signature. Use the earliest date stamped by any SSA component as the date we received the consent document.

If more than 120 days has lapsed from the date of the signature and the date we received the request, do not process the request. Return the consent document to the requester with a letter explaining that the time frame within which we must receive the requested information has expired. In the letter, ask the requester to send us a new consent document if the consenting individual still wants us to release the requested information.

For the specific IRS and SSA requirements for disclosing tax return information, see GN 03305.003E in this section.

H. Acceptable consent documents for non-tax return information

While we prefer the consent forms described in B.1. above, we will accept equivalent consent documents if they meet all of the consent requirements described in GN 03305.003D, GN 03305.003F, and GN 03305.003G in this section, as applicable. We will accept the following types of consent documents that meet the agency’s requirements:

  1. 1. 

    All versions of the SSA-3288 are acceptable if they meet all of the consent requirements for disclosure, as applicable. Return any other consent document that does not meet our requirements to the requester with an explanation of why we cannot honor it. If you return an earlier version of the SSA-3288 to the requester because it is not completed correctly, also provide the most current version of the form.

    NOTE: 

    The address and telephone number of the consenting individual are not mandatory on Form SSA-3288 or other consent forms for the consent to be acceptable. This information assists SSA in contacting the consenting individual if there are questions about the form, but if it is missing from the SSA-3288 or other acceptable consent forms, accept the form anyway.

  2. 2. 

    Fill-in forms are acceptable only if they meet all of the consent requirements, as applicable;

  3. 3. 

    We will accept copies (e.g., photocopies, PDFs or JPEGs) of wet signed consent documents, including the SSA-3288, sent via facsimile, postal mail, or approved electronic means if the copies we receive bear the consenting individual’s wet signature. If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgment in these instances. See GN 03305.003F.2. in this section for circumstances in which electronically signed consents are accepted;

    NOTE: 

    We strongly discourage the public from sending consent documents, or any other documents that contain personally identifiable information, to SSA via unsecure email. Secure email is email sent by a secure partner, encrypted email, or email where the document is password protected.

  4. 4. 

    A consent document patterned after the SSA-3288 or an imitation copy of the SSA-3288 is acceptable if it contains all of the consent requirements, as applicable, and is validly signed (see GN 03305.003F for signature requirements);

  5. 5. 

    A power of attorney document for the disclosure of non-tax return information is generally not acceptable, as these documents do not usually contain all of the consent requirements; only when the power of attorney document contains all of the consent requirements and is validly signed, may it be accepted;

  6. 6. 

    A consent document received within one year from the date of the consenting individual’s signature for non-tax return and non-medical records information is acceptable as described in subsection GN 03305.003G in this section;

  7. 7. 

    A consent document that specifies the time frame for which we may disclose information is acceptable. If using the SSA-3288, the consenting individual may indicate specific time frames in the space allotted for the purpose; and

  8. 8. 

    A consent document that adequately describes the information authorized to be released above the consenting individual’s signature is acceptable.

I. Unacceptable consent documents

Consent documents that are unacceptable and cannot be relied on to disclose records include the following:

  1. 1. 

    A consent document is unacceptable if it appears altered or suspicious (offices must use their own judgment in these instances), or it does not meet the consent or valid signature requirements. For instance, if the list of SSA records requested on the form appears to be altered, replaced, or deleted;

  2. 2. 

    A consent document is unacceptable if the requested information does not appear above the written signature or mark (X) of the consenting individual. However, we may provide any part of the requested records appearing above the consenting individual’s signature if the consent documents satisfies the rest of the requirements in GN 03305.003D, GN 03305.003E, GN 03305.003F, and/or GN 03305.003G in this section;

  3. 3. 

    A consent document is unacceptable if the consenting individual’s (or witnesses’) signature and date of signature, or both are missing, unrecognizable, unclear, illegible, appears traced or otherwise suspicious (offices must use their own judgment in these instances);

  4. 4. 

    A consent document is unacceptable if the individual indicates “any and all records,” “my entire file,” “all my records” or similarly worded phrases. All requesters must specifically indicate the form number or title of the specific record or information for disclosure or describe the requested information in enough detail to enable us to locate the requested information. If the consent document specifies certain records or information for disclosure and also indicates “my entire record” or similar wording, disclose only the specific information that was requested;

  5. 5. 

    A consent document is unacceptable if the overall general appearance of the document appears suspicious (offices must use their own judgment in these instances);

  6. 6. 

    Except for the SSA-3288-OP1 or other electronic consents approved by Office of the General Counsel (OGC), any consent document containing an electronic signature is unacceptable; and

  7. 7. 

    A consent document is unacceptable if the time frame for disclosing the particular type of information has expired. For the time limitations that apply to the receipt of consent documents, see GN 03305.003G in this section.

If any of these conditions exist, return the consent document to the requester with a written explanation of why we cannot honor it. Do not disclose any records until we receive a written consent that meets our consent requirements in GN 03305.003D or GN 03305.003E, as applicable. For subpoenas and court orders, with or without consent, see GN 03330.015.

J. Disclosing medical records

An individual may submit an SSA-3288 (or equivalent) to request the release of their medical records to a third party. However, we have developed special procedures for the disclosure of medical records, including psychological records, pertaining to an individual.

1. Minor’s medical records

A parent or legal guardian, even when acting on behalf of the minor child, may not consent to disclose the minor child's medical records to a third party (20 CFR 401.100(d)). For more information, see subsection GN 03305.005C.4.

2. ADAP records

Medical records relating to alcoholism and drug abuse patients (ADAP) are subject to the Public Health Service regulations that require different handling. For processing consent-based requests for ADAP records, see GN 03305.030.

3. HIPAA records

The Health Insurance Portability and Accountability Act (HIPAA) does not apply to release of SSA records. However, we can accept a HIPAA-compliant authorization if it also meets the requirements listed in GN 03305.003D, GN 03305.003E, GN 03305.003F, and/or GN 03305.003G in this section. If a HIPAA authorization does not meet our consent requirements, return it to the requester with an explanation of why we cannot honor it. If you return a HIPAA authorization request, enclose a current SSA-3288 as a sample of a consent form that would meet our requirements.


To Link to this section - Use this URL:
http://policy.ssa.gov/poms.nsf/lnx/0203305003
GN 03305.003 - Consent Documents - 10/08/2024
Batch run: 10/08/2024
Rev:10/08/2024